# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Oct 25 2018 12:55:11 # Log Creation Date: 01.11.2018 17:12:03.597 Process: id = "1" image_name = "desktop ransomware.exe" filename = "c:\\users\\ciihmnxmn6ps\\desktop\\desktop ransomware.exe" page_root = "0x30a77000" os_pid = "0xdd4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe\" " cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x230000 end_va = 0x2fffff entry_point = 0x230000 region_type = mapped_file name = "desktop ransomware.exe" filename = "\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\desktop ransomware.exe") Region: id = 2 start_va = 0x300000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 3 start_va = 0x320000 end_va = 0x333fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 4 start_va = 0x340000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 5 start_va = 0x440000 end_va = 0x443fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 6 start_va = 0x450000 end_va = 0x450fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 7 start_va = 0x460000 end_va = 0x461fff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 8 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 9 start_va = 0x7ff5ffdf0000 end_va = 0x7ff5ffe12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffdf0000" filename = "" Region: id = 10 start_va = 0x7ff5ffe1b000 end_va = 0x7ff5ffe1bfff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffe1b000" filename = "" Region: id = 11 start_va = 0x7ff5ffe1e000 end_va = 0x7ff5ffe1ffff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffe1e000" filename = "" Region: id = 12 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 152 start_va = 0x550000 end_va = 0x64ffff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 153 start_va = 0x7ff8d6690000 end_va = 0x7ff8d66f7fff entry_point = 0x7ff8d6690000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 154 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 155 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 156 start_va = 0x300000 end_va = 0x30ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000300000" filename = "" Region: id = 157 start_va = 0x310000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 158 start_va = 0x470000 end_va = 0x52dfff entry_point = 0x470000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 159 start_va = 0x530000 end_va = 0x536fff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 160 start_va = 0x7ff5ffcf0000 end_va = 0x7ff5ffdeffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffcf0000" filename = "" Region: id = 161 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 162 start_va = 0x540000 end_va = 0x546fff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 163 start_va = 0x650000 end_va = 0x74ffff entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 164 start_va = 0x7ff5ffe1c000 end_va = 0x7ff5ffe1dfff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffe1c000" filename = "" Region: id = 165 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 166 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 167 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 168 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 169 start_va = 0x750000 end_va = 0x756fff entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 170 start_va = 0x8c0000 end_va = 0x8cffff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 171 start_va = 0x7ff8d6410000 end_va = 0x7ff8d64a6fff entry_point = 0x7ff8d6410000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 172 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 173 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 174 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 175 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 176 start_va = 0x8d0000 end_va = 0xa57fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 177 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 178 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 179 start_va = 0x760000 end_va = 0x760fff entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 180 start_va = 0x770000 end_va = 0x770fff entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 181 start_va = 0xa60000 end_va = 0xbe0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 182 start_va = 0xbf0000 end_va = 0x1feffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bf0000" filename = "" Region: id = 183 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 184 start_va = 0x7ff8e3a50000 end_va = 0x7ff8e3a59fff entry_point = 0x7ff8e3a50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 185 start_va = 0x780000 end_va = 0x780fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 186 start_va = 0x2140000 end_va = 0x214ffff entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 187 start_va = 0x64a10000 end_va = 0x64ad8fff entry_point = 0x64a10000 region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_88e323712fabe0b2\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_88e323712fabe0b2\\msvcr80.dll") Region: id = 188 start_va = 0x7ff8d55a0000 end_va = 0x7ff8d5f3ffff entry_point = 0x7ff8d55a0000 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorwks.dll") Region: id = 189 start_va = 0x20000 end_va = 0x3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 190 start_va = 0x790000 end_va = 0x796fff entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 191 start_va = 0x7a0000 end_va = 0x7a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 192 start_va = 0x7b0000 end_va = 0x7b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 193 start_va = 0x7c0000 end_va = 0x7cffff entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 194 start_va = 0x1ff0000 end_va = 0x20effff entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 195 start_va = 0x7ff5ffe19000 end_va = 0x7ff5ffe1afff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffe19000" filename = "" Region: id = 196 start_va = 0x7ff875e30000 end_va = 0x7ff875e3ffff entry_point = 0x0 region_type = private name = "private_0x00007ff875e30000" filename = "" Region: id = 197 start_va = 0x7ff875e40000 end_va = 0x7ff875e4ffff entry_point = 0x0 region_type = private name = "private_0x00007ff875e40000" filename = "" Region: id = 198 start_va = 0x7ff875e50000 end_va = 0x7ff875eeffff entry_point = 0x0 region_type = private name = "private_0x00007ff875e50000" filename = "" Region: id = 199 start_va = 0x7ff875ef0000 end_va = 0x7ff875efffff entry_point = 0x0 region_type = private name = "private_0x00007ff875ef0000" filename = "" Region: id = 200 start_va = 0x7ff875f00000 end_va = 0x7ff875f6ffff entry_point = 0x0 region_type = private name = "private_0x00007ff875f00000" filename = "" Region: id = 201 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 202 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 203 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 204 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 205 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 206 start_va = 0x7d0000 end_va = 0x7d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 207 start_va = 0x2150000 end_va = 0x2486fff entry_point = 0x2150000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 208 start_va = 0x2490000 end_va = 0x1a48ffff entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 209 start_va = 0x1a490000 end_va = 0x1ab5ffff entry_point = 0x0 region_type = private name = "private_0x000000001a490000" filename = "" Region: id = 210 start_va = 0x1ab60000 end_va = 0x1ac6bfff entry_point = 0x0 region_type = private name = "private_0x000000001ab60000" filename = "" Region: id = 211 start_va = 0x1ac70000 end_va = 0x1ad6ffff entry_point = 0x0 region_type = private name = "private_0x000000001ac70000" filename = "" Region: id = 212 start_va = 0x7ff5ffe17000 end_va = 0x7ff5ffe18fff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffe17000" filename = "" Region: id = 213 start_va = 0x7ff8d46c0000 end_va = 0x7ff8d559dfff entry_point = 0x7ff8d46c0000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\91a4b48cca231bafafe8b8b1de78487c\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mscorlib\\91a4b48cca231bafafe8b8b1de78487c\\mscorlib.ni.dll") Region: id = 214 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 215 start_va = 0x7e0000 end_va = 0x8b5fff entry_point = 0x7e0000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 216 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 217 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 218 start_va = 0x7e0000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 219 start_va = 0x7e0000 end_va = 0x7e2fff entry_point = 0x7e0000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\System32\\l_intl.nls" (normalized: "c:\\windows\\system32\\l_intl.nls") Region: id = 220 start_va = 0x7f0000 end_va = 0x7f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 221 start_va = 0x870000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 222 start_va = 0x7ff5ffc50000 end_va = 0x7ff5ffc5ffff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc50000" filename = "" Region: id = 223 start_va = 0x7ff5ffc60000 end_va = 0x7ff5ffceffff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc60000" filename = "" Region: id = 224 start_va = 0x7ff875f70000 end_va = 0x7ff875f7ffff entry_point = 0x0 region_type = private name = "private_0x00007ff875f70000" filename = "" Region: id = 225 start_va = 0x7ff8d4530000 end_va = 0x7ff8d46b2fff entry_point = 0x7ff8d4530000 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorjit.dll") Region: id = 226 start_va = 0x800000 end_va = 0x80ffff entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 227 start_va = 0x820000 end_va = 0x82ffff entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 228 start_va = 0x830000 end_va = 0x83ffff entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 229 start_va = 0x840000 end_va = 0x84ffff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 230 start_va = 0x850000 end_va = 0x85ffff entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 231 start_va = 0x860000 end_va = 0x86ffff entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 232 start_va = 0x880000 end_va = 0x88ffff entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 233 start_va = 0x8a0000 end_va = 0x8affff entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 234 start_va = 0x7ff875f80000 end_va = 0x7ff875fbffff entry_point = 0x0 region_type = private name = "private_0x00007ff875f80000" filename = "" Region: id = 235 start_va = 0x810000 end_va = 0x81ffff entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 236 start_va = 0x880000 end_va = 0x884fff entry_point = 0x880000 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 237 start_va = 0x890000 end_va = 0x89ffff entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 238 start_va = 0x8b0000 end_va = 0x8bffff entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 239 start_va = 0x20f0000 end_va = 0x2130fff entry_point = 0x20f0000 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 240 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 241 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 242 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 243 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 244 start_va = 0x8a0000 end_va = 0x8affff entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 245 start_va = 0x1ad70000 end_va = 0x1aefdfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad70000" filename = "" Region: id = 246 start_va = 0x1af00000 end_va = 0x1af0ffff entry_point = 0x0 region_type = private name = "private_0x000000001af00000" filename = "" Region: id = 247 start_va = 0x1af10000 end_va = 0x1af1ffff entry_point = 0x0 region_type = private name = "private_0x000000001af10000" filename = "" Region: id = 248 start_va = 0x1afa0000 end_va = 0x1afaffff entry_point = 0x0 region_type = private name = "private_0x000000001afa0000" filename = "" Region: id = 249 start_va = 0x810000 end_va = 0x81ffff entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 250 start_va = 0x860000 end_va = 0x86ffff entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 251 start_va = 0x1afb0000 end_va = 0x1b0affff entry_point = 0x0 region_type = private name = "private_0x000000001afb0000" filename = "" Region: id = 252 start_va = 0x1b0b0000 end_va = 0x1b1affff entry_point = 0x0 region_type = private name = "private_0x000000001b0b0000" filename = "" Region: id = 253 start_va = 0x7ff5ffe13000 end_va = 0x7ff5ffe14fff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffe13000" filename = "" Region: id = 254 start_va = 0x7ff5ffe15000 end_va = 0x7ff5ffe16fff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffe15000" filename = "" Region: id = 255 start_va = 0x7ff875fc0000 end_va = 0x7ff875fcffff entry_point = 0x0 region_type = private name = "private_0x00007ff875fc0000" filename = "" Region: id = 256 start_va = 0x7ff875fd0000 end_va = 0x7ff875fdffff entry_point = 0x0 region_type = private name = "private_0x00007ff875fd0000" filename = "" Region: id = 257 start_va = 0x7ff875fe0000 end_va = 0x7ff875feffff entry_point = 0x0 region_type = private name = "private_0x00007ff875fe0000" filename = "" Region: id = 258 start_va = 0x7ff8d1e20000 end_va = 0x7ff8d2036fff entry_point = 0x7ff8d1e20000 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\bde59184523338805781cc9011ff59e6\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualbas#\\bde59184523338805781cc9011ff59e6\\microsoft.visualbasic.ni.dll") Region: id = 259 start_va = 0x7ff8d25c0000 end_va = 0x7ff8d3658fff entry_point = 0x7ff8d25c0000 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\5fe233ef56ecdbb4a7988d361ebd2f15\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.windows.forms\\5fe233ef56ecdbb4a7988d361ebd2f15\\system.windows.forms.ni.dll") Region: id = 260 start_va = 0x7ff8d3740000 end_va = 0x7ff8d3978fff entry_point = 0x7ff8d3740000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\42eea894b0e7aa6b1d8cc17b26f93de5\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.drawing\\42eea894b0e7aa6b1d8cc17b26f93de5\\system.drawing.ni.dll") Region: id = 261 start_va = 0x7ff8d3b00000 end_va = 0x7ff8d452ffff entry_point = 0x7ff8d3b00000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\042a21e47eb8693a9393028c639e93c6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system\\042a21e47eb8693a9393028c639e93c6\\system.ni.dll") Region: id = 262 start_va = 0x890000 end_va = 0x89ffff entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 263 start_va = 0x1af10000 end_va = 0x1af1ffff entry_point = 0x0 region_type = private name = "private_0x000000001af10000" filename = "" Region: id = 264 start_va = 0x7ff875ff0000 end_va = 0x7ff875ffffff entry_point = 0x0 region_type = private name = "private_0x00007ff875ff0000" filename = "" Region: id = 265 start_va = 0x1af20000 end_va = 0x1af30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001af20000" filename = "" Region: id = 266 start_va = 0x7ff876000000 end_va = 0x7ff87600ffff entry_point = 0x0 region_type = private name = "private_0x00007ff876000000" filename = "" Region: id = 267 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 268 start_va = 0x820000 end_va = 0x82ffff entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 269 start_va = 0x8b0000 end_va = 0x8bffff entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 270 start_va = 0x1af00000 end_va = 0x1af0ffff entry_point = 0x0 region_type = private name = "private_0x000000001af00000" filename = "" Region: id = 271 start_va = 0x1af40000 end_va = 0x1af4ffff entry_point = 0x0 region_type = private name = "private_0x000000001af40000" filename = "" Region: id = 272 start_va = 0x7ff8d9a40000 end_va = 0x7ff8d9be8fff entry_point = 0x7ff8d9a40000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_89a94c179af51f83\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_89a94c179af51f83\\gdiplus.dll") Region: id = 273 start_va = 0x1b1b0000 end_va = 0x1b2cffff entry_point = 0x0 region_type = private name = "private_0x000000001b1b0000" filename = "" Region: id = 274 start_va = 0x1b1b0000 end_va = 0x1b2affff entry_point = 0x0 region_type = private name = "private_0x000000001b1b0000" filename = "" Region: id = 275 start_va = 0x1b2c0000 end_va = 0x1b2cffff entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 276 start_va = 0x7ff5ffc4e000 end_va = 0x7ff5ffc4ffff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc4e000" filename = "" Region: id = 277 start_va = 0x7ff8e37f0000 end_va = 0x7ff8e3a48fff entry_point = 0x7ff8e37f0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 278 start_va = 0x1b2d0000 end_va = 0x1b345fff entry_point = 0x1b2d0000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 279 start_va = 0x1b350000 end_va = 0x1b44ffff entry_point = 0x0 region_type = private name = "private_0x000000001b350000" filename = "" Region: id = 280 start_va = 0x1b450000 end_va = 0x1c44ffff entry_point = 0x1b450000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 281 start_va = 0x810000 end_va = 0x816fff entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 282 start_va = 0x1c450000 end_va = 0x1c54ffff entry_point = 0x0 region_type = private name = "private_0x000000001c450000" filename = "" Region: id = 283 start_va = 0x1c550000 end_va = 0x1ca41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001c550000" filename = "" Region: id = 284 start_va = 0x860000 end_va = 0x86ffff entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 285 start_va = 0x890000 end_va = 0x89ffff entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 286 start_va = 0x8a0000 end_va = 0x8a6fff entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 287 start_va = 0x850000 end_va = 0x850fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 288 start_va = 0x8b0000 end_va = 0x8bffff entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 289 start_va = 0x1af00000 end_va = 0x1af0ffff entry_point = 0x0 region_type = private name = "private_0x000000001af00000" filename = "" Region: id = 290 start_va = 0x7ff8d6680000 end_va = 0x7ff8d6689fff entry_point = 0x7ff8d6680000 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\culture.dll") Region: id = 291 start_va = 0x1af50000 end_va = 0x1afa3fff entry_point = 0x1af50000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorrc.dll") Region: id = 292 start_va = 0x7ff8e86a0000 end_va = 0x7ff8e8851fff entry_point = 0x7ff8e86a0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 293 start_va = 0x1ca50000 end_va = 0x1cb6dfff entry_point = 0x0 region_type = private name = "private_0x000000001ca50000" filename = "" Region: id = 294 start_va = 0x1cb70000 end_va = 0x1cc6ffff entry_point = 0x0 region_type = private name = "private_0x000000001cb70000" filename = "" Region: id = 295 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 296 start_va = 0x1cc70000 end_va = 0x1cd6ffff entry_point = 0x0 region_type = private name = "private_0x000000001cc70000" filename = "" Region: id = 297 start_va = 0x1cd70000 end_va = 0x1ce6ffff entry_point = 0x0 region_type = private name = "private_0x000000001cd70000" filename = "" Region: id = 298 start_va = 0x1ce70000 end_va = 0x1cf6ffff entry_point = 0x0 region_type = private name = "private_0x000000001ce70000" filename = "" Region: id = 299 start_va = 0x1cf70000 end_va = 0x1d06ffff entry_point = 0x0 region_type = private name = "private_0x000000001cf70000" filename = "" Region: id = 300 start_va = 0x7ff5ffc48000 end_va = 0x7ff5ffc49fff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc48000" filename = "" Region: id = 301 start_va = 0x7ff5ffc4a000 end_va = 0x7ff5ffc4bfff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc4a000" filename = "" Region: id = 302 start_va = 0x7ff5ffc4c000 end_va = 0x7ff5ffc4dfff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc4c000" filename = "" Region: id = 303 start_va = 0x850000 end_va = 0x85ffff entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 304 start_va = 0x1af10000 end_va = 0x1af1ffff entry_point = 0x0 region_type = private name = "private_0x000000001af10000" filename = "" Region: id = 305 start_va = 0x1d070000 end_va = 0x1d86ffff entry_point = 0x1d070000 region_type = mapped_file name = "~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1462094071-1423818996-289466292-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat") Region: id = 306 start_va = 0x1d870000 end_va = 0x1dc6ffff entry_point = 0x0 region_type = private name = "private_0x000000001d870000" filename = "" Region: id = 307 start_va = 0x1dc70000 end_va = 0x1dd2afff entry_point = 0x1dc70000 region_type = mapped_file name = "tahomabd.ttf" filename = "\\Windows\\Fonts\\tahomabd.ttf" (normalized: "c:\\windows\\fonts\\tahomabd.ttf") Region: id = 308 start_va = 0x800000 end_va = 0x800fff entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 309 start_va = 0x860000 end_va = 0x860fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 310 start_va = 0x1dd30000 end_va = 0x1dde7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dd30000" filename = "" Region: id = 311 start_va = 0x860000 end_va = 0x863fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 312 start_va = 0x1ddf0000 end_va = 0x1df1afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ddf0000" filename = "" Region: id = 313 start_va = 0x1b2b0000 end_va = 0x1b2b6fff entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 314 start_va = 0x1df20000 end_va = 0x1ef5ffff entry_point = 0x1df20000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 315 start_va = 0x1ef60000 end_va = 0x1ef60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ef60000" filename = "" Region: id = 316 start_va = 0x7ff876010000 end_va = 0x7ff87601ffff entry_point = 0x0 region_type = private name = "private_0x00007ff876010000" filename = "" Region: id = 317 start_va = 0x7ff876020000 end_va = 0x7ff87602ffff entry_point = 0x0 region_type = private name = "private_0x00007ff876020000" filename = "" Region: id = 318 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 319 start_va = 0x1ef60000 end_va = 0x1ef60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ef60000" filename = "" Region: id = 320 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 321 start_va = 0x1ef70000 end_va = 0x1ef70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ef70000" filename = "" Region: id = 322 start_va = 0x1ef80000 end_va = 0x1ef83fff entry_point = 0x1ef80000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 323 start_va = 0x1ef90000 end_va = 0x1efd2fff entry_point = 0x1ef90000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db") Region: id = 324 start_va = 0x1efe0000 end_va = 0x1efe3fff entry_point = 0x1efe0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 325 start_va = 0x1eff0000 end_va = 0x1f07afff entry_point = 0x1eff0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 326 start_va = 0x1f080000 end_va = 0x1f090fff entry_point = 0x1f080000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 327 start_va = 0x1f0a0000 end_va = 0x1f0a3fff entry_point = 0x1f0a0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 328 start_va = 0x1f0b0000 end_va = 0x1f0c2fff entry_point = 0x1f0b0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 329 start_va = 0x1f0d0000 end_va = 0x1f0d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f0d0000" filename = "" Region: id = 330 start_va = 0x1f0e0000 end_va = 0x1f1dffff entry_point = 0x0 region_type = private name = "private_0x000000001f0e0000" filename = "" Region: id = 331 start_va = 0x7ff5ffc46000 end_va = 0x7ff5ffc47fff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc46000" filename = "" Region: id = 332 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 333 start_va = 0x7ff8e0a60000 end_va = 0x7ff8e0bf6fff entry_point = 0x7ff8e0a60000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 334 start_va = 0x1f1e0000 end_va = 0x1f2dffff entry_point = 0x0 region_type = private name = "private_0x000000001f1e0000" filename = "" Region: id = 335 start_va = 0x7ff5ffc44000 end_va = 0x7ff5ffc45fff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc44000" filename = "" Region: id = 336 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 337 start_va = 0x7ff8ea9d0000 end_va = 0x7ff8ea9fbfff entry_point = 0x7ff8ea9d0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 338 start_va = 0x1f2e0000 end_va = 0x1f3dffff entry_point = 0x0 region_type = private name = "private_0x000000001f2e0000" filename = "" Region: id = 339 start_va = 0x1f0a0000 end_va = 0x1f0a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f0a0000" filename = "" Region: id = 340 start_va = 0x7ff5ff8b0000 end_va = 0x7ff5ffc3ffff entry_point = 0x7ff5ff8b0000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 370 start_va = 0x1ddf0000 end_va = 0x1df1afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ddf0000" filename = "" Region: id = 371 start_va = 0x7ff8d18c0000 end_va = 0x7ff8d1969fff entry_point = 0x7ff8d18c0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_0212ec7eba871e86\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_0212ec7eba871e86\\comctl32.dll") Region: id = 372 start_va = 0x1f3e0000 end_va = 0x1f55ffff entry_point = 0x0 region_type = private name = "private_0x000000001f3e0000" filename = "" Region: id = 373 start_va = 0x1f3e0000 end_va = 0x1f3e4fff entry_point = 0x0 region_type = private name = "private_0x000000001f3e0000" filename = "" Region: id = 374 start_va = 0x1f550000 end_va = 0x1f55ffff entry_point = 0x0 region_type = private name = "private_0x000000001f550000" filename = "" Region: id = 375 start_va = 0x1f3f0000 end_va = 0x1f3f0fff entry_point = 0x0 region_type = private name = "private_0x000000001f3f0000" filename = "" Region: id = 450 start_va = 0x1ddf0000 end_va = 0x1deeffff entry_point = 0x0 region_type = private name = "private_0x000000001ddf0000" filename = "" Region: id = 451 start_va = 0x1f400000 end_va = 0x1f52afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f400000" filename = "" Region: id = 452 start_va = 0x7ff5ffc42000 end_va = 0x7ff5ffc43fff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc42000" filename = "" Region: id = 453 start_va = 0x1def0000 end_va = 0x1def4fff entry_point = 0x0 region_type = private name = "private_0x000000001def0000" filename = "" Region: id = 454 start_va = 0x1df00000 end_va = 0x1df15fff entry_point = 0x0 region_type = private name = "private_0x000000001df00000" filename = "" Region: id = 455 start_va = 0x1f3e0000 end_va = 0x1f3e0fff entry_point = 0x0 region_type = private name = "private_0x000000001f3e0000" filename = "" Region: id = 456 start_va = 0x1df00000 end_va = 0x1df19fff entry_point = 0x0 region_type = private name = "private_0x000000001df00000" filename = "" Region: id = 457 start_va = 0x1f560000 end_va = 0x1f669fff entry_point = 0x0 region_type = private name = "private_0x000000001f560000" filename = "" Region: id = 458 start_va = 0x1f670000 end_va = 0x1f779fff entry_point = 0x0 region_type = private name = "private_0x000000001f670000" filename = "" Region: id = 459 start_va = 0x1df00000 end_va = 0x1df00fff entry_point = 0x0 region_type = private name = "private_0x000000001df00000" filename = "" Region: id = 460 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 461 start_va = 0x7ff8d6770000 end_va = 0x7ff8d7368fff entry_point = 0x7ff8d6770000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 462 start_va = 0x1df10000 end_va = 0x1df12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001df10000" filename = "" Region: id = 463 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 464 start_va = 0x1f3e0000 end_va = 0x1f3e7fff entry_point = 0x1f3e0000 region_type = mapped_file name = "windows.storage.dll.mui" filename = "\\Windows\\System32\\en-US\\windows.storage.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.storage.dll.mui") Region: id = 465 start_va = 0x1f3f0000 end_va = 0x1f3f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f3f0000" filename = "" Region: id = 466 start_va = 0x1f560000 end_va = 0x1f5c0fff entry_point = 0x1f560000 region_type = mapped_file name = "shell32.dll.mui" filename = "\\Windows\\System32\\en-US\\shell32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\shell32.dll.mui") Region: id = 467 start_va = 0x7ff8e5480000 end_va = 0x7ff8e548bfff entry_point = 0x7ff8e5480000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 468 start_va = 0x7ff8d7c60000 end_va = 0x7ff8d7c9cfff entry_point = 0x7ff8d7c60000 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll") Region: id = 469 start_va = 0x7ff8dff00000 end_va = 0x7ff8e01a6fff entry_point = 0x7ff8dff00000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 470 start_va = 0x1f530000 end_va = 0x1f530fff entry_point = 0x1f530000 region_type = mapped_file name = "counters.dat" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 471 start_va = 0x1f540000 end_va = 0x1f54ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f540000" filename = "" Region: id = 553 start_va = 0x1f5d0000 end_va = 0x1f6cffff entry_point = 0x0 region_type = private name = "private_0x000000001f5d0000" filename = "" Region: id = 554 start_va = 0x7ff5ffc40000 end_va = 0x7ff5ffc41fff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc40000" filename = "" Region: id = 555 start_va = 0x1f400000 end_va = 0x1f52afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f400000" filename = "" Region: id = 624 start_va = 0x1f6d0000 end_va = 0x1f7cffff entry_point = 0x0 region_type = private name = "private_0x000000001f6d0000" filename = "" Region: id = 625 start_va = 0x7ff5ffc3e000 end_va = 0x7ff5ffc3ffff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc3e000" filename = "" Region: id = 626 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 627 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 628 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 629 start_va = 0x1f7d0000 end_va = 0x1f7f9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f7d0000" filename = "" Region: id = 630 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 1123 start_va = 0x1f400000 end_va = 0x1f52afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f400000" filename = "" Region: id = 1300 start_va = 0x1f5d0000 end_va = 0x1f6cffff entry_point = 0x0 region_type = private name = "private_0x000000001f5d0000" filename = "" Region: id = 1301 start_va = 0x7ff5ffc40000 end_va = 0x7ff5ffc41fff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc40000" filename = "" Region: id = 1619 start_va = 0x1f800000 end_va = 0x1f8fffff entry_point = 0x0 region_type = private name = "private_0x000000001f800000" filename = "" Region: id = 1620 start_va = 0x7ff5ffc3c000 end_va = 0x7ff5ffc3dfff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc3c000" filename = "" Region: id = 1698 start_va = 0x1f6d0000 end_va = 0x1f7cffff entry_point = 0x0 region_type = private name = "private_0x000000001f6d0000" filename = "" Region: id = 1699 start_va = 0x7ff5ffc3e000 end_va = 0x7ff5ffc3ffff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc3e000" filename = "" Region: id = 1700 start_va = 0x1f400000 end_va = 0x1f52afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f400000" filename = "" Region: id = 1842 start_va = 0x1f5d0000 end_va = 0x1f6cffff entry_point = 0x0 region_type = private name = "private_0x000000001f5d0000" filename = "" Region: id = 1843 start_va = 0x7ff5ffc40000 end_va = 0x7ff5ffc41fff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc40000" filename = "" Region: id = 1844 start_va = 0x1f400000 end_va = 0x1f52afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f400000" filename = "" Region: id = 1965 start_va = 0x1f6d0000 end_va = 0x1f7cffff entry_point = 0x0 region_type = private name = "private_0x000000001f6d0000" filename = "" Region: id = 1966 start_va = 0x7ff5ffc3e000 end_va = 0x7ff5ffc3ffff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc3e000" filename = "" Region: id = 1967 start_va = 0x1f400000 end_va = 0x1f52afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f400000" filename = "" Region: id = 2213 start_va = 0x1f800000 end_va = 0x1f8fffff entry_point = 0x0 region_type = private name = "private_0x000000001f800000" filename = "" Region: id = 2214 start_va = 0x7ff5ffc3c000 end_va = 0x7ff5ffc3dfff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc3c000" filename = "" Region: id = 2395 start_va = 0x1f5d0000 end_va = 0x1f6cffff entry_point = 0x0 region_type = private name = "private_0x000000001f5d0000" filename = "" Region: id = 2396 start_va = 0x7ff5ffc40000 end_va = 0x7ff5ffc41fff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc40000" filename = "" Region: id = 2397 start_va = 0x1f400000 end_va = 0x1f52afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f400000" filename = "" Region: id = 2758 start_va = 0x1f6d0000 end_va = 0x1f7cffff entry_point = 0x0 region_type = private name = "private_0x000000001f6d0000" filename = "" Region: id = 2759 start_va = 0x7ff5ffc3e000 end_va = 0x7ff5ffc3ffff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc3e000" filename = "" Region: id = 2779 start_va = 0x1f5d0000 end_va = 0x1f6cffff entry_point = 0x0 region_type = private name = "private_0x000000001f5d0000" filename = "" Region: id = 2780 start_va = 0x1f800000 end_va = 0x1f8fffff entry_point = 0x0 region_type = private name = "private_0x000000001f800000" filename = "" Region: id = 2781 start_va = 0x7ff5ffc3c000 end_va = 0x7ff5ffc3dfff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc3c000" filename = "" Region: id = 2782 start_va = 0x7ff5ffc40000 end_va = 0x7ff5ffc41fff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc40000" filename = "" Region: id = 2894 start_va = 0x1f400000 end_va = 0x1f52afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f400000" filename = "" Region: id = 2920 start_va = 0x1f400000 end_va = 0x1f402fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f400000" filename = "" Region: id = 2921 start_va = 0x1f6d0000 end_va = 0x1f7cffff entry_point = 0x0 region_type = private name = "private_0x000000001f6d0000" filename = "" Region: id = 2922 start_va = 0x7ff5ffc3e000 end_va = 0x7ff5ffc3ffff entry_point = 0x0 region_type = private name = "private_0x00007ff5ffc3e000" filename = "" Region: id = 3059 start_va = 0x1f900000 end_va = 0x1fa2afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f900000" filename = "" Region: id = 3086 start_va = 0x1f400000 end_va = 0x1f509fff entry_point = 0x0 region_type = private name = "private_0x000000001f400000" filename = "" Region: id = 3087 start_va = 0x1f5d0000 end_va = 0x1f6d9fff entry_point = 0x0 region_type = private name = "private_0x000000001f5d0000" filename = "" Thread: id = 1 os_tid = 0xdd8 [0044.276] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0045.345] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", nBufferLength=0x105, lpBuffer=0x43e010, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", lpFilePart=0x0) returned 0x34 [0045.364] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", nBufferLength=0x105, lpBuffer=0x43df50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", lpFilePart=0x0) returned 0x34 [0045.368] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", nBufferLength=0x105, lpBuffer=0x43de60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpFilePart=0x0) returned 0x1e [0045.378] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", nBufferLength=0x105, lpBuffer=0x43e050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpFilePart=0x0) returned 0x1e [0045.378] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", nBufferLength=0x105, lpBuffer=0x43df50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpFilePart=0x0) returned 0x1e [0045.397] GetVersionExW (in: lpVersionInformation=0x43dfb0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x43dfb0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0045.465] GetVersionExW (in: lpVersionInformation=0x43dfb0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x43dfb0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0047.130] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", nBufferLength=0x105, lpBuffer=0x43d6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", lpFilePart=0x0) returned 0x34 [0047.130] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", nBufferLength=0x105, lpBuffer=0x43d530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", lpFilePart=0x0) returned 0x34 [0047.237] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x43d2d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0047.303] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x43d3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0047.303] GetVersionExW (in: lpVersionInformation=0x43d470*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x43d470*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0047.307] SetErrorMode (uMode=0x1) returned 0x0 [0047.308] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x43d5d0 | out: lpFileInformation=0x43d5d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436072d, ftCreationTime.dwHighDateTime=0x1d2d447, ftLastAccessTime.dwLowDateTime=0x1449f42, ftLastAccessTime.dwHighDateTime=0x1d2d447, ftLastWriteTime.dwLowDateTime=0x95baafb, ftLastWriteTime.dwHighDateTime=0x1d2d447, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0047.309] SetErrorMode (uMode=0x0) returned 0x1 [0047.309] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x43d370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0047.309] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x43d240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0047.591] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x43cf50 | out: pfEnabled=0x43cf50) returned 0x0 [0047.594] GetVersionExW (in: lpVersionInformation=0x43cd60*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x43cd60*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0048.035] VirtualProtect (in: lpAddress=0x23253c, dwSize=0x37d, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.036] VirtualProtect (in: lpAddress=0x23253c, dwSize=0x37d, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.036] VirtualProtect (in: lpAddress=0x2328bc, dwSize=0x5b5, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.036] VirtualProtect (in: lpAddress=0x2328bc, dwSize=0x5b5, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.037] VirtualProtect (in: lpAddress=0x232e74, dwSize=0x3bf, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.037] VirtualProtect (in: lpAddress=0x232e74, dwSize=0x3bf, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.037] VirtualProtect (in: lpAddress=0x233244, dwSize=0x4b, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.037] VirtualProtect (in: lpAddress=0x233244, dwSize=0x4b, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.037] VirtualProtect (in: lpAddress=0x233290, dwSize=0x32, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.037] VirtualProtect (in: lpAddress=0x233290, dwSize=0x32, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.037] VirtualProtect (in: lpAddress=0x2332c4, dwSize=0x86, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.037] VirtualProtect (in: lpAddress=0x2332c4, dwSize=0x86, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.037] VirtualProtect (in: lpAddress=0x23334c, dwSize=0x4e, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.037] VirtualProtect (in: lpAddress=0x23334c, dwSize=0x4e, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x23339c, dwSize=0x46, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x23339c, dwSize=0x46, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x2333e4, dwSize=0x3e, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x2333e4, dwSize=0x3e, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x233424, dwSize=0x64, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x233424, dwSize=0x64, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x233488, dwSize=0x58, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x233488, dwSize=0x58, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x2334e0, dwSize=0x52, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x2334e0, dwSize=0x52, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x233534, dwSize=0xc8, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x233534, dwSize=0xc8, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x2335fc, dwSize=0x3db, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x2335fc, dwSize=0x3db, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.038] VirtualProtect (in: lpAddress=0x2339f4, dwSize=0x59, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.039] VirtualProtect (in: lpAddress=0x2339f4, dwSize=0x59, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.039] VirtualProtect (in: lpAddress=0x233a50, dwSize=0x5a, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.039] VirtualProtect (in: lpAddress=0x233a50, dwSize=0x5a, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.039] VirtualProtect (in: lpAddress=0x233aac, dwSize=0x32, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.039] VirtualProtect (in: lpAddress=0x233aac, dwSize=0x32, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.039] VirtualProtect (in: lpAddress=0x233ae0, dwSize=0x38, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.039] VirtualProtect (in: lpAddress=0x233ae0, dwSize=0x38, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.039] VirtualProtect (in: lpAddress=0x233b18, dwSize=0x4a, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.039] VirtualProtect (in: lpAddress=0x233b18, dwSize=0x4a, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.039] VirtualProtect (in: lpAddress=0x233b64, dwSize=0x58, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.039] VirtualProtect (in: lpAddress=0x233b64, dwSize=0x58, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.039] VirtualProtect (in: lpAddress=0x233bbc, dwSize=0x7a, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.039] VirtualProtect (in: lpAddress=0x233bbc, dwSize=0x7a, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.039] VirtualProtect (in: lpAddress=0x233c38, dwSize=0x4a, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.040] VirtualProtect (in: lpAddress=0x233c38, dwSize=0x4a, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.040] VirtualProtect (in: lpAddress=0x233c84, dwSize=0x74, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.040] VirtualProtect (in: lpAddress=0x233c84, dwSize=0x74, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.040] VirtualProtect (in: lpAddress=0x233cf8, dwSize=0x46, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.040] VirtualProtect (in: lpAddress=0x233cf8, dwSize=0x46, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.040] VirtualProtect (in: lpAddress=0x233d40, dwSize=0x82, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.040] VirtualProtect (in: lpAddress=0x233d40, dwSize=0x82, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.040] VirtualProtect (in: lpAddress=0x233dc4, dwSize=0x3c, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.040] VirtualProtect (in: lpAddress=0x233dc4, dwSize=0x3c, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.041] VirtualProtect (in: lpAddress=0x233e00, dwSize=0x44, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.041] VirtualProtect (in: lpAddress=0x233e00, dwSize=0x44, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.041] VirtualProtect (in: lpAddress=0x233e44, dwSize=0x9a, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.041] VirtualProtect (in: lpAddress=0x233e44, dwSize=0x9a, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.041] VirtualProtect (in: lpAddress=0x233ee0, dwSize=0x54, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.041] VirtualProtect (in: lpAddress=0x233ee0, dwSize=0x54, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.041] VirtualProtect (in: lpAddress=0x233f34, dwSize=0x36, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.041] VirtualProtect (in: lpAddress=0x233f34, dwSize=0x36, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.041] VirtualProtect (in: lpAddress=0x233f6c, dwSize=0xbc, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.041] VirtualProtect (in: lpAddress=0x233f6c, dwSize=0xbc, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.042] VirtualProtect (in: lpAddress=0x234028, dwSize=0x2eb, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.042] VirtualProtect (in: lpAddress=0x234028, dwSize=0x2eb, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.042] VirtualProtect (in: lpAddress=0x234330, dwSize=0x3a, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.042] VirtualProtect (in: lpAddress=0x234330, dwSize=0x3a, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.042] VirtualProtect (in: lpAddress=0x23436c, dwSize=0x12c, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.042] VirtualProtect (in: lpAddress=0x23436c, dwSize=0x12c, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.042] VirtualProtect (in: lpAddress=0x2344a8, dwSize=0x151a, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.042] VirtualProtect (in: lpAddress=0x2344a8, dwSize=0x151a, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.043] VirtualProtect (in: lpAddress=0x2359c4, dwSize=0x51, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.043] VirtualProtect (in: lpAddress=0x2359c4, dwSize=0x51, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.043] VirtualProtect (in: lpAddress=0x235a18, dwSize=0x53, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.043] VirtualProtect (in: lpAddress=0x235a18, dwSize=0x53, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.043] VirtualProtect (in: lpAddress=0x235a6c, dwSize=0x45, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.043] VirtualProtect (in: lpAddress=0x235a6c, dwSize=0x45, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.043] VirtualProtect (in: lpAddress=0x235ab4, dwSize=0x3d, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.043] VirtualProtect (in: lpAddress=0x235ab4, dwSize=0x3d, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.043] VirtualProtect (in: lpAddress=0x235af4, dwSize=0x2b, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.043] VirtualProtect (in: lpAddress=0x235af4, dwSize=0x2b, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.043] VirtualProtect (in: lpAddress=0x235b20, dwSize=0x39, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.043] VirtualProtect (in: lpAddress=0x235b20, dwSize=0x39, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.043] VirtualProtect (in: lpAddress=0x235b5c, dwSize=0x2b, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.043] VirtualProtect (in: lpAddress=0x235b5c, dwSize=0x2b, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235b88, dwSize=0x23, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235b88, dwSize=0x23, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235bac, dwSize=0x3f, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235bac, dwSize=0x3f, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235bec, dwSize=0x57, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235bec, dwSize=0x57, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235c44, dwSize=0x4d, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235c44, dwSize=0x4d, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235c94, dwSize=0xce, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235c94, dwSize=0xce, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235d64, dwSize=0x47, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235d64, dwSize=0x47, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235dac, dwSize=0x23, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235dac, dwSize=0x23, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.044] VirtualProtect (in: lpAddress=0x235dd0, dwSize=0x43, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.045] VirtualProtect (in: lpAddress=0x235dd0, dwSize=0x43, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.045] VirtualProtect (in: lpAddress=0x235e14, dwSize=0x49, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.045] VirtualProtect (in: lpAddress=0x235e14, dwSize=0x49, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.045] VirtualProtect (in: lpAddress=0x235e60, dwSize=0x39, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.045] VirtualProtect (in: lpAddress=0x235e60, dwSize=0x39, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.045] VirtualProtect (in: lpAddress=0x235e9c, dwSize=0xf7, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.045] VirtualProtect (in: lpAddress=0x235e9c, dwSize=0xf7, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.045] VirtualProtect (in: lpAddress=0x235f94, dwSize=0xe9, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.045] VirtualProtect (in: lpAddress=0x235f94, dwSize=0xe9, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.045] VirtualProtect (in: lpAddress=0x236080, dwSize=0x6d, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.046] VirtualProtect (in: lpAddress=0x236080, dwSize=0x6d, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.046] VirtualProtect (in: lpAddress=0x2360f0, dwSize=0x5a, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.046] VirtualProtect (in: lpAddress=0x2360f0, dwSize=0x5a, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.046] VirtualProtect (in: lpAddress=0x23614c, dwSize=0x28f, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.046] VirtualProtect (in: lpAddress=0x23614c, dwSize=0x28f, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.046] VirtualProtect (in: lpAddress=0x2363dc, dwSize=0x6e, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.046] VirtualProtect (in: lpAddress=0x2363dc, dwSize=0x6e, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.046] VirtualProtect (in: lpAddress=0x23644c, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.046] VirtualProtect (in: lpAddress=0x23644c, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.046] VirtualProtect (in: lpAddress=0x2364c4, dwSize=0x60, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.046] VirtualProtect (in: lpAddress=0x2364c4, dwSize=0x60, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.046] VirtualProtect (in: lpAddress=0x236524, dwSize=0x70, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.046] VirtualProtect (in: lpAddress=0x236524, dwSize=0x70, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.047] VirtualProtect (in: lpAddress=0x236594, dwSize=0x84, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.047] VirtualProtect (in: lpAddress=0x236594, dwSize=0x84, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.047] VirtualProtect (in: lpAddress=0x236618, dwSize=0x76, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.047] VirtualProtect (in: lpAddress=0x236618, dwSize=0x76, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.047] VirtualProtect (in: lpAddress=0x236690, dwSize=0x76, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.047] VirtualProtect (in: lpAddress=0x236690, dwSize=0x76, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.047] VirtualProtect (in: lpAddress=0x236708, dwSize=0x62, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.047] VirtualProtect (in: lpAddress=0x236708, dwSize=0x62, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.047] VirtualProtect (in: lpAddress=0x23676c, dwSize=0x7c, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.047] VirtualProtect (in: lpAddress=0x23676c, dwSize=0x7c, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.047] VirtualProtect (in: lpAddress=0x2367e8, dwSize=0x88, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.047] VirtualProtect (in: lpAddress=0x2367e8, dwSize=0x88, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.047] VirtualProtect (in: lpAddress=0x236870, dwSize=0x8f, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.047] VirtualProtect (in: lpAddress=0x236870, dwSize=0x8f, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x236900, dwSize=0x61, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x236900, dwSize=0x61, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x236964, dwSize=0x57, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x236964, dwSize=0x57, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x2369bc, dwSize=0x6a, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x2369bc, dwSize=0x6a, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x236a28, dwSize=0x8a, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x236a28, dwSize=0x8a, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x236ab4, dwSize=0x96, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x236ab4, dwSize=0x96, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x236b4c, dwSize=0x70, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x236b4c, dwSize=0x70, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x236bbc, dwSize=0x60, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x236bbc, dwSize=0x60, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.048] VirtualProtect (in: lpAddress=0x236c1c, dwSize=0x31, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.049] VirtualProtect (in: lpAddress=0x236c1c, dwSize=0x31, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.049] VirtualProtect (in: lpAddress=0x236c50, dwSize=0x5b, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.049] VirtualProtect (in: lpAddress=0x236c50, dwSize=0x5b, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.049] VirtualProtect (in: lpAddress=0x236cac, dwSize=0x59, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.049] VirtualProtect (in: lpAddress=0x236cac, dwSize=0x59, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.049] VirtualProtect (in: lpAddress=0x236d08, dwSize=0x10, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.049] VirtualProtect (in: lpAddress=0x236d08, dwSize=0x10, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.049] VirtualProtect (in: lpAddress=0x236d18, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.049] VirtualProtect (in: lpAddress=0x236d18, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.049] VirtualProtect (in: lpAddress=0x236d20, dwSize=0x9, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.049] VirtualProtect (in: lpAddress=0x236d20, dwSize=0x9, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.049] VirtualProtect (in: lpAddress=0x236d2c, dwSize=0x3a, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.049] VirtualProtect (in: lpAddress=0x236d2c, dwSize=0x3a, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.049] VirtualProtect (in: lpAddress=0x236d68, dwSize=0x16, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236d68, dwSize=0x16, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236d80, dwSize=0x16, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236d80, dwSize=0x16, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236d98, dwSize=0x17, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236d98, dwSize=0x17, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236db0, dwSize=0xb, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236db0, dwSize=0xb, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236dbc, dwSize=0x2d, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236dbc, dwSize=0x2d, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236dec, dwSize=0x20, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236dec, dwSize=0x20, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236e0c, dwSize=0x31, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236e0c, dwSize=0x31, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236e40, dwSize=0x58, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.050] VirtualProtect (in: lpAddress=0x236e40, dwSize=0x58, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.051] VirtualProtect (in: lpAddress=0x236e98, dwSize=0x7c, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.051] VirtualProtect (in: lpAddress=0x236e98, dwSize=0x7c, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.051] VirtualProtect (in: lpAddress=0x236f14, dwSize=0x3b, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.051] VirtualProtect (in: lpAddress=0x236f14, dwSize=0x3b, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.051] VirtualProtect (in: lpAddress=0x236f50, dwSize=0x33, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.051] VirtualProtect (in: lpAddress=0x236f50, dwSize=0x33, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.051] VirtualProtect (in: lpAddress=0x236f84, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.051] VirtualProtect (in: lpAddress=0x236f84, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.051] VirtualProtect (in: lpAddress=0x236f8c, dwSize=0x49, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.051] VirtualProtect (in: lpAddress=0x236f8c, dwSize=0x49, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.051] VirtualProtect (in: lpAddress=0x236fd8, dwSize=0x9, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.051] VirtualProtect (in: lpAddress=0x236fd8, dwSize=0x9, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.051] VirtualProtect (in: lpAddress=0x236fe4, dwSize=0x3a, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.052] VirtualProtect (in: lpAddress=0x236fe4, dwSize=0x3a, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.052] VirtualProtect (in: lpAddress=0x237020, dwSize=0x73, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.052] VirtualProtect (in: lpAddress=0x237020, dwSize=0x73, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.052] VirtualProtect (in: lpAddress=0x237094, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.052] VirtualProtect (in: lpAddress=0x237094, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.052] VirtualProtect (in: lpAddress=0x23709c, dwSize=0xd, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.052] VirtualProtect (in: lpAddress=0x23709c, dwSize=0xd, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.052] VirtualProtect (in: lpAddress=0x2370ac, dwSize=0xe9, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.052] VirtualProtect (in: lpAddress=0x2370ac, dwSize=0xe9, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.052] VirtualProtect (in: lpAddress=0x237198, dwSize=0x1a, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.052] VirtualProtect (in: lpAddress=0x237198, dwSize=0x1a, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.052] VirtualProtect (in: lpAddress=0x2371b4, dwSize=0x37, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x2371b4, dwSize=0x37, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x2371ec, dwSize=0x45, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x2371ec, dwSize=0x45, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x237234, dwSize=0x48, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x237234, dwSize=0x48, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x23727c, dwSize=0x40, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x23727c, dwSize=0x40, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x2372bc, dwSize=0xf7, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x2372bc, dwSize=0xf7, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x2373b4, dwSize=0x4c, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x2373b4, dwSize=0x4c, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x237400, dwSize=0xf, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x237400, dwSize=0xf, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x237410, dwSize=0x35, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.053] VirtualProtect (in: lpAddress=0x237410, dwSize=0x35, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.054] VirtualProtect (in: lpAddress=0x237448, dwSize=0x12a, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.054] VirtualProtect (in: lpAddress=0x237448, dwSize=0x12a, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.054] VirtualProtect (in: lpAddress=0x237574, dwSize=0x355, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.054] VirtualProtect (in: lpAddress=0x237574, dwSize=0x355, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.054] VirtualProtect (in: lpAddress=0x2378cc, dwSize=0x60, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.054] VirtualProtect (in: lpAddress=0x2378cc, dwSize=0x60, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.054] VirtualProtect (in: lpAddress=0x23792c, dwSize=0x55, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.054] VirtualProtect (in: lpAddress=0x23792c, dwSize=0x55, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.054] VirtualProtect (in: lpAddress=0x237984, dwSize=0x63, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.054] VirtualProtect (in: lpAddress=0x237984, dwSize=0x63, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.054] VirtualProtect (in: lpAddress=0x2379e8, dwSize=0x6b, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.054] VirtualProtect (in: lpAddress=0x2379e8, dwSize=0x6b, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.054] VirtualProtect (in: lpAddress=0x237a54, dwSize=0x53, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.054] VirtualProtect (in: lpAddress=0x237a54, dwSize=0x53, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.055] VirtualProtect (in: lpAddress=0x237aa8, dwSize=0x82, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.055] VirtualProtect (in: lpAddress=0x237aa8, dwSize=0x82, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.055] VirtualProtect (in: lpAddress=0x237b2c, dwSize=0x3e, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.055] VirtualProtect (in: lpAddress=0x237b2c, dwSize=0x3e, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.055] VirtualProtect (in: lpAddress=0x237b6c, dwSize=0x22, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.055] VirtualProtect (in: lpAddress=0x237b6c, dwSize=0x22, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.055] VirtualProtect (in: lpAddress=0x237b90, dwSize=0x1c, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.055] VirtualProtect (in: lpAddress=0x237b90, dwSize=0x1c, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.055] VirtualProtect (in: lpAddress=0x237bac, dwSize=0x1e, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.055] VirtualProtect (in: lpAddress=0x237bac, dwSize=0x1e, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.055] VirtualProtect (in: lpAddress=0x237bcc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.055] VirtualProtect (in: lpAddress=0x237bcc, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.056] VirtualProtect (in: lpAddress=0x237bd4, dwSize=0x12, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0048.056] VirtualProtect (in: lpAddress=0x237bd4, dwSize=0x12, flNewProtect=0x2, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x4) returned 1 [0048.056] VirtualProtect (in: lpAddress=0x237be8, dwSize=0x2e, flNewProtect=0x4, lpflOldProtect=0x43db74 | out: lpflOldProtect=0x43db74*=0x2) returned 1 [0049.880] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", nBufferLength=0x105, lpBuffer=0x43d720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", lpFilePart=0x0) returned 0x34 [0049.880] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", nBufferLength=0x105, lpBuffer=0x43d5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", lpFilePart=0x0) returned 0x34 [0049.895] VirtualProtect (in: lpAddress=0x2ef9ee, dwSize=0xb, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x2) returned 1 [0049.895] VirtualProtect (in: lpAddress=0x2ef9e2, dwSize=0xb, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.895] VirtualProtect (in: lpAddress=0x230188, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x2) returned 1 [0049.895] VirtualProtect (in: lpAddress=0x2301b0, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.895] VirtualProtect (in: lpAddress=0x2301d8, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.895] VirtualProtect (in: lpAddress=0x230200, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.895] VirtualProtect (in: lpAddress=0x232008, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x2) returned 1 [0049.896] VirtualProtect (in: lpAddress=0x2cda64, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x2) returned 1 [0049.897] VirtualProtect (in: lpAddress=0x2cda8c, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.897] VirtualProtect (in: lpAddress=0x2cda94, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.897] VirtualProtect (in: lpAddress=0x2cda98, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.897] VirtualProtect (in: lpAddress=0x2cdaa0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.897] VirtualProtect (in: lpAddress=0x2cdaa4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.897] VirtualProtect (in: lpAddress=0x2cdaa8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.897] VirtualProtect (in: lpAddress=0x2cdaac, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.897] VirtualProtect (in: lpAddress=0x2cdab4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.897] VirtualProtect (in: lpAddress=0x2cdab8, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.897] VirtualProtect (in: lpAddress=0x2cdac0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.897] VirtualProtect (in: lpAddress=0x2cdac4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.897] VirtualProtect (in: lpAddress=0x2cdac8, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.897] VirtualProtect (in: lpAddress=0x2cdad0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.897] VirtualProtect (in: lpAddress=0x2cdad4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x43dbf4 | out: lpflOldProtect=0x43dbf4*=0x40) returned 1 [0049.950] CoTaskMemAlloc (cb=0x104) returned 0x588960 [0049.951] GetEnvironmentVariableW (in: lpName="COR_PROFILER", lpBuffer=0x588960, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.951] CoTaskMemFree (pv=0x588960) [0049.952] CoTaskMemAlloc (cb=0x104) returned 0x588960 [0049.952] GetEnvironmentVariableW (in: lpName="COR_ENABLE_PROFILING", lpBuffer=0x588960, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.952] CoTaskMemFree (pv=0x588960) [0055.585] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc16e [0055.585] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc16d [0055.640] GetSystemMetrics (nIndex=75) returned 1 [0055.876] AdjustWindowRectEx (in: lpRect=0x43dd10, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x43dd10) returned 1 [0055.883] GetCurrentProcess () returned 0xffffffffffffffff [0055.883] GetCurrentThread () returned 0xfffffffffffffffe [0055.883] GetCurrentProcess () returned 0xffffffffffffffff [0055.884] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x43da80, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x43da80*=0x2a8) returned 1 [0055.902] GetCurrentThreadId () returned 0xdd8 [0055.978] lstrlenW (lpString="䅁") returned 1 [0055.991] GetModuleHandleW (lpModuleName="user32.dll") returned 0x7ff8ebdc0000 [0055.992] GetACP () returned 0x4e4 [0056.047] CoTaskMemAlloc (cb=0x10) returned 0x5c7c70 [0056.047] GetProcAddress (hModule=0x7ff8ebdc0000, lpProcName="DefWindowProcW") returned 0x7ff8ee413240 [0056.047] CoTaskMemFree (pv=0x5c7c70) [0056.070] GetStockObject (i=5) returned 0x1900015 [0056.071] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0056.072] CoTaskMemAlloc (cb=0x4c) returned 0x5c3920 [0056.073] RegisterClassW (lpWndClass=0x43d770) returned 0xc168 [0056.073] CoTaskMemFree (pv=0x5c3920) [0056.073] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0056.074] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffffffffffd, hMenu=0x0, hInstance=0x230000, lpParam=0x0) returned 0x40170 [0056.076] SetWindowLongPtrW (hWnd=0x40170, nIndex=-4, dwNewLong=0x7ff8ee413240) returned 0x21413ac [0056.109] GetWindowLongPtrW (hWnd=0x40170, nIndex=-4) returned 0x7ff8ee413240 [0056.117] lstrlenW (lpString="䅁") returned 1 [0056.124] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x43c988 | out: phkResult=0x43c988*=0x2b0) returned 0x0 [0056.126] RegQueryValueExW (in: hKey=0x2b0, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x43c90c, lpData=0x0, lpcbData=0x43c908*=0x0 | out: lpType=0x43c90c*=0x0, lpData=0x0, lpcbData=0x43c908*=0x0) returned 0x2 [0056.126] RegQueryValueExW (in: hKey=0x2b0, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x43c90c, lpData=0x0, lpcbData=0x43c908*=0x0 | out: lpType=0x43c90c*=0x0, lpData=0x0, lpcbData=0x43c908*=0x0) returned 0x2 [0056.127] RegCloseKey (hKey=0x2b0) returned 0x0 [0056.129] SetWindowLongPtrW (hWnd=0x40170, nIndex=-4, dwNewLong=0x21413fc) returned 0x7ff8ee413240 [0056.129] GetWindowLongPtrW (hWnd=0x40170, nIndex=-4) returned 0x21413fc [0056.129] GetWindowLongPtrW (hWnd=0x40170, nIndex=-16) returned 0x6c10000 [0056.132] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc169 [0056.132] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x40170, Msg=0x24, wParam=0x0, lParam=0x43d160) returned 0x0 [0056.132] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc0e2 [0056.133] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x40170, Msg=0x81, wParam=0x0, lParam=0x43d0e0) returned 0x1 [0056.133] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x40170, Msg=0x83, wParam=0x0, lParam=0x43d180) returned 0x0 [0056.280] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x40170, Msg=0x1, wParam=0x0, lParam=0x43d0e0) returned 0x0 [0056.281] GetClientRect (in: hWnd=0x40170, lpRect=0x43c900 | out: lpRect=0x43c900) returned 1 [0056.282] GetWindowRect (in: hWnd=0x40170, lpRect=0x43c900 | out: lpRect=0x43c900) returned 1 [0056.293] GetParent (hWnd=0x40170) returned 0x0 [0056.592] AdjustWindowRectEx (in: lpRect=0x43d530, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d530) returned 1 [0056.694] AdjustWindowRectEx (in: lpRect=0x43d520, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d520) returned 1 [0056.704] AdjustWindowRectEx (in: lpRect=0x43d530, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d530) returned 1 [0056.711] AdjustWindowRectEx (in: lpRect=0x43d530, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d530) returned 1 [0056.757] GetSystemDefaultLCID () returned 0x409 [0056.758] GetStockObject (i=17) returned 0x10a0047 [0056.762] GetObjectW (in: h=0x10a0047, c=92, pv=0x43d0c0 | out: pv=0x43d0c0) returned 92 [0056.763] GetDC (hWnd=0x0) returned 0x10105c2 [0056.786] GetCurrentProcessId () returned 0xdd4 [0056.789] FindAtomW (lpString="GDI+Atom_3540_1") returned 0x0 [0056.790] AddAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0056.799] GdiplusStartup (in: token=0x43c008, input=0x43c020, output=0x43bff8 | out: token=0x43c008, output=0x43bff8) returned 0x0 [0056.809] GdipCreateFontFromLogfontW (hdc=0x10105c2, logfont=0x5ca380, font=0x43d0d8) returned 0x0 [0057.070] GdipGetFontUnit (font=0x1b2c34f0, unit=0x43cfe0) returned 0x0 [0057.071] GdipGetFontSize (font=0x1b2c34f0, size=0x43cfe0) returned 0x0 [0057.072] GdipGetFontStyle (font=0x1b2c34f0, style=0x43cfe0) returned 0x0 [0057.072] GdipGetFamily (font=0x1b2c34f0, family=0x43cfe0) returned 0x0 [0057.076] GdipGetFontSize (font=0x1b2c34f0, size=0x43cf40) returned 0x0 [0057.076] ReleaseDC (hWnd=0x0, hDC=0x10105c2) returned 1 [0057.079] GetDC (hWnd=0x0) returned 0x10105c2 [0057.080] GdipCreateFromHDC (hdc=0x10105c2, graphics=0x43d0a0) returned 0x0 [0057.092] GdipGetDpiY (graphics=0x1c461520, dpi=0x24d6100) returned 0x0 [0057.093] GdipGetFontHeight (font=0x1b2c34f0, graphics=0x1c461520, height=0x43d070) returned 0x0 [0057.095] GdipGetEmHeight (family=0x1c4598c0, style=0, EmHeight=0x43d090) returned 0x0 [0057.096] GdipGetLineSpacing (family=0x1c4598c0, style=0, LineSpacing=0x43d090) returned 0x0 [0057.098] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0057.099] GdipDeleteGraphics (graphics=0x1c461520) returned 0x0 [0057.099] ReleaseDC (hWnd=0x0, hDC=0x10105c2) returned 1 [0057.102] GdipCreateFont (fontFamily=0x1c4598c0, emSize=0x0, style=0, unit=0x3, font=0x43d130) returned 0x0 [0057.102] GdipGetFontSize (font=0x1b2cebe0, size=0x43d1c0) returned 0x0 [0057.103] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0057.104] GdipDeleteFont (font=0x1b2c34f0) returned 0x0 [0057.105] GetDC (hWnd=0x0) returned 0x10105c2 [0057.105] GdipCreateFromHDC (hdc=0x10105c2, graphics=0x43d1f0) returned 0x0 [0057.105] GdipGetFontHeight (font=0x1b2cebe0, graphics=0x1c461520, height=0x43d1c0) returned 0x0 [0057.107] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0057.107] GdipDeleteGraphics (graphics=0x1c461520) returned 0x0 [0057.107] ReleaseDC (hWnd=0x0, hDC=0x10105c2) returned 1 [0057.107] GetSystemMetrics (nIndex=5) returned 1 [0057.107] GetSystemMetrics (nIndex=6) returned 1 [0057.113] AdjustWindowRectEx (in: lpRect=0x43d530, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x43d530) returned 1 [0057.173] AdjustWindowRectEx (in: lpRect=0x43d4f0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d4f0) returned 1 [0057.258] AdjustWindowRectEx (in: lpRect=0x43d530, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d530) returned 1 [0057.265] AdjustWindowRectEx (in: lpRect=0x43d530, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d530) returned 1 [0057.269] AdjustWindowRectEx (in: lpRect=0x43d4f0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d4f0) returned 1 [0057.552] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x43d540) returned 0x0 [0057.552] GdipCreateFont (fontFamily=0x1c45ea10, emSize=0x0, style=1, unit=0x3, font=0x43d4e0) returned 0x0 [0057.555] GdipGetFontSize (font=0x1b2c34f0, size=0x43d570) returned 0x0 [0057.660] AdjustWindowRectEx (in: lpRect=0x43d420, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d420) returned 1 [0057.718] GetProcessWindowStation () returned 0xc8 [0057.728] GetUserObjectInformationA (in: hObj=0xc8, nIndex=1, pvInfo=0x24ea278, nLength=0xc, lpnLengthNeeded=0x43d000 | out: pvInfo=0x24ea278, lpnLengthNeeded=0x43d000) returned 1 [0057.730] SetConsoleCtrlHandler (HandlerRoutine=0x21444bc, Add=1) returned 1 [0057.731] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0057.731] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0057.732] GetClassInfoW (in: hInstance=0x230000, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", lpWndClass=0x24ea300 | out: lpWndClass=0x24ea300) returned 0 [0057.733] CoTaskMemAlloc (cb=0x58) returned 0x5c3860 [0057.733] RegisterClassW (lpWndClass=0x43cf20) returned 0xc164 [0057.733] CoTaskMemFree (pv=0x5c3860) [0057.734] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", lpWindowName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x230000, lpParam=0x0) returned 0x20232 [0057.735] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x81, wParam=0x0, lParam=0x43c710) returned 0x1 [0057.737] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x83, wParam=0x0, lParam=0x43c7c0) returned 0x0 [0057.738] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x1, wParam=0x0, lParam=0x43c6b0) returned 0x0 [0057.738] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0057.738] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0057.755] GetSysColor (nIndex=10) returned 0xb4b4b4 [0057.755] GetSysColor (nIndex=2) returned 0xd1b499 [0057.755] GetSysColor (nIndex=9) returned 0x0 [0057.755] GetSysColor (nIndex=12) returned 0xababab [0057.755] GetSysColor (nIndex=15) returned 0xf0f0f0 [0057.755] GetSysColor (nIndex=20) returned 0xffffff [0057.755] GetSysColor (nIndex=16) returned 0xa0a0a0 [0057.755] GetSysColor (nIndex=15) returned 0xf0f0f0 [0057.755] GetSysColor (nIndex=16) returned 0xa0a0a0 [0057.755] GetSysColor (nIndex=21) returned 0x696969 [0057.755] GetSysColor (nIndex=22) returned 0xe3e3e3 [0057.755] GetSysColor (nIndex=20) returned 0xffffff [0057.755] GetSysColor (nIndex=18) returned 0x0 [0057.755] GetSysColor (nIndex=1) returned 0x0 [0057.755] GetSysColor (nIndex=27) returned 0xead1b9 [0057.755] GetSysColor (nIndex=28) returned 0xf2e4d7 [0057.755] GetSysColor (nIndex=17) returned 0x6d6d6d [0057.756] GetSysColor (nIndex=13) returned 0xff9933 [0057.756] GetSysColor (nIndex=14) returned 0xffffff [0057.756] GetSysColor (nIndex=26) returned 0xcc6600 [0057.756] GetSysColor (nIndex=11) returned 0xfcf7f4 [0057.756] GetSysColor (nIndex=3) returned 0xdbcdbf [0057.756] GetSysColor (nIndex=19) returned 0x0 [0057.756] GetSysColor (nIndex=24) returned 0xe1ffff [0057.756] GetSysColor (nIndex=23) returned 0x0 [0057.756] GetSysColor (nIndex=4) returned 0xf0f0f0 [0057.756] GetSysColor (nIndex=30) returned 0xf0f0f0 [0057.756] GetSysColor (nIndex=29) returned 0xff9933 [0057.756] GetSysColor (nIndex=7) returned 0x0 [0057.756] GetSysColor (nIndex=0) returned 0xc8c8c8 [0057.756] GetSysColor (nIndex=5) returned 0xffffff [0057.756] GetSysColor (nIndex=6) returned 0x646464 [0057.756] GetSysColor (nIndex=8) returned 0x0 [0057.846] AdjustWindowRectEx (in: lpRect=0x43d420, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d420) returned 1 [0058.034] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.config", nBufferLength=0x105, lpBuffer=0x43cff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.config", lpFilePart=0x0) returned 0x37 [0058.034] SetErrorMode (uMode=0x1) returned 0x0 [0058.034] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.config" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\desktop ransomware.config"), fInfoLevelId=0x0, lpFileInformation=0x43d270 | out: lpFileInformation=0x43d270*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0058.034] SetErrorMode (uMode=0x0) returned 0x1 [0058.679] GdipLoadImageFromStream (stream=0x840020, image=0x43c6d8) returned 0x0 [0058.859] GdipImageForceValidation (image=0x1c4667f0) returned 0x0 [0058.884] GdipGetImageType (image=0x1c4667f0, type=0x43c6f0) returned 0x0 [0058.886] GdipGetImageRawFormat (image=0x1c4667f0, format=0x43c590*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0058.996] AdjustWindowRectEx (in: lpRect=0x43d4a0, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d4a0) returned 1 [0059.112] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x43d540) returned 0x0 [0059.112] GdipCreateFont (fontFamily=0x1c45ea10, emSize=0x0, style=1, unit=0x3, font=0x43d4e0) returned 0x0 [0059.112] GdipGetFontSize (font=0x1c4618b0, size=0x43d570) returned 0x0 [0059.112] AdjustWindowRectEx (in: lpRect=0x43d420, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d420) returned 1 [0059.131] AdjustWindowRectEx (in: lpRect=0x43d420, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d420) returned 1 [0059.138] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x43d540) returned 0x0 [0059.138] GdipCreateFont (fontFamily=0x1c45ea10, emSize=0x0, style=1, unit=0x3, font=0x43d4e0) returned 0x0 [0059.138] GdipGetFontSize (font=0x1c4618f0, size=0x43d570) returned 0x0 [0059.138] AdjustWindowRectEx (in: lpRect=0x43d420, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d420) returned 1 [0059.140] AdjustWindowRectEx (in: lpRect=0x43d420, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d420) returned 1 [0059.143] GetSystemMetrics (nIndex=5) returned 1 [0059.143] GetSystemMetrics (nIndex=6) returned 1 [0059.143] AdjustWindowRectEx (in: lpRect=0x43d4a0, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x43d4a0) returned 1 [0059.155] GetSystemMetrics (nIndex=5) returned 1 [0059.155] GetSystemMetrics (nIndex=6) returned 1 [0059.155] AdjustWindowRectEx (in: lpRect=0x43d4a0, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x43d4a0) returned 1 [0059.478] OleCreatePictureIndirect () returned 0x0 [0059.479] CPicture::QueryInterface () returned 0x0 [0059.479] CPicture::QueryInterface () returned 0x80004002 [0059.479] CPicture::QueryInterface () returned 0x80004002 [0059.480] CPicture::AddRef () returned 0x3 [0059.480] CoGetContextToken (in: pToken=0x43ca20 | out: pToken=0x43ca20) returned 0x0 [0059.480] CoGetContextToken (in: pToken=0x43c9b0 | out: pToken=0x43c9b0) returned 0x0 [0059.480] CObjectContext::QueryInterface () returned 0x0 [0059.480] CObjectContext::GetCurrentApartmentType () returned 0x0 [0059.480] Release () returned 0x0 [0059.480] CoGetObjectContext (in: riid=0x7ff8d55cd260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5d4ed8 | out: ppv=0x5d4ed8*=0x597d68) returned 0x0 [0059.570] CPicture::QueryInterface () returned 0x0 [0059.570] CPicture::GetUnmarshalClass () returned 0x80004005 [0059.570] Release () returned 0x3 [0059.570] CoGetContextToken (in: pToken=0x43c9f0 | out: pToken=0x43c9f0) returned 0x0 [0059.570] CPicture::AddRef () returned 0x4 [0059.570] CPicture::QueryInterface () returned 0x80004002 [0059.571] CPicture::Release () returned 0x3 [0059.571] CPicture::Release () returned 0x2 [0059.571] CoGetContextToken (in: pToken=0x43cef0 | out: pToken=0x43cef0) returned 0x0 [0059.571] CoGetContextToken (in: pToken=0x43ce30 | out: pToken=0x43ce30) returned 0x0 [0059.571] CPicture::AddRef () returned 0x3 [0059.571] CPicture::QueryInterface () returned 0x0 [0059.571] CPicture::Release () returned 0x3 [0059.572] CPicture::Release () returned 0x2 [0059.572] CPicture::Release () returned 0x1 [0059.572] CoGetContextToken (in: pToken=0x43d100 | out: pToken=0x43d100) returned 0x0 [0059.572] CoGetContextToken (in: pToken=0x43d040 | out: pToken=0x43d040) returned 0x0 [0059.572] CPicture::AddRef () returned 0x2 [0059.572] CPicture::QueryInterface () returned 0x0 [0059.572] CPicture::Release () returned 0x2 [0059.572] Release () returned 0x1 [0059.629] CoGetContextToken (in: pToken=0x43d2b0 | out: pToken=0x43d2b0) returned 0x0 [0059.629] CoGetContextToken (in: pToken=0x43d1f0 | out: pToken=0x43d1f0) returned 0x0 [0059.629] CPicture::AddRef () returned 0x2 [0059.629] CPicture::QueryInterface () returned 0x0 [0059.629] CPicture::Release () returned 0x2 [0059.630] AddRef () returned 0x3 [0059.630] CPicture::Load () returned 0x0 [0059.633] Release () returned 0x2 [0059.662] CoGetContextToken (in: pToken=0x43d2d0 | out: pToken=0x43d2d0) returned 0x0 [0059.662] CoGetContextToken (in: pToken=0x43d210 | out: pToken=0x43d210) returned 0x0 [0059.662] CPicture::AddRef () returned 0x3 [0059.662] CPicture::QueryInterface () returned 0x0 [0059.663] CPicture::Release () returned 0x3 [0059.663] CPicture::AddRef () returned 0x4 [0059.663] CPicture::get_Type () returned 0x0 [0059.663] CPicture::Release () returned 0x3 [0059.664] CPicture::get_Handle () returned 0x0 [0059.664] GetSystemMetrics (nIndex=13) returned 32 [0059.664] GetSystemMetrics (nIndex=14) returned 32 [0059.665] GetIconInfo (in: hIcon=0x10800ed, piconinfo=0x25504a0 | out: piconinfo=0x25504a0) returned 1 [0059.665] GetObjectW (in: h=0x1005066f, c=32, pv=0x25504d0 | out: pv=0x25504d0) returned 32 [0059.666] DeleteObject (ho=0x1005066f) returned 1 [0059.666] CopyImage (h=0x10800ed, type=0x2, cx=32, cy=32, flags=0x0) returned 0x200149 [0059.672] CoGetContextToken (in: pToken=0x43d2a0 | out: pToken=0x43d2a0) returned 0x0 [0059.672] CPicture::Release () returned 0x2 [0059.673] IUnknown:Release (This=0x597d68) returned 0x0 [0059.673] Release () returned 0x1 [0059.673] CPicture::Release () returned 0x0 [0059.732] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0059.734] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x43d540) returned 0x0 [0059.734] GdipCreateFont (fontFamily=0x1c45ea10, emSize=0x0, style=1, unit=0x3, font=0x43d4e0) returned 0x0 [0059.734] GdipGetFontSize (font=0x1c4677d0, size=0x43d570) returned 0x0 [0059.735] AdjustWindowRectEx (in: lpRect=0x43d4a0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d4a0) returned 1 [0059.738] AdjustWindowRectEx (in: lpRect=0x43d4a0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d4a0) returned 1 [0059.876] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x43d540) returned 0x0 [0059.876] GdipCreateFont (fontFamily=0x1c45ea10, emSize=0x0, style=1, unit=0x3, font=0x43d4e0) returned 0x0 [0059.876] GdipGetFontSize (font=0x1c467810, size=0x43d570) returned 0x0 [0059.877] AdjustWindowRectEx (in: lpRect=0x43d420, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d420) returned 1 [0059.877] AdjustWindowRectEx (in: lpRect=0x43d420, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d420) returned 1 [0059.880] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x43d540) returned 0x0 [0059.880] GdipCreateFont (fontFamily=0x1c45ea10, emSize=0x0, style=1, unit=0x3, font=0x43d4e0) returned 0x0 [0059.880] GdipGetFontSize (font=0x1c467850, size=0x43d570) returned 0x0 [0059.880] AdjustWindowRectEx (in: lpRect=0x43d420, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d420) returned 1 [0059.881] AdjustWindowRectEx (in: lpRect=0x43d420, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d420) returned 1 [0059.901] GdipCreateFontFamilyFromName (name="Tahoma", fontCollection=0x0, fontFamily=0x43d540) returned 0x0 [0059.902] GdipCreateFont (fontFamily=0x1c45ea10, emSize=0x0, style=1, unit=0x3, font=0x43d4e0) returned 0x0 [0059.902] GdipGetFontSize (font=0x1c467890, size=0x43d570) returned 0x0 [0059.902] AdjustWindowRectEx (in: lpRect=0x43d4a0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d4a0) returned 1 [0059.902] AdjustWindowRectEx (in: lpRect=0x43d4a0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d4a0) returned 1 [0060.002] AdjustWindowRectEx (in: lpRect=0x43d510, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x43d510) returned 1 [0060.002] GetSystemMetrics (nIndex=59) returned 1456 [0060.002] GetSystemMetrics (nIndex=60) returned 916 [0060.002] GetSystemMetrics (nIndex=34) returned 136 [0060.002] GetSystemMetrics (nIndex=35) returned 39 [0060.002] AdjustWindowRectEx (in: lpRect=0x43d190, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x43d190) returned 1 [0060.067] GetCurrentThreadId () returned 0xdd8 [0060.067] GetCurrentThreadId () returned 0xdd8 [0060.083] GetCurrentThreadId () returned 0xdd8 [0060.083] GetCurrentThreadId () returned 0xdd8 [0060.114] CreateCompatibleDC (hdc=0x0) returned 0x6c010559 [0060.115] GetCurrentObject (hdc=0x6c010559, type=0x1) returned 0x1b00017 [0060.115] GetCurrentObject (hdc=0x6c010559, type=0x2) returned 0x1900010 [0060.115] GetCurrentObject (hdc=0x6c010559, type=0x7) returned 0x185000f [0060.115] GetCurrentObject (hdc=0x6c010559, type=0x6) returned 0x18a0048 [0060.151] SaveDC (hdc=0x6c010559) returned 1 [0060.151] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43d290) returned 0x0 [0060.153] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d250) returned 0x0 [0060.155] GdipSetStringFormatAlign (format=0x1c467d30, align=0x0) returned 0x0 [0060.157] GdipSetStringFormatLineAlign (format=0x1c467d30, align=0x0) returned 0x0 [0060.158] GdipSetStringFormatHotkeyPrefix (format=0x1c467d30, hotkeyPrefix=1) returned 0x0 [0060.213] GdipGetStringFormatFlags (format=0x1c467d30, flags=0x43d270) returned 0x0 [0060.215] GdipSetStringFormatFlags (format=0x1c467d30, flags=2048) returned 0x0 [0060.236] GdipMeasureString (graphics=0x1c467960, string="You", length=3, font=0x1c467850, layoutRect=0x43d1b8, stringFormat=0x1c467d30, boundingBox=0x43d1a8, codepointsFitted=0x43d1a4, linesFilled=0x43d1a0) returned 0x0 [0060.305] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.305] GdipDeleteStringFormat (format=0x1c467d30) returned 0x0 [0060.305] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.305] GdipDeleteGraphics (graphics=0x1c467960) returned 0x0 [0060.305] AdjustWindowRectEx (in: lpRect=0x43d1b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d1b0) returned 1 [0060.349] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43d290) returned 0x0 [0060.349] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d250) returned 0x0 [0060.349] GdipSetStringFormatAlign (format=0x1c467d30, align=0x0) returned 0x0 [0060.349] GdipSetStringFormatLineAlign (format=0x1c467d30, align=0x0) returned 0x0 [0060.349] GdipSetStringFormatHotkeyPrefix (format=0x1c467d30, hotkeyPrefix=1) returned 0x0 [0060.349] GdipGetStringFormatFlags (format=0x1c467d30, flags=0x43d270) returned 0x0 [0060.349] GdipSetStringFormatFlags (format=0x1c467d30, flags=2048) returned 0x0 [0060.349] GdipMeasureString (graphics=0x1c467960, string="Enter PIN", length=9, font=0x1c467810, layoutRect=0x43d1b8, stringFormat=0x1c467d30, boundingBox=0x43d1a8, codepointsFitted=0x43d1a4, linesFilled=0x43d1a0) returned 0x0 [0060.349] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.349] GdipDeleteStringFormat (format=0x1c467d30) returned 0x0 [0060.350] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.350] GdipDeleteGraphics (graphics=0x1c467960) returned 0x0 [0060.350] AdjustWindowRectEx (in: lpRect=0x43d1b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d1b0) returned 1 [0060.351] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43d290) returned 0x0 [0060.351] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d250) returned 0x0 [0060.351] GdipSetStringFormatAlign (format=0x1c467d30, align=0x0) returned 0x0 [0060.351] GdipSetStringFormatLineAlign (format=0x1c467d30, align=0x0) returned 0x0 [0060.351] GdipSetStringFormatHotkeyPrefix (format=0x1c467d30, hotkeyPrefix=1) returned 0x0 [0060.351] GdipGetStringFormatFlags (format=0x1c467d30, flags=0x43d270) returned 0x0 [0060.352] GdipSetStringFormatFlags (format=0x1c467d30, flags=2048) returned 0x0 [0060.352] GdipMeasureString (graphics=0x1c467960, string="PIN = ", length=6, font=0x1c4618f0, layoutRect=0x43d1b8, stringFormat=0x1c467d30, boundingBox=0x43d1a8, codepointsFitted=0x43d1a4, linesFilled=0x43d1a0) returned 0x0 [0060.352] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.352] GdipDeleteStringFormat (format=0x1c467d30) returned 0x0 [0060.352] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.352] GdipDeleteGraphics (graphics=0x1c467960) returned 0x0 [0060.352] AdjustWindowRectEx (in: lpRect=0x43d1b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d1b0) returned 1 [0060.352] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43d290) returned 0x0 [0060.353] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d250) returned 0x0 [0060.353] GdipSetStringFormatAlign (format=0x1c467d30, align=0x0) returned 0x0 [0060.353] GdipSetStringFormatLineAlign (format=0x1c467d30, align=0x0) returned 0x0 [0060.353] GdipSetStringFormatHotkeyPrefix (format=0x1c467d30, hotkeyPrefix=1) returned 0x0 [0060.353] GdipGetStringFormatFlags (format=0x1c467d30, flags=0x43d270) returned 0x0 [0060.353] GdipSetStringFormatFlags (format=0x1c467d30, flags=2048) returned 0x0 [0060.353] GdipMeasureString (graphics=0x1c467960, string="Oooooops All your files on the desktop\r\nare encrypted To decrypt files enter PIN\r\nsee you soon", length=94, font=0x1c4618b0, layoutRect=0x43d1b8, stringFormat=0x1c467d30, boundingBox=0x43d1a8, codepointsFitted=0x43d1a4, linesFilled=0x43d1a0) returned 0x0 [0060.585] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.586] GdipDeleteStringFormat (format=0x1c467d30) returned 0x0 [0060.586] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.586] GdipDeleteGraphics (graphics=0x1c467960) returned 0x0 [0060.586] AdjustWindowRectEx (in: lpRect=0x43d1b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d1b0) returned 1 [0060.586] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43d290) returned 0x0 [0060.586] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d250) returned 0x0 [0060.586] GdipSetStringFormatAlign (format=0x1c468ca0, align=0x0) returned 0x0 [0060.586] GdipSetStringFormatLineAlign (format=0x1c468ca0, align=0x0) returned 0x0 [0060.587] GdipSetStringFormatHotkeyPrefix (format=0x1c468ca0, hotkeyPrefix=1) returned 0x0 [0060.587] GdipGetStringFormatFlags (format=0x1c468ca0, flags=0x43d270) returned 0x0 [0060.587] GdipSetStringFormatFlags (format=0x1c468ca0, flags=2048) returned 0x0 [0060.587] GdipMeasureString (graphics=0x1c4688d0, string=" Welcome in\r\nDesktop Ransomware", length=39, font=0x1b2c34f0, layoutRect=0x43d1b8, stringFormat=0x1c468ca0, boundingBox=0x43d1a8, codepointsFitted=0x43d1a4, linesFilled=0x43d1a0) returned 0x0 [0060.587] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.587] GdipDeleteStringFormat (format=0x1c468ca0) returned 0x0 [0060.587] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.587] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0060.587] AdjustWindowRectEx (in: lpRect=0x43d1b0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d1b0) returned 1 [0060.781] CreateCompatibleDC (hdc=0x0) returned 0x18010671 [0060.782] GetDC (hWnd=0x0) returned 0x10105c2 [0060.782] GdipCreateFromHDC (hdc=0x10105c2, graphics=0x43d0c0) returned 0x0 [0060.783] GdipGetLogFontW (font=0x1b2cebe0, graphics=0x1c46d570, logfontW=0x5defb0) returned 0x0 [0060.784] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.784] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0060.784] ReleaseDC (hWnd=0x0, hDC=0x10105c2) returned 1 [0060.785] CreateFontIndirectW (lplf=0x5defb0) returned 0x160a0760 [0060.786] SelectObject (hdc=0x18010671, h=0x160a0760) returned 0x18a0048 [0060.789] GetTextMetricsW (in: hdc=0x18010671, lptm=0x43d260 | out: lptm=0x43d260) returned 1 [0060.790] GetTextExtentPoint32W (in: hdc=0x18010671, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x2577a88 | out: psizl=0x2577a88) returned 1 [0060.791] SelectObject (hdc=0x18010671, h=0x18a0048) returned 0x160a0760 [0060.792] DeleteDC (hdc=0x18010671) returned 1 [0060.794] AdjustWindowRectEx (in: lpRect=0x43d000, dwStyle=0x2c40000, bMenu=0, dwExStyle=0x90001 | out: lpRect=0x43d000) returned 1 [0060.795] GetCursorPos (in: lpPoint=0x2577ac0 | out: lpPoint=0x2577ac0*(x=748, y=484)) returned 1 [0060.822] GetSystemMetrics (nIndex=80) returned 1 [0060.858] MonitorFromPoint (pt=0x1e4000002ec, dwFlags=0x2) returned 0x10001 [0060.870] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x43ce50 | out: lpmi=0x43ce50) returned 1 [0060.870] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1a010671 [0060.871] GetDeviceCaps (hdc=0x1a010671, index=12) returned 32 [0060.871] GetDeviceCaps (hdc=0x1a010671, index=14) returned 1 [0060.871] DeleteDC (hdc=0x1a010671) returned 1 [0060.871] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x43cf50 | out: lpmi=0x43cf50) returned 1 [0060.871] AdjustWindowRectEx (in: lpRect=0x43d270, dwStyle=0x2c40000, bMenu=0, dwExStyle=0x90001 | out: lpRect=0x43d270) returned 1 [0060.872] AdjustWindowRectEx (in: lpRect=0x43ce90, dwStyle=0x2c40000, bMenu=0, dwExStyle=0x90001 | out: lpRect=0x43ce90) returned 1 [0060.872] GetCursorPos (in: lpPoint=0x2577f20 | out: lpPoint=0x2577f20*(x=748, y=484)) returned 1 [0060.872] MonitorFromPoint (pt=0x1e1000002ec, dwFlags=0x2) returned 0x10001 [0060.872] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x43cce0 | out: lpmi=0x43cce0) returned 1 [0060.872] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1b010671 [0060.872] GetDeviceCaps (hdc=0x1b010671, index=12) returned 32 [0060.872] GetDeviceCaps (hdc=0x1b010671, index=14) returned 1 [0060.872] DeleteDC (hdc=0x1b010671) returned 1 [0060.872] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x43cde0 | out: lpmi=0x43cde0) returned 1 [0060.873] AdjustWindowRectEx (in: lpRect=0x43d100, dwStyle=0x2c40000, bMenu=0, dwExStyle=0x90001 | out: lpRect=0x43d100) returned 1 [0060.873] GetSystemMetrics (nIndex=34) returned 136 [0060.873] GetSystemMetrics (nIndex=35) returned 39 [0060.873] AdjustWindowRectEx (in: lpRect=0x43d210, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d210) returned 1 [0060.874] AdjustWindowRectEx (in: lpRect=0x43d130, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d130) returned 1 [0060.874] AdjustWindowRectEx (in: lpRect=0x43d210, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d210) returned 1 [0060.874] AdjustWindowRectEx (in: lpRect=0x43d130, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d130) returned 1 [0060.874] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43cfa0) returned 0x0 [0060.874] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43cf60) returned 0x0 [0060.874] GdipSetStringFormatAlign (format=0x1c46a4a0, align=0x0) returned 0x0 [0060.874] GdipSetStringFormatLineAlign (format=0x1c46a4a0, align=0x0) returned 0x0 [0060.874] GdipSetStringFormatHotkeyPrefix (format=0x1c46a4a0, hotkeyPrefix=1) returned 0x0 [0060.874] GdipGetStringFormatFlags (format=0x1c46a4a0, flags=0x43cf80) returned 0x0 [0060.874] GdipSetStringFormatFlags (format=0x1c46a4a0, flags=2048) returned 0x0 [0060.874] GdipMeasureString (graphics=0x1c46d570, string="You", length=3, font=0x1c467850, layoutRect=0x43cec8, stringFormat=0x1c46a4a0, boundingBox=0x43ceb8, codepointsFitted=0x43ceb4, linesFilled=0x43ceb0) returned 0x0 [0060.874] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.874] GdipDeleteStringFormat (format=0x1c46a4a0) returned 0x0 [0060.875] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.875] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0060.875] AdjustWindowRectEx (in: lpRect=0x43d210, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d210) returned 1 [0060.875] AdjustWindowRectEx (in: lpRect=0x43d130, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d130) returned 1 [0060.875] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43cfa0) returned 0x0 [0060.875] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43cf60) returned 0x0 [0060.875] GdipSetStringFormatAlign (format=0x1c46a4a0, align=0x0) returned 0x0 [0060.875] GdipSetStringFormatLineAlign (format=0x1c46a4a0, align=0x0) returned 0x0 [0060.875] GdipSetStringFormatHotkeyPrefix (format=0x1c46a4a0, hotkeyPrefix=1) returned 0x0 [0060.875] GdipGetStringFormatFlags (format=0x1c46a4a0, flags=0x43cf80) returned 0x0 [0060.875] GdipSetStringFormatFlags (format=0x1c46a4a0, flags=2048) returned 0x0 [0060.875] GdipMeasureString (graphics=0x1c46d570, string="Enter PIN", length=9, font=0x1c467810, layoutRect=0x43cec8, stringFormat=0x1c46a4a0, boundingBox=0x43ceb8, codepointsFitted=0x43ceb4, linesFilled=0x43ceb0) returned 0x0 [0060.875] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.875] GdipDeleteStringFormat (format=0x1c46a4a0) returned 0x0 [0060.875] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.875] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0060.875] AdjustWindowRectEx (in: lpRect=0x43d210, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d210) returned 1 [0060.875] AdjustWindowRectEx (in: lpRect=0x43d130, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d130) returned 1 [0060.876] AdjustWindowRectEx (in: lpRect=0x43d210, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x43d210) returned 1 [0060.876] AdjustWindowRectEx (in: lpRect=0x43d130, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x43d130) returned 1 [0060.876] GetSystemMetrics (nIndex=5) returned 1 [0060.876] GetSystemMetrics (nIndex=6) returned 1 [0060.876] AdjustWindowRectEx (in: lpRect=0x43d210, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d210) returned 1 [0060.876] AdjustWindowRectEx (in: lpRect=0x43d130, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d130) returned 1 [0060.876] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43cfa0) returned 0x0 [0060.876] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43cf60) returned 0x0 [0060.876] GdipSetStringFormatAlign (format=0x1c46a4a0, align=0x0) returned 0x0 [0060.876] GdipSetStringFormatLineAlign (format=0x1c46a4a0, align=0x0) returned 0x0 [0060.876] GdipSetStringFormatHotkeyPrefix (format=0x1c46a4a0, hotkeyPrefix=1) returned 0x0 [0060.876] GdipGetStringFormatFlags (format=0x1c46a4a0, flags=0x43cf80) returned 0x0 [0060.876] GdipSetStringFormatFlags (format=0x1c46a4a0, flags=2048) returned 0x0 [0060.876] GdipMeasureString (graphics=0x1c46d570, string="PIN = ", length=6, font=0x1c4618f0, layoutRect=0x43cec8, stringFormat=0x1c46a4a0, boundingBox=0x43ceb8, codepointsFitted=0x43ceb4, linesFilled=0x43ceb0) returned 0x0 [0060.876] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.876] GdipDeleteStringFormat (format=0x1c46a4a0) returned 0x0 [0060.876] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.876] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0060.877] AdjustWindowRectEx (in: lpRect=0x43d210, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d210) returned 1 [0060.877] AdjustWindowRectEx (in: lpRect=0x43d130, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d130) returned 1 [0060.877] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43cfa0) returned 0x0 [0060.877] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43cf60) returned 0x0 [0060.877] GdipSetStringFormatAlign (format=0x1c46a4a0, align=0x0) returned 0x0 [0060.877] GdipSetStringFormatLineAlign (format=0x1c46a4a0, align=0x0) returned 0x0 [0060.877] GdipSetStringFormatHotkeyPrefix (format=0x1c46a4a0, hotkeyPrefix=1) returned 0x0 [0060.877] GdipGetStringFormatFlags (format=0x1c46a4a0, flags=0x43cf80) returned 0x0 [0060.877] GdipSetStringFormatFlags (format=0x1c46a4a0, flags=2048) returned 0x0 [0060.877] GdipMeasureString (graphics=0x1c46d570, string="Oooooops All your files on the desktop\r\nare encrypted To decrypt files enter PIN\r\nsee you soon", length=94, font=0x1c4618b0, layoutRect=0x43cec8, stringFormat=0x1c46a4a0, boundingBox=0x43ceb8, codepointsFitted=0x43ceb4, linesFilled=0x43ceb0) returned 0x0 [0060.877] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.877] GdipDeleteStringFormat (format=0x1c46a4a0) returned 0x0 [0060.877] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.877] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0060.877] AdjustWindowRectEx (in: lpRect=0x43d210, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d210) returned 1 [0060.877] AdjustWindowRectEx (in: lpRect=0x43d130, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d130) returned 1 [0060.878] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43cfa0) returned 0x0 [0060.879] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43cf60) returned 0x0 [0060.879] GdipSetStringFormatAlign (format=0x1c46fe70, align=0x0) returned 0x0 [0060.879] GdipSetStringFormatLineAlign (format=0x1c46fe70, align=0x0) returned 0x0 [0060.879] GdipSetStringFormatHotkeyPrefix (format=0x1c46fe70, hotkeyPrefix=1) returned 0x0 [0060.879] GdipGetStringFormatFlags (format=0x1c46fe70, flags=0x43cf80) returned 0x0 [0060.879] GdipSetStringFormatFlags (format=0x1c46fe70, flags=2048) returned 0x0 [0060.879] GdipMeasureString (graphics=0x1c46d570, string=" Welcome in\r\nDesktop Ransomware", length=39, font=0x1b2c34f0, layoutRect=0x43cec8, stringFormat=0x1c46fe70, boundingBox=0x43ceb8, codepointsFitted=0x43ceb4, linesFilled=0x43ceb0) returned 0x0 [0060.879] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.879] GdipDeleteStringFormat (format=0x1c46fe70) returned 0x0 [0060.879] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0060.879] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0060.879] AdjustWindowRectEx (in: lpRect=0x43d210, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d210) returned 1 [0060.879] AdjustWindowRectEx (in: lpRect=0x43d130, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x43d130) returned 1 [0060.942] AdjustWindowRectEx (in: lpRect=0x43e1a0, dwStyle=0x2c40000, bMenu=0, dwExStyle=0x90001 | out: lpRect=0x43e1a0) returned 1 [0060.942] GetCursorPos (in: lpPoint=0x257a6f8 | out: lpPoint=0x257a6f8*(x=748, y=484)) returned 1 [0060.942] MonitorFromPoint (pt=0x1e4000002ec, dwFlags=0x2) returned 0x10001 [0060.942] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x43dff0 | out: lpmi=0x43dff0) returned 1 [0060.942] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x21010671 [0060.943] GetDeviceCaps (hdc=0x21010671, index=12) returned 32 [0060.943] GetDeviceCaps (hdc=0x21010671, index=14) returned 1 [0060.943] DeleteDC (hdc=0x21010671) returned 1 [0060.943] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x43e0f0 | out: lpmi=0x43e0f0) returned 1 [0060.943] GetStockObject (i=5) returned 0x1900015 [0060.943] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0060.944] CoTaskMemAlloc (cb=0x50) returned 0x587570 [0060.944] RegisterClassW (lpWndClass=0x43e070) returned 0xc163 [0060.944] CoTaskMemFree (pv=0x587570) [0060.944] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0060.944] CreateWindowExW (dwExStyle=0x90001, lpClassName="WindowsForms10.Window.208.app.0.33c0d9d", lpWindowName="Desktop Ransomware", dwStyle=0x2c40000, X=392, Y=197, nWidth=655, nHeight=465, hWndParent=0x0, hMenu=0x0, hInstance=0x230000, lpParam=0x0) returned 0x8016e [0060.944] SetWindowLongPtrW (hWnd=0x8016e, nIndex=-4, dwNewLong=0x7ff8ee413240) returned 0x214b29c [0060.945] GetWindowLongPtrW (hWnd=0x8016e, nIndex=-4) returned 0x7ff8ee413240 [0060.945] SetWindowLongPtrW (hWnd=0x8016e, nIndex=-4, dwNewLong=0x214b1fc) returned 0x7ff8ee413240 [0060.948] GetWindowLongPtrW (hWnd=0x8016e, nIndex=-4) returned 0x214b1fc [0060.948] GetWindowLongPtrW (hWnd=0x8016e, nIndex=-16) returned 0x6c40000 [0060.953] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x81, wParam=0x0, lParam=0x43d9e0) returned 0x1 [0060.954] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x83, wParam=0x0, lParam=0x43da80) returned 0x0 [0060.958] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x1, wParam=0x0, lParam=0x43d9a0) returned 0x0 [0060.958] GetClientRect (in: hWnd=0x8016e, lpRect=0x43d180 | out: lpRect=0x43d180) returned 1 [0060.958] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43d180 | out: lpRect=0x43d180) returned 1 [0060.960] SetWindowTextW (hWnd=0x8016e, lpString="Desktop Ransomware") returned 1 [0060.960] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xc, wParam=0x0, lParam=0x25737a8) returned 0x1 [0060.968] SetLayeredWindowAttributes (hwnd=0x8016e, crKey=0x0, bAlpha=0xf7, dwFlags=0x2) returned 1 [0060.984] GetStartupInfoW (in: lpStartupInfo=0x257ae08 | out: lpStartupInfo=0x257ae08*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0060.985] GetParent (hWnd=0x8016e) returned 0x0 [0060.994] GetStockObject (i=5) returned 0x1900015 [0060.994] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0060.994] CoTaskMemAlloc (cb=0x4c) returned 0x587570 [0060.994] RegisterClassW (lpWndClass=0x43e040) returned 0xc162 [0060.994] CoTaskMemFree (pv=0x587570) [0060.995] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0060.995] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x230000, lpParam=0x0) returned 0x60076 [0060.995] SetWindowLongPtrW (hWnd=0x60076, nIndex=-4, dwNewLong=0x7ff8ee413240) returned 0x214af2c [0060.995] GetWindowLongPtrW (hWnd=0x60076, nIndex=-4) returned 0x7ff8ee413240 [0060.996] SetWindowLongPtrW (hWnd=0x60076, nIndex=-4, dwNewLong=0x214b2ec) returned 0x7ff8ee413240 [0060.996] GetWindowLongPtrW (hWnd=0x60076, nIndex=-4) returned 0x214b2ec [0060.996] GetWindowLongPtrW (hWnd=0x60076, nIndex=-16) returned 0x4c00000 [0060.996] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x24, wParam=0x0, lParam=0x43da30) returned 0x0 [0060.996] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x81, wParam=0x0, lParam=0x43d9b0) returned 0x1 [0060.996] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x83, wParam=0x0, lParam=0x43da50) returned 0x0 [0060.997] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x1, wParam=0x0, lParam=0x43d9b0) returned 0x0 [0060.998] SetWindowLongPtrW (hWnd=0x8016e, nIndex=-8, dwNewLong=0x60076) returned 0x0 [0061.001] SendMessageW (hWnd=0x8016e, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0 [0061.001] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0 [0061.001] SendMessageW (hWnd=0x8016e, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0061.001] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0061.031] GetSystemMenu (hWnd=0x8016e, bRevert=0) returned 0x0 [0061.032] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43e250 | out: lpwndpl=0x43e250) returned 1 [0061.033] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0061.033] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x1) returned 1 [0061.033] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x1) returned 1 [0061.033] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0061.033] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x0) returned 1 [0061.034] GetClientRect (in: hWnd=0x8016e, lpRect=0x43e370 | out: lpRect=0x43e370) returned 1 [0061.034] GetClientRect (in: hWnd=0x8016e, lpRect=0x43e250 | out: lpRect=0x43e250) returned 1 [0061.034] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43e250 | out: lpRect=0x43e250) returned 1 [0061.035] SetWindowLongPtrW (hWnd=0x8016e, nIndex=-8, dwNewLong=0x60076) returned 0x60076 [0061.065] GetSystemMetrics (nIndex=11) returned 32 [0061.065] GetSystemMetrics (nIndex=12) returned 32 [0061.065] GetDC (hWnd=0x0) returned 0xa0100d0 [0061.066] GetDeviceCaps (hdc=0xa0100d0, index=12) returned 32 [0061.066] GetDeviceCaps (hdc=0xa0100d0, index=14) returned 1 [0061.066] ReleaseDC (hWnd=0x0, hDC=0xa0100d0) returned 1 [0061.068] CreateIconFromResourceEx (presbits=0x257dbb8, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x1901b9 [0061.071] SendMessageW (hWnd=0x60076, Msg=0x80, wParam=0x1, lParam=0x1901b9) returned 0x0 [0061.071] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x80, wParam=0x1, lParam=0x1901b9) returned 0x0 [0061.073] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0xffffffffffffffff, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0061.074] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43e350) returned 0x0 [0061.074] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43e350) returned 0x0 [0061.081] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43e350) returned 0x0 [0061.081] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43e350) returned 0x0 [0061.081] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x1c, wParam=0x1, lParam=0x7f8) returned 0x0 [0061.081] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x1c, wParam=0x1, lParam=0x7f8) returned 0x0 [0061.081] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x1c, wParam=0x1, lParam=0x7f8) returned 0x0 [0061.081] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0061.159] OleInitialize (pvReserved=0x0) returned 0x0 [0061.160] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x43dca0 | out: lplpMessageFilter=0x43dca0*=0x0) returned 0x0 [0061.173] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0061.179] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0061.218] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0061.219] GetParent (hWnd=0x8016e) returned 0x0 [0061.219] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0061.221] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0061.222] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43dd80 | out: lpwndpl=0x43dd80) returned 1 [0061.222] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x47, wParam=0x0, lParam=0x43e350) returned 0x0 [0061.222] GetClientRect (in: hWnd=0x8016e, lpRect=0x43db20 | out: lpRect=0x43db20) returned 1 [0061.222] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43db20 | out: lpRect=0x43db20) returned 1 [0061.224] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x83, wParam=0x1, lParam=0x43dc00) returned 0x0 [0061.225] GetWindowLongPtrW (hWnd=0x8016e, nIndex=-16) returned 0x6c40000 [0061.225] GetWindowTextLengthW (hWnd=0x8016e) returned 18 [0061.225] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x12 [0061.225] GetSystemMetrics (nIndex=42) returned 0 [0061.226] CoTaskMemAlloc (cb=0x2a) returned 0x591cc0 [0061.226] GetWindowTextW (in: hWnd=0x8016e, lpString=0x591cc0, nMaxCount=19 | out: lpString="Desktop Ransomware") returned 18 [0061.226] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xd, wParam=0x13, lParam=0x591cc0) returned 0x12 [0061.226] CoTaskMemFree (pv=0x591cc0) [0061.227] GetWindowTextLengthW (hWnd=0x8016e) returned 18 [0061.227] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x12 [0061.227] GetSystemMetrics (nIndex=42) returned 0 [0061.227] CoTaskMemAlloc (cb=0x2a) returned 0x592700 [0061.227] GetWindowTextW (in: hWnd=0x8016e, lpString=0x592700, nMaxCount=19 | out: lpString="Desktop Ransomware") returned 18 [0061.227] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xd, wParam=0x13, lParam=0x592700) returned 0x12 [0061.227] CoTaskMemFree (pv=0x592700) [0061.227] GetCursorPos (in: lpPoint=0x257f220 | out: lpPoint=0x257f220*(x=748, y=484)) returned 1 [0061.227] MonitorFromPoint (pt=0x1e1000002ed, dwFlags=0x2) returned 0x10001 [0061.227] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x43e020 | out: lpmi=0x43e020) returned 1 [0061.228] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x2e0105e3 [0061.228] GetDeviceCaps (hdc=0x2e0105e3, index=12) returned 32 [0061.228] GetDeviceCaps (hdc=0x2e0105e3, index=14) returned 1 [0061.228] DeleteDC (hdc=0x2e0105e3) returned 1 [0061.228] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x43e120 | out: lpmi=0x43e120) returned 1 [0061.228] GetWindowLongPtrW (hWnd=0x8016e, nIndex=-16) returned 0x6c40000 [0061.229] GetWindowLongPtrW (hWnd=0x8016e, nIndex=-20) returned 0x90109 [0061.229] SetWindowLongPtrW (hWnd=0x8016e, nIndex=-16, dwNewLong=0x2c40000) returned 0x6c40000 [0061.229] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x43e280) returned 0x0 [0061.230] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x43e280) returned 0x0 [0061.230] SetWindowLongPtrW (hWnd=0x8016e, nIndex=-20, dwNewLong=0x90001) returned 0x90109 [0061.230] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x43e280) returned 0x0 [0061.231] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x43e280) returned 0x0 [0061.231] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0061.231] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43e330) returned 0x0 [0061.231] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x83, wParam=0x1, lParam=0x43e300) returned 0x0 [0061.231] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43dd60 | out: lpwndpl=0x43dd60) returned 1 [0061.232] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x47, wParam=0x0, lParam=0x43e330) returned 0x0 [0061.232] GetClientRect (in: hWnd=0x8016e, lpRect=0x43db00 | out: lpRect=0x43db00) returned 1 [0061.232] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43db00 | out: lpRect=0x43db00) returned 1 [0061.232] RedrawWindow (hWnd=0x8016e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0061.233] GetSystemMenu (hWnd=0x8016e, bRevert=0) returned 0x0 [0061.233] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43e250 | out: lpwndpl=0x43e250) returned 1 [0061.233] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0061.233] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x1) returned 1 [0061.233] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x1) returned 1 [0061.233] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0061.233] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x0) returned 1 [0061.233] ShowWindow (hWnd=0x8016e, nCmdShow=5) returned 0 [0061.234] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0061.234] GetClassInfoW (in: hInstance=0x0, lpClassName="BUTTON", lpWndClass=0x257f650 | out: lpWndClass=0x257f650) returned 1 [0061.234] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0061.235] CoTaskMemAlloc (cb=0x48) returned 0x5ee470 [0061.235] RegisterClassW (lpWndClass=0x43d8e0) returned 0xc161 [0061.235] CoTaskMemFree (pv=0x5ee470) [0061.235] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0061.235] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.33c0d9d", lpWindowName="Get PIN", dwStyle=0x5601000b, X=12, Y=378, nWidth=125, nHeight=36, hWndParent=0x8016e, hMenu=0x0, hInstance=0x230000, lpParam=0x0) returned 0xa01fa [0061.235] SetWindowLongPtrW (hWnd=0xa01fa, nIndex=-4, dwNewLong=0x7ff8ee4132a0) returned 0x214b33c [0061.236] GetWindowLongPtrW (hWnd=0xa01fa, nIndex=-4) returned 0x7ff8ee4132a0 [0061.236] SetWindowLongPtrW (hWnd=0xa01fa, nIndex=-4, dwNewLong=0x214b38c) returned 0x7ff8ee4132a0 [0061.236] GetWindowLongPtrW (hWnd=0xa01fa, nIndex=-4) returned 0x214b38c [0061.236] GetWindowLongPtrW (hWnd=0xa01fa, nIndex=-16) returned 0x4601000b [0061.236] GetWindowLongPtrW (hWnd=0xa01fa, nIndex=-12) returned 0x0 [0061.236] SetWindowLongPtrW (hWnd=0xa01fa, nIndex=-12, dwNewLong=0xa01fa) returned 0x0 [0061.236] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x81, wParam=0x0, lParam=0x43d250) returned 0x1 [0061.237] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x83, wParam=0x0, lParam=0x43d2f0) returned 0x0 [0061.237] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x1, wParam=0x0, lParam=0x43d230) returned 0x0 [0061.237] GetWindow (hWnd=0xa01fa, uCmd=0x3) returned 0x0 [0061.237] GetClientRect (in: hWnd=0xa01fa, lpRect=0x43c9a0 | out: lpRect=0x43c9a0) returned 1 [0061.237] GetWindowRect (in: hWnd=0xa01fa, lpRect=0x43c9a0 | out: lpRect=0x43c9a0) returned 1 [0061.237] GetParent (hWnd=0xa01fa) returned 0x8016e [0061.238] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43c990, cPoints=0x2 | out: lpPoints=0x43c990) returned -14877072 [0061.238] SetWindowTextW (hWnd=0xa01fa, lpString="Get PIN") returned 1 [0061.238] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0xc, wParam=0x0, lParam=0x255bca8) returned 0x1 [0061.238] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x5, wParam=0x0, lParam=0x24007d) returned 0x0 [0061.239] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x3, wParam=0x0, lParam=0x17a000c) returned 0x0 [0061.239] GetClientRect (in: hWnd=0xa01fa, lpRect=0x43cac0 | out: lpRect=0x43cac0) returned 1 [0061.239] GetWindowRect (in: hWnd=0xa01fa, lpRect=0x43cac0 | out: lpRect=0x43cac0) returned 1 [0061.239] GetParent (hWnd=0xa01fa) returned 0x8016e [0061.239] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43cab0, cPoints=0x2 | out: lpPoints=0x43cab0) returned -14877072 [0061.240] SendMessageW (hWnd=0xa01fa, Msg=0x2210, wParam=0x1fa0001, lParam=0xa01fa) returned 0x0 [0061.240] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x2210, wParam=0x1fa0001, lParam=0xa01fa) returned 0x0 [0061.240] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0061.240] GetParent (hWnd=0xa01fa) returned 0x8016e [0061.240] GetClassInfoW (in: hInstance=0x0, lpClassName="STATIC", lpWndClass=0x257f9c8 | out: lpWndClass=0x257f9c8) returned 1 [0061.241] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0061.241] CoTaskMemAlloc (cb=0x48) returned 0x5ee740 [0061.241] RegisterClassW (lpWndClass=0x43d8e0) returned 0xc160 [0061.241] CoTaskMemFree (pv=0x5ee740) [0061.241] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0061.241] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.33c0d9d", lpWindowName="You", dwStyle=0x5600000d, X=374, Y=225, nWidth=38, nHeight=25, hWndParent=0x8016e, hMenu=0x0, hInstance=0x230000, lpParam=0x0) returned 0x20200 [0061.241] SetWindowLongPtrW (hWnd=0x20200, nIndex=-4, dwNewLong=0x7ff8ee413380) returned 0x214afcc [0061.241] GetWindowLongPtrW (hWnd=0x20200, nIndex=-4) returned 0x7ff8ee413380 [0061.241] SetWindowLongPtrW (hWnd=0x20200, nIndex=-4, dwNewLong=0x214b06c) returned 0x7ff8ee413380 [0061.241] GetWindowLongPtrW (hWnd=0x20200, nIndex=-4) returned 0x214b06c [0061.241] GetWindowLongPtrW (hWnd=0x20200, nIndex=-16) returned 0x4600000d [0061.241] GetWindowLongPtrW (hWnd=0x20200, nIndex=-12) returned 0x0 [0061.242] SetWindowLongPtrW (hWnd=0x20200, nIndex=-12, dwNewLong=0x20200) returned 0x0 [0061.243] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x81, wParam=0x0, lParam=0x43d250) returned 0x1 [0061.243] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x83, wParam=0x0, lParam=0x43d2f0) returned 0x0 [0061.243] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x1, wParam=0x0, lParam=0x43d240) returned 0x0 [0061.243] GetWindow (hWnd=0x20200, uCmd=0x3) returned 0xa01fa [0061.243] GetClientRect (in: hWnd=0x20200, lpRect=0x43c9b0 | out: lpRect=0x43c9b0) returned 1 [0061.243] GetWindowRect (in: hWnd=0x20200, lpRect=0x43c9b0 | out: lpRect=0x43c9b0) returned 1 [0061.243] GetParent (hWnd=0x20200) returned 0x8016e [0061.243] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43c9a0, cPoints=0x2 | out: lpPoints=0x43c9a0) returned -14877072 [0061.244] SetWindowTextW (hWnd=0x20200, lpString="You") returned 1 [0061.244] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xc, wParam=0x0, lParam=0x2559ea8) returned 0x1 [0061.244] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x5, wParam=0x0, lParam=0x190026) returned 0x0 [0061.244] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x3, wParam=0x0, lParam=0xe10176) returned 0x0 [0061.244] GetClientRect (in: hWnd=0x20200, lpRect=0x43cac0 | out: lpRect=0x43cac0) returned 1 [0061.244] GetWindowRect (in: hWnd=0x20200, lpRect=0x43cac0 | out: lpRect=0x43cac0) returned 1 [0061.244] GetParent (hWnd=0x20200) returned 0x8016e [0061.244] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43cab0, cPoints=0x2 | out: lpPoints=0x43cab0) returned -14877072 [0061.244] SendMessageW (hWnd=0x20200, Msg=0x2210, wParam=0x2000001, lParam=0x20200) returned 0x0 [0061.244] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x2210, wParam=0x2000001, lParam=0x20200) returned 0x0 [0061.244] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0061.245] GetParent (hWnd=0x20200) returned 0x8016e [0061.245] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0061.245] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.33c0d9d", lpWindowName="Enter PIN", dwStyle=0x5600000d, X=286, Y=225, nWidth=87, nHeight=25, hWndParent=0x8016e, hMenu=0x0, hInstance=0x230000, lpParam=0x0) returned 0x400f0 [0061.245] SetWindowLongPtrW (hWnd=0x400f0, nIndex=-4, dwNewLong=0x7ff8ee413380) returned 0x214afcc [0061.245] GetWindowLongPtrW (hWnd=0x400f0, nIndex=-4) returned 0x7ff8ee413380 [0061.245] SetWindowLongPtrW (hWnd=0x400f0, nIndex=-4, dwNewLong=0x214b42c) returned 0x7ff8ee413380 [0061.245] GetWindowLongPtrW (hWnd=0x400f0, nIndex=-4) returned 0x214b42c [0061.245] GetWindowLongPtrW (hWnd=0x400f0, nIndex=-16) returned 0x4600000d [0061.245] GetWindowLongPtrW (hWnd=0x400f0, nIndex=-12) returned 0x0 [0061.245] SetWindowLongPtrW (hWnd=0x400f0, nIndex=-12, dwNewLong=0x400f0) returned 0x0 [0061.245] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x81, wParam=0x0, lParam=0x43d250) returned 0x1 [0061.246] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x83, wParam=0x0, lParam=0x43d2f0) returned 0x0 [0061.246] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x1, wParam=0x0, lParam=0x43d230) returned 0x0 [0061.246] GetWindow (hWnd=0x400f0, uCmd=0x3) returned 0x20200 [0061.246] GetClientRect (in: hWnd=0x400f0, lpRect=0x43c9a0 | out: lpRect=0x43c9a0) returned 1 [0061.246] GetWindowRect (in: hWnd=0x400f0, lpRect=0x43c9a0 | out: lpRect=0x43c9a0) returned 1 [0061.246] GetParent (hWnd=0x400f0) returned 0x8016e [0061.246] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43c990, cPoints=0x2 | out: lpPoints=0x43c990) returned -14877072 [0061.247] SetWindowTextW (hWnd=0x400f0, lpString="Enter PIN") returned 1 [0061.247] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0xc, wParam=0x0, lParam=0x25583f0) returned 0x1 [0061.247] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x5, wParam=0x0, lParam=0x190057) returned 0x0 [0061.247] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x3, wParam=0x0, lParam=0xe1011e) returned 0x0 [0061.247] GetClientRect (in: hWnd=0x400f0, lpRect=0x43cac0 | out: lpRect=0x43cac0) returned 1 [0061.247] GetWindowRect (in: hWnd=0x400f0, lpRect=0x43cac0 | out: lpRect=0x43cac0) returned 1 [0061.247] GetParent (hWnd=0x400f0) returned 0x8016e [0061.247] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43cab0, cPoints=0x2 | out: lpPoints=0x43cab0) returned -14877072 [0061.247] SendMessageW (hWnd=0x400f0, Msg=0x2210, wParam=0xf00001, lParam=0x400f0) returned 0x0 [0061.247] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x2210, wParam=0xf00001, lParam=0x400f0) returned 0x0 [0061.247] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0061.247] GetParent (hWnd=0x400f0) returned 0x8016e [0061.248] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0061.248] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.33c0d9d", lpWindowName="Decryption", dwStyle=0x5601000b, X=493, Y=297, nWidth=125, nHeight=38, hWndParent=0x8016e, hMenu=0x0, hInstance=0x230000, lpParam=0x0) returned 0x20208 [0061.248] SetWindowLongPtrW (hWnd=0x20208, nIndex=-4, dwNewLong=0x7ff8ee4132a0) returned 0x214b33c [0061.248] GetWindowLongPtrW (hWnd=0x20208, nIndex=-4) returned 0x7ff8ee4132a0 [0061.248] SetWindowLongPtrW (hWnd=0x20208, nIndex=-4, dwNewLong=0x214b10c) returned 0x7ff8ee4132a0 [0061.248] GetWindowLongPtrW (hWnd=0x20208, nIndex=-4) returned 0x214b10c [0061.248] GetWindowLongPtrW (hWnd=0x20208, nIndex=-16) returned 0x4601000b [0061.248] GetWindowLongPtrW (hWnd=0x20208, nIndex=-12) returned 0x0 [0061.248] SetWindowLongPtrW (hWnd=0x20208, nIndex=-12, dwNewLong=0x20208) returned 0x0 [0061.248] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x81, wParam=0x0, lParam=0x43d250) returned 0x1 [0061.249] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x83, wParam=0x0, lParam=0x43d2f0) returned 0x0 [0061.249] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x1, wParam=0x0, lParam=0x43d230) returned 0x0 [0061.249] GetWindow (hWnd=0x20208, uCmd=0x3) returned 0x400f0 [0061.249] GetClientRect (in: hWnd=0x20208, lpRect=0x43c9a0 | out: lpRect=0x43c9a0) returned 1 [0061.249] GetWindowRect (in: hWnd=0x20208, lpRect=0x43c9a0 | out: lpRect=0x43c9a0) returned 1 [0061.249] GetParent (hWnd=0x20208) returned 0x8016e [0061.249] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43c990, cPoints=0x2 | out: lpPoints=0x43c990) returned -14877072 [0061.249] SetWindowTextW (hWnd=0x20208, lpString="Decryption") returned 1 [0061.249] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0xc, wParam=0x0, lParam=0x2553770) returned 0x1 [0061.250] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x5, wParam=0x0, lParam=0x26007d) returned 0x0 [0061.250] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x3, wParam=0x0, lParam=0x12901ed) returned 0x0 [0061.250] GetClientRect (in: hWnd=0x20208, lpRect=0x43cac0 | out: lpRect=0x43cac0) returned 1 [0061.250] GetWindowRect (in: hWnd=0x20208, lpRect=0x43cac0 | out: lpRect=0x43cac0) returned 1 [0061.250] GetParent (hWnd=0x20208) returned 0x8016e [0061.250] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43cab0, cPoints=0x2 | out: lpPoints=0x43cab0) returned -14877072 [0061.250] SendMessageW (hWnd=0x20208, Msg=0x2210, wParam=0x2080001, lParam=0x20208) returned 0x0 [0061.250] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x2210, wParam=0x2080001, lParam=0x20208) returned 0x0 [0061.250] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0061.250] GetParent (hWnd=0x20208) returned 0x8016e [0061.251] GetClassInfoW (in: hInstance=0x0, lpClassName="EDIT", lpWndClass=0x257ffd0 | out: lpWndClass=0x257ffd0) returned 1 [0061.251] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0061.251] CoTaskMemAlloc (cb=0x44) returned 0x5ed840 [0061.251] RegisterClassW (lpWndClass=0x43d890) returned 0xc15f [0061.251] CoTaskMemFree (pv=0x5ed840) [0061.251] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0061.251] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x560100c0, X=285, Y=271, nWidth=333, nHeight=20, hWndParent=0x8016e, hMenu=0x0, hInstance=0x230000, lpParam=0x0) returned 0x2022e [0061.252] SetWindowLongPtrW (hWnd=0x2022e, nIndex=-4, dwNewLong=0x7ff8ee413320) returned 0x214b47c [0061.252] GetWindowLongPtrW (hWnd=0x2022e, nIndex=-4) returned 0x7ff8ee413320 [0061.252] SetWindowLongPtrW (hWnd=0x2022e, nIndex=-4, dwNewLong=0x214b1ac) returned 0x7ff8ee413320 [0061.252] GetWindowLongPtrW (hWnd=0x2022e, nIndex=-4) returned 0x214b1ac [0061.252] GetWindowLongPtrW (hWnd=0x2022e, nIndex=-16) returned 0x460100c0 [0061.252] GetWindowLongPtrW (hWnd=0x2022e, nIndex=-12) returned 0x0 [0061.252] SetWindowLongPtrW (hWnd=0x2022e, nIndex=-12, dwNewLong=0x2022e) returned 0x0 [0061.252] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x81, wParam=0x0, lParam=0x43d200) returned 0x1 [0061.253] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x83, wParam=0x0, lParam=0x43d2a0) returned 0x0 [0061.253] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x1, wParam=0x0, lParam=0x43d200) returned 0x1 [0061.254] GetWindow (hWnd=0x2022e, uCmd=0x3) returned 0x20208 [0061.254] GetClientRect (in: hWnd=0x2022e, lpRect=0x43ca20 | out: lpRect=0x43ca20) returned 1 [0061.254] GetWindowRect (in: hWnd=0x2022e, lpRect=0x43ca20 | out: lpRect=0x43ca20) returned 1 [0061.254] GetParent (hWnd=0x2022e) returned 0x8016e [0061.254] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43ca10, cPoints=0x2 | out: lpPoints=0x43ca10) returned -14877072 [0061.254] SendMessageW (hWnd=0x2022e, Msg=0x30, wParam=0x160a0760, lParam=0x0) returned 0x1 [0061.255] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x30, wParam=0x160a0760, lParam=0x0) returned 0x1 [0061.255] SendMessageW (hWnd=0x2022e, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0061.255] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0061.255] GetSystemMetrics (nIndex=5) returned 1 [0061.255] GetSystemMetrics (nIndex=6) returned 1 [0061.256] SendMessageW (hWnd=0x2022e, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0061.256] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0061.257] SendMessageW (hWnd=0x2022e, Msg=0xd2, wParam=0x0, lParam=0x0) returned 0x0 [0061.257] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0xd2, wParam=0x0, lParam=0x0) returned 0x0 [0061.260] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x5, wParam=0x0, lParam=0x100149) returned 0x0 [0061.260] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x3, wParam=0x0, lParam=0x111011f) returned 0x0 [0061.261] GetClientRect (in: hWnd=0x2022e, lpRect=0x43cb20 | out: lpRect=0x43cb20) returned 1 [0061.261] GetWindowRect (in: hWnd=0x2022e, lpRect=0x43cb20 | out: lpRect=0x43cb20) returned 1 [0061.261] GetParent (hWnd=0x2022e) returned 0x8016e [0061.261] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43cb10, cPoints=0x2 | out: lpPoints=0x43cb10) returned -14877072 [0061.261] SendMessageW (hWnd=0x2022e, Msg=0x2210, wParam=0x22e0001, lParam=0x2022e) returned 0x0 [0061.261] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x2210, wParam=0x22e0001, lParam=0x2022e) returned 0x0 [0061.261] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0061.261] GetParent (hWnd=0x2022e) returned 0x8016e [0061.261] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0061.261] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.33c0d9d", lpWindowName="PIN = ", dwStyle=0x5600000d, X=218, Y=272, nWidth=60, nHeight=25, hWndParent=0x8016e, hMenu=0x0, hInstance=0x230000, lpParam=0x0) returned 0x20230 [0061.262] SetWindowLongPtrW (hWnd=0x20230, nIndex=-4, dwNewLong=0x7ff8ee413380) returned 0x214afcc [0061.262] GetWindowLongPtrW (hWnd=0x20230, nIndex=-4) returned 0x7ff8ee413380 [0061.262] SetWindowLongPtrW (hWnd=0x20230, nIndex=-4, dwNewLong=0x214b51c) returned 0x7ff8ee413380 [0061.262] GetWindowLongPtrW (hWnd=0x20230, nIndex=-4) returned 0x214b51c [0061.262] GetWindowLongPtrW (hWnd=0x20230, nIndex=-16) returned 0x4600000d [0061.262] GetWindowLongPtrW (hWnd=0x20230, nIndex=-12) returned 0x0 [0061.262] SetWindowLongPtrW (hWnd=0x20230, nIndex=-12, dwNewLong=0x20230) returned 0x0 [0061.262] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x81, wParam=0x0, lParam=0x43d250) returned 0x1 [0061.263] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x83, wParam=0x0, lParam=0x43d2f0) returned 0x0 [0061.263] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x1, wParam=0x0, lParam=0x43d230) returned 0x0 [0061.263] GetWindow (hWnd=0x20230, uCmd=0x3) returned 0x2022e [0061.263] GetClientRect (in: hWnd=0x20230, lpRect=0x43c9a0 | out: lpRect=0x43c9a0) returned 1 [0061.263] GetWindowRect (in: hWnd=0x20230, lpRect=0x43c9a0 | out: lpRect=0x43c9a0) returned 1 [0061.263] GetParent (hWnd=0x20230) returned 0x8016e [0061.263] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43c990, cPoints=0x2 | out: lpPoints=0x43c990) returned -14877072 [0061.264] SetWindowTextW (hWnd=0x20230, lpString="PIN = ") returned 1 [0061.264] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0xc, wParam=0x0, lParam=0x254ef08) returned 0x1 [0061.264] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x5, wParam=0x0, lParam=0x19003c) returned 0x0 [0061.264] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x3, wParam=0x0, lParam=0x11000da) returned 0x0 [0061.264] GetClientRect (in: hWnd=0x20230, lpRect=0x43cac0 | out: lpRect=0x43cac0) returned 1 [0061.264] GetWindowRect (in: hWnd=0x20230, lpRect=0x43cac0 | out: lpRect=0x43cac0) returned 1 [0061.264] GetParent (hWnd=0x20230) returned 0x8016e [0061.264] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43cab0, cPoints=0x2 | out: lpPoints=0x43cab0) returned -14877072 [0061.264] SendMessageW (hWnd=0x20230, Msg=0x2210, wParam=0x2300001, lParam=0x20230) returned 0x0 [0061.264] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x2210, wParam=0x2300001, lParam=0x20230) returned 0x0 [0061.264] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0061.265] GetParent (hWnd=0x20230) returned 0x8016e [0061.265] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0061.265] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.33c0d9d", lpWindowName="Oooooops All your files on the desktop\r\nare encrypted To decrypt files enter PIN\r\nsee you soon", dwStyle=0x5600000d, X=281, Y=137, nWidth=348, nHeight=63, hWndParent=0x8016e, hMenu=0x0, hInstance=0x230000, lpParam=0x0) returned 0x20222 [0061.265] SetWindowLongPtrW (hWnd=0x20222, nIndex=-4, dwNewLong=0x7ff8ee413380) returned 0x214afcc [0061.265] GetWindowLongPtrW (hWnd=0x20222, nIndex=-4) returned 0x7ff8ee413380 [0061.265] SetWindowLongPtrW (hWnd=0x20222, nIndex=-4, dwNewLong=0x214b4cc) returned 0x7ff8ee413380 [0061.265] GetWindowLongPtrW (hWnd=0x20222, nIndex=-4) returned 0x214b4cc [0061.265] GetWindowLongPtrW (hWnd=0x20222, nIndex=-16) returned 0x4600000d [0061.265] GetWindowLongPtrW (hWnd=0x20222, nIndex=-12) returned 0x0 [0061.265] SetWindowLongPtrW (hWnd=0x20222, nIndex=-12, dwNewLong=0x20222) returned 0x0 [0061.265] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x81, wParam=0x0, lParam=0x43d250) returned 0x1 [0061.266] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x83, wParam=0x0, lParam=0x43d2f0) returned 0x0 [0061.266] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x1, wParam=0x0, lParam=0x43d180) returned 0x0 [0061.266] GetWindow (hWnd=0x20222, uCmd=0x3) returned 0x20230 [0061.266] GetClientRect (in: hWnd=0x20222, lpRect=0x43c8f0 | out: lpRect=0x43c8f0) returned 1 [0061.266] GetWindowRect (in: hWnd=0x20222, lpRect=0x43c8f0 | out: lpRect=0x43c8f0) returned 1 [0061.266] GetParent (hWnd=0x20222) returned 0x8016e [0061.266] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43c8e0, cPoints=0x2 | out: lpPoints=0x43c8e0) returned -14877072 [0061.267] SetWindowTextW (hWnd=0x20222, lpString="Oooooops All your files on the desktop\r\nare encrypted To decrypt files enter PIN\r\nsee you soon") returned 1 [0061.267] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0xc, wParam=0x0, lParam=0x254d1f8) returned 0x1 [0061.267] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x5, wParam=0x0, lParam=0x3f015c) returned 0x0 [0061.267] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x3, wParam=0x0, lParam=0x890119) returned 0x0 [0061.267] GetClientRect (in: hWnd=0x20222, lpRect=0x43cac0 | out: lpRect=0x43cac0) returned 1 [0061.267] GetWindowRect (in: hWnd=0x20222, lpRect=0x43cac0 | out: lpRect=0x43cac0) returned 1 [0061.267] GetParent (hWnd=0x20222) returned 0x8016e [0061.267] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43cab0, cPoints=0x2 | out: lpPoints=0x43cab0) returned -14877072 [0061.267] SendMessageW (hWnd=0x20222, Msg=0x2210, wParam=0x2220001, lParam=0x20222) returned 0x0 [0061.267] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x2210, wParam=0x2220001, lParam=0x20222) returned 0x0 [0061.267] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0061.267] GetParent (hWnd=0x20222) returned 0x8016e [0061.268] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0061.268] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.33c0d9d", lpWindowName=" Welcome in\r\nDesktop Ransomware", dwStyle=0x5600000d, X=284, Y=19, nWidth=338, nHeight=77, hWndParent=0x8016e, hMenu=0x0, hInstance=0x230000, lpParam=0x0) returned 0x20224 [0061.268] SetWindowLongPtrW (hWnd=0x20224, nIndex=-4, dwNewLong=0x7ff8ee413380) returned 0x214afcc [0061.268] GetWindowLongPtrW (hWnd=0x20224, nIndex=-4) returned 0x7ff8ee413380 [0061.268] SetWindowLongPtrW (hWnd=0x20224, nIndex=-4, dwNewLong=0x214b56c) returned 0x7ff8ee413380 [0061.268] GetWindowLongPtrW (hWnd=0x20224, nIndex=-4) returned 0x214b56c [0061.268] GetWindowLongPtrW (hWnd=0x20224, nIndex=-16) returned 0x4600000d [0061.268] GetWindowLongPtrW (hWnd=0x20224, nIndex=-12) returned 0x0 [0061.268] SetWindowLongPtrW (hWnd=0x20224, nIndex=-12, dwNewLong=0x20224) returned 0x0 [0061.268] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x81, wParam=0x0, lParam=0x43d250) returned 0x1 [0061.269] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x83, wParam=0x0, lParam=0x43d2f0) returned 0x0 [0061.269] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x1, wParam=0x0, lParam=0x43d1f0) returned 0x0 [0061.269] GetWindow (hWnd=0x20224, uCmd=0x3) returned 0x20222 [0061.269] GetClientRect (in: hWnd=0x20224, lpRect=0x43c960 | out: lpRect=0x43c960) returned 1 [0061.269] GetWindowRect (in: hWnd=0x20224, lpRect=0x43c960 | out: lpRect=0x43c960) returned 1 [0061.269] GetParent (hWnd=0x20224) returned 0x8016e [0061.269] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43c950, cPoints=0x2 | out: lpPoints=0x43c950) returned -14877072 [0061.269] SetWindowTextW (hWnd=0x20224, lpString=" Welcome in\r\nDesktop Ransomware") returned 1 [0061.269] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0xc, wParam=0x0, lParam=0x24f0328) returned 0x1 [0061.270] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x5, wParam=0x0, lParam=0x4d0152) returned 0x0 [0061.270] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x3, wParam=0x0, lParam=0x13011c) returned 0x0 [0061.270] GetClientRect (in: hWnd=0x20224, lpRect=0x43cac0 | out: lpRect=0x43cac0) returned 1 [0061.270] GetWindowRect (in: hWnd=0x20224, lpRect=0x43cac0 | out: lpRect=0x43cac0) returned 1 [0061.270] GetParent (hWnd=0x20224) returned 0x8016e [0061.270] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43cab0, cPoints=0x2 | out: lpPoints=0x43cab0) returned -14877072 [0061.270] SendMessageW (hWnd=0x20224, Msg=0x2210, wParam=0x2240001, lParam=0x20224) returned 0x0 [0061.270] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x2210, wParam=0x2240001, lParam=0x20224) returned 0x0 [0061.270] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0061.270] GetParent (hWnd=0x20224) returned 0x8016e [0061.271] GetModuleHandleW (lpModuleName=0x0) returned 0x230000 [0061.271] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x56000000, X=0, Y=0, nWidth=639, nHeight=426, hWndParent=0x8016e, hMenu=0x0, hInstance=0x230000, lpParam=0x0) returned 0x2021e [0061.271] SetWindowLongPtrW (hWnd=0x2021e, nIndex=-4, dwNewLong=0x7ff8ee413240) returned 0x21413ac [0061.271] GetWindowLongPtrW (hWnd=0x2021e, nIndex=-4) returned 0x7ff8ee413240 [0061.271] SetWindowLongPtrW (hWnd=0x2021e, nIndex=-4, dwNewLong=0x214ae3c) returned 0x7ff8ee413240 [0061.271] GetWindowLongPtrW (hWnd=0x2021e, nIndex=-4) returned 0x214ae3c [0061.271] GetWindowLongPtrW (hWnd=0x2021e, nIndex=-16) returned 0x46000000 [0061.271] GetWindowLongPtrW (hWnd=0x2021e, nIndex=-12) returned 0x0 [0061.271] SetWindowLongPtrW (hWnd=0x2021e, nIndex=-12, dwNewLong=0x2021e) returned 0x0 [0061.271] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0x81, wParam=0x0, lParam=0x43d250) returned 0x1 [0061.272] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0x83, wParam=0x0, lParam=0x43d2f0) returned 0x0 [0061.272] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0x1, wParam=0x0, lParam=0x43d250) returned 0x0 [0061.272] GetWindow (hWnd=0x2021e, uCmd=0x3) returned 0x20224 [0061.272] GetClientRect (in: hWnd=0x2021e, lpRect=0x43ca70 | out: lpRect=0x43ca70) returned 1 [0061.272] GetWindowRect (in: hWnd=0x2021e, lpRect=0x43ca70 | out: lpRect=0x43ca70) returned 1 [0061.272] GetParent (hWnd=0x2021e) returned 0x8016e [0061.272] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43ca60, cPoints=0x2 | out: lpPoints=0x43ca60) returned -14877072 [0061.285] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0x5, wParam=0x0, lParam=0x1aa027f) returned 0x0 [0061.285] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0061.285] GetClientRect (in: hWnd=0x2021e, lpRect=0x43cb70 | out: lpRect=0x43cb70) returned 1 [0061.285] GetWindowRect (in: hWnd=0x2021e, lpRect=0x43cb70 | out: lpRect=0x43cb70) returned 1 [0061.285] GetParent (hWnd=0x2021e) returned 0x8016e [0061.285] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43cb60, cPoints=0x2 | out: lpPoints=0x43cb60) returned -14877072 [0061.285] SendMessageW (hWnd=0x2021e, Msg=0x2210, wParam=0x21e0001, lParam=0x2021e) returned 0x0 [0061.285] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0x2210, wParam=0x21e0001, lParam=0x2021e) returned 0x0 [0061.286] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0061.286] GetParent (hWnd=0x2021e) returned 0x8016e [0061.288] GetWindowTextLengthW (hWnd=0x8016e) returned 18 [0061.288] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x12 [0061.288] GetSystemMetrics (nIndex=42) returned 0 [0061.288] CoTaskMemAlloc (cb=0x2a) returned 0x592140 [0061.288] GetWindowTextW (in: hWnd=0x8016e, lpString=0x592140, nMaxCount=19 | out: lpString="Desktop Ransomware") returned 18 [0061.288] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xd, wParam=0x13, lParam=0x592140) returned 0x12 [0061.289] CoTaskMemFree (pv=0x592140) [0061.473] CoTaskMemAlloc (cb=0x20c) returned 0x5c1ce0 [0061.473] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x5c1ce0 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0061.473] CoTaskMemFree (pv=0x5c1ce0) [0061.474] GetLongPathNameW (in: lpszShortPath="C:\\Users\\CIIHMN~1\\", lpszLongPath=0x43d7a0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\CIiHmnxMn6Ps\\") returned 0x16 [0061.475] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x43d820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29 [0061.477] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x43d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29 [0061.479] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x43d710, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x28 [0061.481] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x43d750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0061.482] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x43d740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x28 [0061.482] SetErrorMode (uMode=0x1) returned 0x0 [0061.483] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x43d950 | out: lpFileInformation=0x43d950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa834b392, ftCreationTime.dwHighDateTime=0x1d2d079, ftLastAccessTime.dwLowDateTime=0x16299ef4, ftLastAccessTime.dwHighDateTime=0x1d47206, ftLastWriteTime.dwLowDateTime=0x16299ef4, ftLastWriteTime.dwHighDateTime=0x1d47206, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0061.483] SetErrorMode (uMode=0x0) returned 0x1 [0061.483] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x43d740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x28 [0061.483] SetErrorMode (uMode=0x1) returned 0x0 [0061.483] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x43d950 | out: lpFileInformation=0x43d950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa834b392, ftCreationTime.dwHighDateTime=0x1d2d079, ftLastAccessTime.dwLowDateTime=0x16299ef4, ftLastAccessTime.dwHighDateTime=0x1d47206, ftLastWriteTime.dwLowDateTime=0x16299ef4, ftLastWriteTime.dwHighDateTime=0x1d47206, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0061.483] SetErrorMode (uMode=0x0) returned 0x1 [0061.486] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x43d540, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0061.488] SetErrorMode (uMode=0x1) returned 0x0 [0061.491] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp", lpFindFileData=0x43d6e0 | out: lpFindFileData=0x43d6e0) returned 0x587570 [0061.492] FindNextFileW (in: hFindFile=0x587570, lpFindFileData=0x43d6f0 | out: lpFindFileData=0x43d6f0) returned 0 [0061.492] FindClose (in: hFindFile=0x587570 | out: hFindFile=0x587570) returned 1 [0061.492] SetErrorMode (uMode=0x0) returned 0x1 [0061.494] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\.", nBufferLength=0x105, lpBuffer=0x43d600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x28 [0061.684] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", nBufferLength=0x105, lpBuffer=0x43d550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", lpFilePart=0x0) returned 0x32 [0061.684] SetErrorMode (uMode=0x1) returned 0x0 [0061.685] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tempchhksm.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0061.687] GetFileType (hFile=0x37c) returned 0x1 [0061.687] SetErrorMode (uMode=0x0) returned 0x1 [0061.687] GetFileType (hFile=0x37c) returned 0x1 [0061.689] WriteFile (in: hFile=0x37c, lpBuffer=0x124b73b0*, nNumberOfBytesToWrite=0xce867, lpNumberOfBytesWritten=0x43db08, lpOverlapped=0x0 | out: lpBuffer=0x124b73b0*, lpNumberOfBytesWritten=0x43db08*=0xce867, lpOverlapped=0x0) returned 1 [0061.705] CloseHandle (hObject=0x37c) returned 1 [0061.841] LocalAlloc (uFlags=0x0, uBytes=0x66) returned 0x5b23a0 [0061.842] RtlMoveMemory (in: Destination=0x5b23a0, Source=0x258b2a0, Length=0x66 | out: Destination=0x5b23a0) [0061.868] ShellExecuteExW (in: pExecInfo=0x258d1d0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x258d1d0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x4e0)) returned 1 [0063.827] LocalFree (hMem=0x5b23a0) returned 0x0 [0063.940] CoTaskMemAlloc (cb=0x204) returned 0x64a7d0 [0063.940] GetComputerNameW (in: lpBuffer=0x64a7d0, nSize=0x43dbe8 | out: lpBuffer="LHNIWSJ", nSize=0x43dbe8) returned 1 [0063.940] CoTaskMemFree (pv=0x64a7d0) [0063.940] GetWindowTextLengthW (hWnd=0x20200) returned 3 [0063.940] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3 [0063.940] GetSystemMetrics (nIndex=42) returned 0 [0063.940] CoTaskMemAlloc (cb=0xc) returned 0x6344e0 [0063.940] GetWindowTextW (in: hWnd=0x20200, lpString=0x6344e0, nMaxCount=4 | out: lpString="You") returned 3 [0063.940] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xd, wParam=0x4, lParam=0x6344e0) returned 0x3 [0063.940] CoTaskMemFree (pv=0x6344e0) [0063.940] GetWindowTextLengthW (hWnd=0x20200) returned 3 [0063.940] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3 [0063.940] GetSystemMetrics (nIndex=42) returned 0 [0063.940] CoTaskMemAlloc (cb=0xc) returned 0x6344e0 [0063.940] GetWindowTextW (in: hWnd=0x20200, lpString=0x6344e0, nMaxCount=4 | out: lpString="You") returned 3 [0063.940] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xd, wParam=0x4, lParam=0x6344e0) returned 0x3 [0063.940] CoTaskMemFree (pv=0x6344e0) [0063.940] SetWindowTextW (hWnd=0x20200, lpString="LHNIWSJ") returned 1 [0063.940] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xc, wParam=0x0, lParam=0x258ee60) returned 0x1 [0063.941] GetWindowTextLengthW (hWnd=0x20200) returned 7 [0063.941] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0063.941] GetSystemMetrics (nIndex=42) returned 0 [0063.941] CoTaskMemAlloc (cb=0x14) returned 0x6344e0 [0063.941] GetWindowTextW (in: hWnd=0x20200, lpString=0x6344e0, nMaxCount=8 | out: lpString="LHNIWSJ") returned 7 [0063.941] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xd, wParam=0x8, lParam=0x6344e0) returned 0x7 [0063.941] CoTaskMemFree (pv=0x6344e0) [0063.941] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43d950) returned 0x0 [0063.941] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d910) returned 0x0 [0063.941] GdipSetStringFormatAlign (format=0x1c46d1b0, align=0x0) returned 0x0 [0063.941] GdipSetStringFormatLineAlign (format=0x1c46d1b0, align=0x0) returned 0x0 [0063.942] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x43d920, fWinIni=0x0 | out: pvParam=0x43d920) returned 1 [0063.942] SendMessageW (hWnd=0x8016e, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0063.942] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0063.944] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0063.944] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0063.951] RedrawWindow (hWnd=0xa01fa, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0063.951] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0063.951] RedrawWindow (hWnd=0x20200, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0063.951] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0063.951] RedrawWindow (hWnd=0x400f0, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0063.952] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0063.952] RedrawWindow (hWnd=0x20208, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0063.952] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0063.952] RedrawWindow (hWnd=0x2022e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0063.952] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0063.952] RedrawWindow (hWnd=0x20230, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0063.952] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0063.953] RedrawWindow (hWnd=0x20222, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0063.953] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0063.953] RedrawWindow (hWnd=0x20224, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0063.953] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0063.953] RedrawWindow (hWnd=0x2021e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0063.953] RedrawWindow (hWnd=0x8016e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0063.954] GdipSetStringFormatHotkeyPrefix (format=0x1c46d1b0, hotkeyPrefix=2) returned 0x0 [0063.954] GdipGetStringFormatFlags (format=0x1c46d1b0, flags=0x43d930) returned 0x0 [0063.954] GdipSetStringFormatFlags (format=0x1c46d1b0, flags=2048) returned 0x0 [0063.954] GdipMeasureString (graphics=0x1c46d570, string="LHNIWSJ", length=7, font=0x1c467850, layoutRect=0x43d878, stringFormat=0x1c46d1b0, boundingBox=0x43d868, codepointsFitted=0x43d864, linesFilled=0x43d860) returned 0x0 [0063.954] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0063.954] GdipDeleteStringFormat (format=0x1c46d1b0) returned 0x0 [0063.954] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0063.954] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0063.954] SetWindowPos (hWnd=0x20200, hWndInsertAfter=0x0, X=374, Y=225, cx=84, cy=25, uFlags=0x16) returned 1 [0063.955] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x46, wParam=0x0, lParam=0x43d7f0) returned 0x0 [0063.955] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x83, wParam=0x1, lParam=0x43d7c0) returned 0x0 [0063.955] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x47, wParam=0x0, lParam=0x43d7f0) returned 0x0 [0063.955] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x5, wParam=0x0, lParam=0x190054) returned 0x0 [0063.955] GetClientRect (in: hWnd=0x20200, lpRect=0x43cf50 | out: lpRect=0x43cf50) returned 1 [0063.955] GetWindowRect (in: hWnd=0x20200, lpRect=0x43cf50 | out: lpRect=0x43cf50) returned 1 [0063.955] GetParent (hWnd=0x20200) returned 0x8016e [0063.955] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8016e, lpPoints=0x43cf40, cPoints=0x2 | out: lpPoints=0x43cf40) returned -14877072 [0063.956] InvalidateRect (hWnd=0x20200, lpRect=0x0, bErase=1) returned 1 [0063.957] GetWindowTextLengthW (hWnd=0x20200) returned 7 [0063.957] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0063.957] GetSystemMetrics (nIndex=42) returned 0 [0063.957] CoTaskMemAlloc (cb=0x14) returned 0x6344e0 [0063.957] GetWindowTextW (in: hWnd=0x20200, lpString=0x6344e0, nMaxCount=8 | out: lpString="LHNIWSJ") returned 7 [0063.957] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xd, wParam=0x8, lParam=0x6344e0) returned 0x7 [0063.957] CoTaskMemFree (pv=0x6344e0) [0063.957] GetParent (hWnd=0x20200) returned 0x8016e [0063.957] InvalidateRect (hWnd=0x20200, lpRect=0x0, bErase=1) returned 1 [0063.957] GetWindowTextLengthW (hWnd=0x8016e) returned 18 [0063.957] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x12 [0063.957] GetSystemMetrics (nIndex=42) returned 0 [0063.957] CoTaskMemAlloc (cb=0x2a) returned 0x1f2e08d0 [0063.957] GetWindowTextW (in: hWnd=0x8016e, lpString=0x1f2e08d0, nMaxCount=19 | out: lpString="Desktop Ransomware") returned 18 [0063.957] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xd, wParam=0x13, lParam=0x1f2e08d0) returned 0x12 [0063.957] CoTaskMemFree (pv=0x1f2e08d0) [0063.958] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0063.958] InvalidateRect (hWnd=0x20200, lpRect=0x0, bErase=1) returned 1 [0063.958] InvalidateRect (hWnd=0x400f0, lpRect=0x0, bErase=1) returned 1 [0063.958] InvalidateRect (hWnd=0x20208, lpRect=0x0, bErase=0) returned 1 [0063.958] InvalidateRect (hWnd=0x2022e, lpRect=0x0, bErase=1) returned 1 [0063.958] InvalidateRect (hWnd=0x20230, lpRect=0x0, bErase=1) returned 1 [0063.958] InvalidateRect (hWnd=0x20222, lpRect=0x0, bErase=1) returned 1 [0063.958] InvalidateRect (hWnd=0x20224, lpRect=0x0, bErase=1) returned 1 [0063.958] InvalidateRect (hWnd=0x2021e, lpRect=0x0, bErase=1) returned 1 [0063.970] GetWindowThreadProcessId (in: hWnd=0x8016e, lpdwProcessId=0x43db90 | out: lpdwProcessId=0x43db90) returned 0xdd8 [0063.970] GetCurrentThreadId () returned 0xdd8 [0063.973] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc15e [0063.974] PostMessageW (hWnd=0x8016e, Msg=0xc15e, wParam=0x0, lParam=0x0) returned 1 [0063.976] GetWindowTextLengthW (hWnd=0x8016e) returned 18 [0063.976] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x12 [0063.976] GetSystemMetrics (nIndex=42) returned 0 [0063.976] CoTaskMemAlloc (cb=0x2a) returned 0x1f2e03d0 [0063.976] GetWindowTextW (in: hWnd=0x8016e, lpString=0x1f2e03d0, nMaxCount=19 | out: lpString="Desktop Ransomware") returned 18 [0063.976] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xd, wParam=0x13, lParam=0x1f2e03d0) returned 0x12 [0063.976] CoTaskMemFree (pv=0x1f2e03d0) [0063.979] GdipImageGetFrameDimensionsCount (image=0x1c4667f0, count=0x43da80) returned 0x0 [0063.979] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x633de0 [0063.980] GdipImageGetFrameDimensionsList (image=0x1c4667f0, dimensionIDs=0x633de0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), count=0x1) returned 0x0 [0063.985] LocalFree (hMem=0x633de0) returned 0x0 [0063.998] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43e590) returned 0x0 [0063.998] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43e590) returned 0x0 [0064.003] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0064.005] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43dfe0 | out: lpwndpl=0x43dfe0) returned 1 [0064.006] GetClientRect (in: hWnd=0x8016e, lpRect=0x43de60 | out: lpRect=0x43de60) returned 1 [0064.006] GetWindowTextLengthW (hWnd=0x8016e) returned 18 [0064.006] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x12 [0064.006] GetSystemMetrics (nIndex=42) returned 0 [0064.006] CoTaskMemAlloc (cb=0x2a) returned 0x1f2e0210 [0064.006] GetWindowTextW (in: hWnd=0x8016e, lpString=0x1f2e0210, nMaxCount=19 | out: lpString="Desktop Ransomware") returned 18 [0064.006] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xd, wParam=0x13, lParam=0x1f2e0210) returned 0x12 [0064.006] CoTaskMemFree (pv=0x1f2e0210) [0064.007] GetClientRect (in: hWnd=0x8016e, lpRect=0x43dc10 | out: lpRect=0x43dc10) returned 1 [0064.009] GetDC (hWnd=0x0) returned 0x501071f [0064.011] EnumDisplayMonitors (hdc=0x501071f, lprcClip=0x0, lpfnEnum=0x1cb71f5c, dwData=0x0) returned 1 [0064.011] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x43d110 | out: lpmi=0x43d110) returned 1 [0064.011] GetDeviceCaps (hdc=0xd01075f, index=12) returned 32 [0064.011] GetDeviceCaps (hdc=0xd01075f, index=14) returned 1 [0064.012] ReleaseDC (hWnd=0x0, hDC=0x501071f) returned 1 [0064.012] GetCurrentObject (hdc=0xa0100d0, type=0x1) returned 0x1b00017 [0064.012] GetCurrentObject (hdc=0xa0100d0, type=0x2) returned 0x1900010 [0064.012] GetCurrentObject (hdc=0xa0100d0, type=0x7) returned 0x1d05076a [0064.012] GetCurrentObject (hdc=0xa0100d0, type=0x6) returned 0x18a0048 [0064.012] SaveDC (hdc=0xa0100d0) returned 1 [0064.013] GetNearestColor (hdc=0xa0100d0, color=0xf0f0f0) returned 0xf0f0f0 [0064.034] CreateSolidBrush (color=0xf0f0f0) returned 0x810075d [0064.035] FillRect (hDC=0xa0100d0, lprc=0x43d740, hbr=0x810075d) returned 1 [0064.036] DeleteObject (ho=0x810075d) returned 1 [0064.037] RestoreDC (hdc=0xa0100d0, nSavedDC=-1) returned 1 [0064.922] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0064.922] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x14, wParam=0x10105c2, lParam=0x0) returned 0x1 [0064.923] GetStockObject (i=5) returned 0x1900015 [0064.923] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0064.924] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0064.924] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0064.924] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x14, wParam=0x10105c2, lParam=0x0) returned 0x1 [0064.924] GetStockObject (i=5) returned 0x1900015 [0064.925] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0064.925] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x14, wParam=0xa0100d0, lParam=0x0) returned 0x1 [0064.925] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0064.926] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0064.926] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0064.926] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0064.926] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43dfc0 | out: lpwndpl=0x43dfc0) returned 1 [0064.927] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x47, wParam=0x0, lParam=0x43e590) returned 0x0 [0064.927] GetClientRect (in: hWnd=0x8016e, lpRect=0x43dd60 | out: lpRect=0x43dd60) returned 1 [0064.927] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43dd60 | out: lpRect=0x43dd60) returned 1 [0064.928] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x5, wParam=0x0, lParam=0x1aa027f) returned 0x0 [0064.928] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x3, wParam=0x0, lParam=0xe40190) returned 0x0 [0064.928] GetClientRect (in: hWnd=0x8016e, lpRect=0x43de30 | out: lpRect=0x43de30) returned 1 [0064.928] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43de30 | out: lpRect=0x43de30) returned 1 [0064.935] GetFocus () returned 0x8016e [0064.935] GetFocus () returned 0x8016e [0064.936] SetFocus (hWnd=0x2022e) returned 0x8016e [0064.937] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x8, wParam=0x2022e, lParam=0x0) returned 0x0 [0064.937] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0064.938] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0064.939] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0064.941] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x7, wParam=0x8016e, lParam=0x0) returned 0x1 [0064.941] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0064.941] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x282, wParam=0xa, lParam=0x0) returned 0x0 [0064.941] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0064.941] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x282, wParam=0xf, lParam=0x901bb) returned 0x0 [0064.943] SetTextColor (hdc=0xa0100d0, color=0x0) returned 0x0 [0064.943] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff [0064.944] GetSysColorBrush (nIndex=5) returned 0x110007b [0064.944] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0064.945] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x282, wParam=0xb, lParam=0x0) returned 0x0 [0064.945] SendMessageW (hWnd=0x2022e, Msg=0x2111, wParam=0x100022e, lParam=0x2022e) returned 0x0 [0065.015] SendMessageW (hWnd=0x2022e, Msg=0xb0, wParam=0x43dd84, lParam=0x43dd80) returned 0x0 [0065.015] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0xb0, wParam=0x43dd84, lParam=0x43dd80) returned 0x0 [0065.016] GetKeyState (nVirtKey=1) returned 0 [0065.016] GetKeyState (nVirtKey=2) returned 0 [0065.016] GetKeyState (nVirtKey=4) returned 0 [0065.016] GetKeyState (nVirtKey=5) returned 0 [0065.016] GetKeyState (nVirtKey=6) returned 0 [0065.017] GetWindowTextLengthW (hWnd=0x2022e) returned 0 [0065.017] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0065.023] SendMessageW (hWnd=0x2022e, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0065.023] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0065.023] SetTextColor (hdc=0xa0100d0, color=0x0) returned 0x0 [0065.023] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff [0065.024] GetFocus () returned 0x2022e [0065.025] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0065.030] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43e410) returned 0x0 [0065.030] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x83, wParam=0x1, lParam=0x43e3e0) returned 0x0 [0065.031] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43e410) returned 0x0 [0065.032] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.046] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43de60 | out: lpwndpl=0x43de60) returned 1 [0065.046] GetClientRect (in: hWnd=0x8016e, lpRect=0x43dce0 | out: lpRect=0x43dce0) returned 1 [0065.046] GetWindowTextLengthW (hWnd=0x8016e) returned 18 [0065.046] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x12 [0065.047] GetSystemMetrics (nIndex=42) returned 0 [0065.047] CoTaskMemAlloc (cb=0x2a) returned 0x1f2e02d0 [0065.047] GetWindowTextW (in: hWnd=0x8016e, lpString=0x1f2e02d0, nMaxCount=19 | out: lpString="Desktop Ransomware") returned 18 [0065.047] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xd, wParam=0x13, lParam=0x1f2e02d0) returned 0x12 [0065.047] CoTaskMemFree (pv=0x1f2e02d0) [0065.047] GetClientRect (in: hWnd=0x8016e, lpRect=0x43da90 | out: lpRect=0x43da90) returned 1 [0065.047] GetCurrentObject (hdc=0xa0100d0, type=0x1) returned 0x1b00017 [0065.047] GetCurrentObject (hdc=0xa0100d0, type=0x2) returned 0x1900010 [0065.047] GetCurrentObject (hdc=0xa0100d0, type=0x7) returned 0x1d05076a [0065.047] GetCurrentObject (hdc=0xa0100d0, type=0x6) returned 0x18a0048 [0065.047] SaveDC (hdc=0xa0100d0) returned 1 [0065.047] GetNearestColor (hdc=0xa0100d0, color=0xf0f0f0) returned 0xf0f0f0 [0065.047] CreateSolidBrush (color=0xf0f0f0) returned 0x910075d [0065.047] FillRect (hDC=0xa0100d0, lprc=0x43d5c0, hbr=0x910075d) returned 1 [0065.047] DeleteObject (ho=0x910075d) returned 1 [0065.047] RestoreDC (hdc=0xa0100d0, nSavedDC=-1) returned 1 [0065.048] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.048] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x14, wParam=0x501071f, lParam=0x0) returned 0x1 [0065.048] GetStockObject (i=5) returned 0x1900015 [0065.048] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.048] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.049] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.049] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x14, wParam=0x501071f, lParam=0x0) returned 0x1 [0065.049] GetStockObject (i=5) returned 0x1900015 [0065.049] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.059] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x14, wParam=0x10105c2, lParam=0x0) returned 0x1 [0065.059] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.059] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.060] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.060] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.060] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43de40 | out: lpwndpl=0x43de40) returned 1 [0065.060] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x47, wParam=0x0, lParam=0x43e410) returned 0x0 [0065.060] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x5, wParam=0x0, lParam=0x1aa027f) returned 0x0 [0065.060] GetClientRect (in: hWnd=0x8016e, lpRect=0x43dbe0 | out: lpRect=0x43dbe0) returned 1 [0065.060] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43dbe0 | out: lpRect=0x43dbe0) returned 1 [0065.063] IsWindowUnicode (hWnd=0x8016e) returned 1 [0065.063] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0065.100] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0065.101] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0065.101] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43e1c0) returned 0x0 [0065.101] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x83, wParam=0x1, lParam=0x43e190) returned 0x0 [0065.101] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.102] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43dc10 | out: lpwndpl=0x43dc10) returned 1 [0065.102] GetClientRect (in: hWnd=0x8016e, lpRect=0x43da90 | out: lpRect=0x43da90) returned 1 [0065.102] GetWindowTextLengthW (hWnd=0x8016e) returned 18 [0065.102] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x12 [0065.102] GetSystemMetrics (nIndex=42) returned 0 [0065.102] CoTaskMemAlloc (cb=0x2a) returned 0x1f2e0d90 [0065.102] GetWindowTextW (in: hWnd=0x8016e, lpString=0x1f2e0d90, nMaxCount=19 | out: lpString="Desktop Ransomware") returned 18 [0065.102] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xd, wParam=0x13, lParam=0x1f2e0d90) returned 0x12 [0065.102] CoTaskMemFree (pv=0x1f2e0d90) [0065.102] GetClientRect (in: hWnd=0x8016e, lpRect=0x43d840 | out: lpRect=0x43d840) returned 1 [0065.102] GetCurrentObject (hdc=0xa0100d0, type=0x1) returned 0x1b00017 [0065.102] GetCurrentObject (hdc=0xa0100d0, type=0x2) returned 0x1900010 [0065.102] GetCurrentObject (hdc=0xa0100d0, type=0x7) returned 0x1d05076a [0065.102] GetCurrentObject (hdc=0xa0100d0, type=0x6) returned 0x18a0048 [0065.102] SaveDC (hdc=0xa0100d0) returned 1 [0065.103] GetNearestColor (hdc=0xa0100d0, color=0xf0f0f0) returned 0xf0f0f0 [0065.103] CreateSolidBrush (color=0xf0f0f0) returned 0xa10075d [0065.103] FillRect (hDC=0xa0100d0, lprc=0x43d370, hbr=0xa10075d) returned 1 [0065.103] DeleteObject (ho=0xa10075d) returned 1 [0065.103] RestoreDC (hdc=0xa0100d0, nSavedDC=-1) returned 1 [0065.103] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.103] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x14, wParam=0x10105c2, lParam=0x0) returned 0x1 [0065.103] GetStockObject (i=5) returned 0x1900015 [0065.103] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.103] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.104] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.104] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x14, wParam=0x10105c2, lParam=0x0) returned 0x1 [0065.104] GetStockObject (i=5) returned 0x1900015 [0065.104] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.104] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x14, wParam=0x501071f, lParam=0x0) returned 0x1 [0065.104] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.104] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.104] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.105] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.105] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43dbf0 | out: lpwndpl=0x43dbf0) returned 1 [0065.105] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x47, wParam=0x0, lParam=0x43e1c0) returned 0x0 [0065.105] GetClientRect (in: hWnd=0x8016e, lpRect=0x43d990 | out: lpRect=0x43d990) returned 1 [0065.105] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43d990 | out: lpRect=0x43d990) returned 1 [0065.106] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x83, wParam=0x1, lParam=0x43da70) returned 0x0 [0065.106] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.107] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43d4f0 | out: lpwndpl=0x43d4f0) returned 1 [0065.107] GetClientRect (in: hWnd=0x8016e, lpRect=0x43d370 | out: lpRect=0x43d370) returned 1 [0065.107] GetWindowTextLengthW (hWnd=0x8016e) returned 18 [0065.107] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x12 [0065.107] GetSystemMetrics (nIndex=42) returned 0 [0065.107] CoTaskMemAlloc (cb=0x2a) returned 0x1f2e0190 [0065.107] GetWindowTextW (in: hWnd=0x8016e, lpString=0x1f2e0190, nMaxCount=19 | out: lpString="Desktop Ransomware") returned 18 [0065.107] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xd, wParam=0x13, lParam=0x1f2e0190) returned 0x12 [0065.107] CoTaskMemFree (pv=0x1f2e0190) [0065.107] GetClientRect (in: hWnd=0x8016e, lpRect=0x43d120 | out: lpRect=0x43d120) returned 1 [0065.107] GetCurrentObject (hdc=0x10105c2, type=0x1) returned 0x1b00017 [0065.107] GetCurrentObject (hdc=0x10105c2, type=0x2) returned 0x1900010 [0065.107] GetCurrentObject (hdc=0x10105c2, type=0x7) returned 0x1d05076a [0065.107] GetCurrentObject (hdc=0x10105c2, type=0x6) returned 0x18a0048 [0065.108] SaveDC (hdc=0x10105c2) returned 1 [0065.108] GetNearestColor (hdc=0x10105c2, color=0xf0f0f0) returned 0xf0f0f0 [0065.108] CreateSolidBrush (color=0xf0f0f0) returned 0xb10075d [0065.108] FillRect (hDC=0x10105c2, lprc=0x43cc50, hbr=0xb10075d) returned 1 [0065.108] DeleteObject (ho=0xb10075d) returned 1 [0065.108] RestoreDC (hdc=0x10105c2, nSavedDC=-1) returned 1 [0065.108] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.108] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x14, wParam=0xa0100d0, lParam=0x0) returned 0x1 [0065.108] GetStockObject (i=5) returned 0x1900015 [0065.109] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.109] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.109] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.109] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x14, wParam=0xa0100d0, lParam=0x0) returned 0x1 [0065.109] GetStockObject (i=5) returned 0x1900015 [0065.109] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.110] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x14, wParam=0x501071f, lParam=0x0) returned 0x1 [0065.110] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.110] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.110] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.110] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.111] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0065.111] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0065.111] IsWindowUnicode (hWnd=0x60076) returned 1 [0065.111] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0065.111] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0065.111] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0065.111] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0065.111] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0065.111] IsWindowUnicode (hWnd=0x8016e) returned 1 [0065.111] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0065.111] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0065.111] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0065.119] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0065.119] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0065.121] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43e410) returned 0x0 [0065.121] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43e410) returned 0x0 [0065.121] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26a01be) returned 0x1 [0065.121] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0065.121] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0065.122] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26a01be) returned 0x1 [0065.123] SetCursor (hCursor=0x200149) returned 0x10007 [0065.123] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0065.123] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0065.649] _TrackMouseEvent (in: lpEventTrack=0x2591800 | out: lpEventTrack=0x2591800) returned 1 [0065.649] SendMessageW (hWnd=0xa01fa, Msg=0xc169, wParam=0x0, lParam=0x0) returned 0x0 [0065.650] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0xc169, wParam=0x0, lParam=0x0) returned 0x0 [0065.651] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0065.663] GetKeyState (nVirtKey=1) returned 0 [0065.663] GetKeyState (nVirtKey=2) returned 0 [0065.663] GetKeyState (nVirtKey=4) returned 0 [0065.663] GetKeyState (nVirtKey=5) returned 0 [0065.663] GetKeyState (nVirtKey=6) returned 0 [0065.664] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0065.664] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26a01be) returned 0x1 [0065.664] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0065.664] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0065.664] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26a01be) returned 0x1 [0065.665] GetDlgItem (hDlg=0x8016e, nIDDlgItem=0) returned 0x0 [0065.665] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x210, wParam=0x201, lParam=0x186002e) returned 0x0 [0065.665] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x21, wParam=0x8016e, lParam=0x2010001) returned 0x1 [0065.665] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x21, wParam=0x8016e, lParam=0x2010001) returned 0x1 [0065.665] SetCursor (hCursor=0x200149) returned 0x200149 [0065.665] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0065.665] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0065.666] GetKeyState (nVirtKey=1) returned -127 [0065.666] GetKeyState (nVirtKey=2) returned 0 [0065.666] GetKeyState (nVirtKey=4) returned 0 [0065.666] GetKeyState (nVirtKey=5) returned 0 [0065.666] GetKeyState (nVirtKey=6) returned 0 [0065.667] IsWindowVisible (hWnd=0xa01fa) returned 1 [0065.668] IsWindowEnabled (hWnd=0xa01fa) returned 1 [0065.668] SetFocus (hWnd=0xa01fa) returned 0x2022e [0065.668] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x8, wParam=0xa01fa, lParam=0x0) returned 0x1 [0065.668] SendMessageW (hWnd=0x2022e, Msg=0x2111, wParam=0x200022e, lParam=0x2022e) returned 0x0 [0065.669] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0065.669] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0065.669] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x282, wParam=0xb, lParam=0x0) returned 0x0 [0065.669] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x282, wParam=0xf, lParam=0x901bb) returned 0x0 [0065.670] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0065.679] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0065.679] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x7, wParam=0x2022e, lParam=0x0) returned 0x0 [0065.679] GetStockObject (i=5) returned 0x1900015 [0065.680] GetDlgItem (hDlg=0x8016e, nIDDlgItem=655866) returned 0xa01fa [0065.680] SendMessageW (hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43d080) returned 0x0 [0065.680] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43d080) returned 0x0 [0065.681] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0065.681] GetFocus () returned 0xa01fa [0065.681] GetFocus () returned 0xa01fa [0065.682] GetFocus () returned 0xa01fa [0065.682] GetKeyState (nVirtKey=1) returned -127 [0065.682] GetKeyState (nVirtKey=2) returned 0 [0065.682] GetKeyState (nVirtKey=4) returned 0 [0065.682] GetKeyState (nVirtKey=5) returned 0 [0065.682] GetKeyState (nVirtKey=6) returned 0 [0065.683] GetCapture () returned 0x0 [0065.684] SetCapture (hWnd=0xa01fa) returned 0x0 [0065.685] GetKeyState (nVirtKey=1) returned -127 [0065.685] GetKeyState (nVirtKey=2) returned 0 [0065.685] GetKeyState (nVirtKey=4) returned 0 [0065.685] GetKeyState (nVirtKey=5) returned 0 [0065.685] GetKeyState (nVirtKey=6) returned 0 [0065.687] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0065.688] InvalidateRect (hWnd=0xa01fa, lpRect=0x43dc30, bErase=0) returned 1 [0065.688] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0065.688] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0065.688] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0065.688] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0065.688] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0065.690] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x2591ab0, cPoints=0x1 | out: lpPoints=0x2591ab0) returned 39715228 [0065.693] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0065.693] InvalidateRect (hWnd=0xa01fa, lpRect=0x43db80, bErase=0) returned 1 [0065.694] UpdateWindow (hWnd=0xa01fa) returned 0 [0065.695] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x43d198 | out: lpPaint=0x43d198) returned 0xa0100d0 [0065.695] GdipCreateHalftonePalette () returned 0x2e0801b6 [0065.696] SelectPalette (hdc=0xa0100d0, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0065.698] CreateCompatibleDC (hdc=0xa0100d0) returned 0x2b010758 [0065.699] GetObjectType (h=0xa0100d0) returned 0x3 [0065.700] CreateCompatibleBitmap (hdc=0xa0100d0, cx=1, cy=1) returned 0x6005053b [0065.702] GetDIBits (in: hdc=0xa0100d0, hbm=0x6005053b, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x43c8b8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43c8b8) returned 1 [0065.702] GetDIBits (in: hdc=0xa0100d0, hbm=0x6005053b, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x43c8b8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43c8b8) returned 1 [0065.702] DeleteObject (ho=0x6005053b) returned 1 [0065.703] CreateDIBSection (in: hdc=0xa0100d0, lpbmi=0x43ca90, usage=0x0, ppvBits=0x43ca88, hSection=0x0, offset=0x0 | out: ppvBits=0x43ca88) returned 0x2805055a [0065.704] SelectObject (hdc=0x2b010758, h=0x2805055a) returned 0x185000f [0065.704] GdipCreateFromHDC (hdc=0x2b010758, graphics=0x43cfa0) returned 0x0 [0065.707] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0065.709] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0065.711] GdipCreateMatrix (matrix=0x43d0d0) returned 0x0 [0065.712] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c468ce0) returned 0x0 [0065.713] GdipIsMatrixIdentity (matrix=0x1c468ce0, result=0x43d130) returned 0x0 [0065.714] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e05d0 [0065.714] GdipGetMatrixElements (matrix=0x1c468ce0, matrixOut=0x1f2e05d0) returned 0x0 [0065.715] LocalFree (hMem=0x1f2e05d0) returned 0x0 [0065.715] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0065.716] GdipDeleteMatrix (matrix=0x1c468ce0) returned 0x0 [0065.717] GdipCreateRegion (region=0x43d0d0) returned 0x0 [0065.718] GdipGetClip (graphics=0x1c46d570, region=0x1c46d1b0) returned 0x0 [0065.719] GdipIsInfiniteRegion (region=0x1c46d1b0, graphics=0x1c46d570, result=0x43d100) returned 0x0 [0065.719] GdipSaveGraphics (graphics=0x1c46d570, state=0x43d1d0) returned 0x0 [0065.723] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffdac0dbd) returned 0x0 [0065.730] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0065.731] GdipDeleteRegion (region=0x1c46d1b0) returned 0x0 [0065.741] SystemParametersInfoW (in: uiAction=0x42, uiParam=0x10, pvParam=0x43cd60, fWinIni=0x0 | out: pvParam=0x43cd60) returned 1 [0065.741] GdipGetDC (graphics=0x1c46d570, hdc=0x43c5c0) returned 0x0 [0065.741] GetCurrentObject (hdc=0x2b010758, type=0x1) returned 0x1b00017 [0065.741] GetCurrentObject (hdc=0x2b010758, type=0x2) returned 0x1900010 [0065.741] GetCurrentObject (hdc=0x2b010758, type=0x7) returned 0x2805055a [0065.741] GetCurrentObject (hdc=0x2b010758, type=0x6) returned 0x18a0048 [0065.741] SaveDC (hdc=0x2b010758) returned 1 [0065.742] GetNearestColor (hdc=0x2b010758, color=0xf0f0f0) returned 0xf0f0f0 [0065.742] GetNearestColor (hdc=0x2b010758, color=0xa0a0a0) returned 0xa0a0a0 [0065.742] GetNearestColor (hdc=0x2b010758, color=0x696969) returned 0x696969 [0065.742] GetNearestColor (hdc=0x2b010758, color=0xa0a0a0) returned 0xa0a0a0 [0065.742] GetNearestColor (hdc=0x2b010758, color=0x0) returned 0x0 [0065.742] GetNearestColor (hdc=0x2b010758, color=0xffffff) returned 0xffffff [0065.742] GetNearestColor (hdc=0x2b010758, color=0xe5e5e5) returned 0xe5e5e5 [0065.742] GetNearestColor (hdc=0x2b010758, color=0xd8d8d8) returned 0xd8d8d8 [0065.742] GetNearestColor (hdc=0x2b010758, color=0x0) returned 0x0 [0065.742] RestoreDC (hdc=0x2b010758, nSavedDC=-1) returned 1 [0065.742] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0065.743] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b010758) returned 0x0 [0065.743] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0065.743] CoTaskMemAlloc (cb=0x13) returned 0x633d60 [0065.744] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0065.744] CoTaskMemFree (pv=0x633d60) [0065.746] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43ccb0) returned 0x0 [0065.746] GdipSetStringFormatAlign (format=0x1c46d1b0, align=0x1) returned 0x0 [0065.746] GdipSetStringFormatLineAlign (format=0x1c46d1b0, align=0x1) returned 0x0 [0065.746] GdipSetStringFormatHotkeyPrefix (format=0x1c46d1b0, hotkeyPrefix=2) returned 0x0 [0065.746] GdipGetStringFormatFlags (format=0x1c46d1b0, flags=0x43cce0) returned 0x0 [0065.746] GdipGetStringFormatTrimming (format=0x1c46d1b0, trimming=0x43cce0) returned 0x0 [0065.747] GdipGetStringFormatHotkeyPrefix (format=0x1c46d1b0, hotkeyPrefix=0x43cce0) returned 0x0 [0065.748] GdipGetFontSize (font=0x1c46d1b0, size=0x43cce0) returned 0x0 [0065.748] GdipGetFontStyle (font=0x1c46d1b0, style=0x43cce0) returned 0x0 [0065.748] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0065.748] GdipDeleteStringFormat (format=0x1c46d1b0) returned 0x0 [0065.748] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0065.749] CoTaskMemAlloc (cb=0x13) returned 0x633a60 [0065.749] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0065.749] CoTaskMemFree (pv=0x633a60) [0065.750] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43c970) returned 0x0 [0065.751] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43c980) returned 0x0 [0065.751] GdipSetStringFormatFlags (format=0x1c46a7e0, flags=0) returned 0x0 [0065.751] GdipSetStringFormatTrimming (format=0x1c46a7e0, trimming=0x1) returned 0x0 [0065.751] GdipSetStringFormatHotkeyPrefix (format=0x1c46a7e0, hotkeyPrefix=2) returned 0x0 [0065.751] GdipSetStringFormatAlign (format=0x1c46a7e0, align=0x1) returned 0x0 [0065.751] GdipSetStringFormatLineAlign (format=0x1c46a7e0, align=0x1) returned 0x0 [0065.751] GdipMeasureString (graphics=0x1c46a410, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43c898, stringFormat=0x1c46a7e0, boundingBox=0x43c888, codepointsFitted=0x43c884, linesFilled=0x43c880) returned 0x0 [0065.752] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0065.752] GdipDeleteStringFormat (format=0x1c46a7e0) returned 0x0 [0065.752] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0065.752] GdipDeleteGraphics (graphics=0x1c46a410) returned 0x0 [0065.752] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0065.752] CoTaskMemAlloc (cb=0x13) returned 0x633c40 [0065.752] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0065.752] CoTaskMemFree (pv=0x633c40) [0065.753] GdipCreateRegion (region=0x43c8e0) returned 0x0 [0065.753] GdipGetClip (graphics=0x1c46d570, region=0x1c46d1b0) returned 0x0 [0065.753] GdipCreateMatrix (matrix=0x43c8e0) returned 0x0 [0065.753] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c46d270) returned 0x0 [0065.753] GdipIsMatrixIdentity (matrix=0x1c46d270, result=0x43c940) returned 0x0 [0065.753] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0f90 [0065.753] GdipGetMatrixElements (matrix=0x1c46d270, matrixOut=0x1f2e0f90) returned 0x0 [0065.754] LocalFree (hMem=0x1f2e0f90) returned 0x0 [0065.762] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e00d0 [0065.762] GdipGetMatrixElements (matrix=0x1c46d270, matrixOut=0x1f2e00d0) returned 0x0 [0065.762] LocalFree (hMem=0x1f2e00d0) returned 0x0 [0065.762] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0065.762] GdipDeleteMatrix (matrix=0x1c46d270) returned 0x0 [0065.762] GdipIsInfiniteRegion (region=0x1c46d1b0, graphics=0x1c46d570, result=0x43c990) returned 0x0 [0065.762] GdipIsInfiniteRegion (region=0x1c46d1b0, graphics=0x1c46d570, result=0x43c950) returned 0x0 [0065.762] GdipGetRegionHRgn (region=0x1c46d1b0, graphics=0x1c46d570, hRgn=0x43c950) returned 0x0 [0065.763] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0065.763] GdipDeleteRegion (region=0x1c46d1b0) returned 0x0 [0065.763] GdipGetDC (graphics=0x1c46d570, hdc=0x43c9c0) returned 0x0 [0065.764] GetCurrentObject (hdc=0x2b010758, type=0x1) returned 0x1b00017 [0065.764] GetCurrentObject (hdc=0x2b010758, type=0x2) returned 0x1900010 [0065.764] GetCurrentObject (hdc=0x2b010758, type=0x7) returned 0x2805055a [0065.764] GetCurrentObject (hdc=0x2b010758, type=0x6) returned 0x18a0048 [0065.764] SaveDC (hdc=0x2b010758) returned 1 [0065.765] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x410406cc [0065.765] GetClipRgn (hdc=0x2b010758, hrgn=0x410406cc) returned 0 [0065.766] SelectClipRgn (hdc=0x2b010758, hrgn=0x3b0405d8) returned 2 [0065.766] DeleteObject (ho=0x410406cc) returned 1 [0065.766] DeleteObject (ho=0x3b0405d8) returned 1 [0065.766] OffsetViewportOrgEx (in: hdc=0x2b010758, x=0, y=0, lppt=0x2593c28 | out: lppt=0x2593c28) returned 1 [0065.766] GetNearestColor (hdc=0x2b010758, color=0xf0f0f0) returned 0xf0f0f0 [0065.767] CreateSolidBrush (color=0xf0f0f0) returned 0xc10075d [0065.767] FillRect (hDC=0x2b010758, lprc=0x43c990, hbr=0xc10075d) returned 1 [0065.767] DeleteObject (ho=0xc10075d) returned 1 [0065.767] RestoreDC (hdc=0x2b010758, nSavedDC=-1) returned 1 [0065.767] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0065.767] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b010758) returned 0x0 [0065.767] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0065.768] CoTaskMemAlloc (cb=0x13) returned 0x633c60 [0065.768] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0065.768] CoTaskMemFree (pv=0x633c60) [0065.768] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43ca10) returned 0x0 [0065.773] GdipSetStringFormatAlign (format=0x1c46d1b0, align=0x1) returned 0x0 [0065.773] GdipSetStringFormatLineAlign (format=0x1c46d1b0, align=0x1) returned 0x0 [0065.773] GdipSetStringFormatHotkeyPrefix (format=0x1c46d1b0, hotkeyPrefix=2) returned 0x0 [0065.775] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x43ca80) returned 0x0 [0065.776] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43c990, stringFormat=0x1c46d1b0, brush=0x1c46d2b0) returned 0x0 [0065.830] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0065.830] GdipDeleteBrush (brush=0x1c46d2b0) returned 0x0 [0065.830] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0065.831] GdipDeleteStringFormat (format=0x1c46d1b0) returned 0x0 [0065.831] GetFocus () returned 0xa01fa [0065.831] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0065.831] CoTaskMemAlloc (cb=0x13) returned 0x633aa0 [0065.832] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0065.832] CoTaskMemFree (pv=0x633aa0) [0065.832] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x43cd70) returned 0x0 [0065.833] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0065.834] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0065.834] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0065.834] GdipCreateRegion (region=0x43c840) returned 0x0 [0065.834] GdipGetClip (graphics=0x1c46d570, region=0x1c46bbe0) returned 0x0 [0065.834] GdipCreateMatrix (matrix=0x43c840) returned 0x0 [0065.834] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c468ce0) returned 0x0 [0065.834] GdipIsMatrixIdentity (matrix=0x1c468ce0, result=0x43c8a0) returned 0x0 [0065.834] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0990 [0065.834] GdipGetMatrixElements (matrix=0x1c468ce0, matrixOut=0x1f2e0990) returned 0x0 [0065.834] LocalFree (hMem=0x1f2e0990) returned 0x0 [0065.834] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0490 [0065.834] GdipGetMatrixElements (matrix=0x1c468ce0, matrixOut=0x1f2e0490) returned 0x0 [0065.835] LocalFree (hMem=0x1f2e0490) returned 0x0 [0065.835] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0065.835] GdipDeleteMatrix (matrix=0x1c468ce0) returned 0x0 [0065.835] GdipIsInfiniteRegion (region=0x1c46bbe0, graphics=0x1c46d570, result=0x43c8f0) returned 0x0 [0065.835] GdipIsInfiniteRegion (region=0x1c46bbe0, graphics=0x1c46d570, result=0x43c8b0) returned 0x0 [0065.835] GdipGetRegionHRgn (region=0x1c46bbe0, graphics=0x1c46d570, hRgn=0x43c8b0) returned 0x0 [0065.835] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0065.835] GdipDeleteRegion (region=0x1c46bbe0) returned 0x0 [0065.835] GdipGetDC (graphics=0x1c46d570, hdc=0x43c920) returned 0x0 [0065.835] GetCurrentObject (hdc=0x2b010758, type=0x1) returned 0x1b00017 [0065.835] GetCurrentObject (hdc=0x2b010758, type=0x2) returned 0x1900010 [0065.835] GetCurrentObject (hdc=0x2b010758, type=0x7) returned 0x2805055a [0065.835] GetCurrentObject (hdc=0x2b010758, type=0x6) returned 0x18a0048 [0065.835] SaveDC (hdc=0x2b010758) returned 1 [0065.835] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3c0405d8 [0065.835] GetClipRgn (hdc=0x2b010758, hrgn=0x3c0405d8) returned 0 [0065.835] SelectClipRgn (hdc=0x2b010758, hrgn=0x420406cc) returned 2 [0065.836] DeleteObject (ho=0x3c0405d8) returned 1 [0065.836] DeleteObject (ho=0x420406cc) returned 1 [0065.836] OffsetViewportOrgEx (in: hdc=0x2b010758, x=0, y=0, lppt=0x25941c8 | out: lppt=0x25941c8) returned 1 [0068.288] GetROP2 (hdc=0x2b010758) returned 13 [0068.288] GetBkMode (hdc=0x2b010758) returned 2 [0068.289] SetBkMode (hdc=0x2b010758, mode=1) returned 2 [0068.289] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x5c30054e [0068.290] SelectObject (hdc=0x2b010758, h=0x5c30054e) returned 0x1b00017 [0068.290] MoveToEx (in: hdc=0x2b010758, x=123, y=1, lppt=0x2594230 | out: lppt=0x2594230) returned 1 [0068.290] LineTo (hdc=0x2b010758, x=1, y=1) returned 1 [0068.290] SetBkMode (hdc=0x2b010758, mode=2) returned 1 [0068.290] MoveToEx (in: hdc=0x2b010758, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0068.290] GetROP2 (hdc=0x2b010758) returned 13 [0068.290] GetBkMode (hdc=0x2b010758) returned 2 [0068.290] SetBkMode (hdc=0x2b010758, mode=1) returned 2 [0068.290] SelectObject (hdc=0x2b010758, h=0x5c30054e) returned 0x5c30054e [0068.290] MoveToEx (in: hdc=0x2b010758, x=1, y=1, lppt=0x2594248 | out: lppt=0x2594248) returned 1 [0068.290] LineTo (hdc=0x2b010758, x=1, y=34) returned 1 [0068.291] SetBkMode (hdc=0x2b010758, mode=2) returned 1 [0068.291] MoveToEx (in: hdc=0x2b010758, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0068.291] SelectObject (hdc=0x2b010758, h=0x1b00017) returned 0x5c30054e [0068.291] DeleteObject (ho=0x5c30054e) returned 1 [0068.291] GetROP2 (hdc=0x2b010758) returned 13 [0068.291] GetBkMode (hdc=0x2b010758) returned 2 [0068.291] SetBkMode (hdc=0x2b010758, mode=1) returned 2 [0068.291] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x830073e [0068.291] SelectObject (hdc=0x2b010758, h=0x830073e) returned 0x1b00017 [0068.291] MoveToEx (in: hdc=0x2b010758, x=1, y=34, lppt=0x25942b0 | out: lppt=0x25942b0) returned 1 [0068.291] LineTo (hdc=0x2b010758, x=123, y=34) returned 1 [0068.291] SetBkMode (hdc=0x2b010758, mode=2) returned 1 [0068.291] MoveToEx (in: hdc=0x2b010758, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0068.291] GetROP2 (hdc=0x2b010758) returned 13 [0068.291] GetBkMode (hdc=0x2b010758) returned 2 [0068.292] SetBkMode (hdc=0x2b010758, mode=1) returned 2 [0068.292] SelectObject (hdc=0x2b010758, h=0x830073e) returned 0x830073e [0068.292] MoveToEx (in: hdc=0x2b010758, x=123, y=34, lppt=0x25942c8 | out: lppt=0x25942c8) returned 1 [0068.292] LineTo (hdc=0x2b010758, x=123, y=0) returned 1 [0068.292] SetBkMode (hdc=0x2b010758, mode=2) returned 1 [0068.292] MoveToEx (in: hdc=0x2b010758, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0068.292] SelectObject (hdc=0x2b010758, h=0x1b00017) returned 0x830073e [0068.292] DeleteObject (ho=0x830073e) returned 1 [0068.292] GetROP2 (hdc=0x2b010758) returned 13 [0068.292] GetBkMode (hdc=0x2b010758) returned 2 [0068.292] SetBkMode (hdc=0x2b010758, mode=1) returned 2 [0068.292] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x5d30054e [0068.292] SelectObject (hdc=0x2b010758, h=0x5d30054e) returned 0x1b00017 [0068.292] MoveToEx (in: hdc=0x2b010758, x=122, y=2, lppt=0x2594330 | out: lppt=0x2594330) returned 1 [0068.292] LineTo (hdc=0x2b010758, x=2, y=2) returned 1 [0068.292] SetBkMode (hdc=0x2b010758, mode=2) returned 1 [0068.292] MoveToEx (in: hdc=0x2b010758, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0068.292] GetROP2 (hdc=0x2b010758) returned 13 [0068.292] GetBkMode (hdc=0x2b010758) returned 2 [0068.292] SetBkMode (hdc=0x2b010758, mode=1) returned 2 [0068.292] SelectObject (hdc=0x2b010758, h=0x5d30054e) returned 0x5d30054e [0068.292] MoveToEx (in: hdc=0x2b010758, x=2, y=2, lppt=0x2594348 | out: lppt=0x2594348) returned 1 [0068.293] LineTo (hdc=0x2b010758, x=2, y=33) returned 1 [0068.293] SetBkMode (hdc=0x2b010758, mode=2) returned 1 [0068.293] MoveToEx (in: hdc=0x2b010758, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0068.293] SelectObject (hdc=0x2b010758, h=0x1b00017) returned 0x5d30054e [0068.293] DeleteObject (ho=0x5d30054e) returned 1 [0068.293] GetROP2 (hdc=0x2b010758) returned 13 [0068.293] GetBkMode (hdc=0x2b010758) returned 2 [0068.293] SetBkMode (hdc=0x2b010758, mode=1) returned 2 [0068.293] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x930073e [0068.293] SelectObject (hdc=0x2b010758, h=0x930073e) returned 0x1b00017 [0068.293] MoveToEx (in: hdc=0x2b010758, x=2, y=33, lppt=0x25943b0 | out: lppt=0x25943b0) returned 1 [0068.293] LineTo (hdc=0x2b010758, x=122, y=33) returned 1 [0068.293] SetBkMode (hdc=0x2b010758, mode=2) returned 1 [0068.293] MoveToEx (in: hdc=0x2b010758, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0068.293] GetROP2 (hdc=0x2b010758) returned 13 [0068.293] GetBkMode (hdc=0x2b010758) returned 2 [0068.293] SetBkMode (hdc=0x2b010758, mode=1) returned 2 [0068.293] SelectObject (hdc=0x2b010758, h=0x930073e) returned 0x930073e [0068.293] MoveToEx (in: hdc=0x2b010758, x=122, y=33, lppt=0x25943c8 | out: lppt=0x25943c8) returned 1 [0068.293] LineTo (hdc=0x2b010758, x=122, y=1) returned 1 [0068.293] SetBkMode (hdc=0x2b010758, mode=2) returned 1 [0068.294] MoveToEx (in: hdc=0x2b010758, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0068.294] SelectObject (hdc=0x2b010758, h=0x1b00017) returned 0x930073e [0068.294] DeleteObject (ho=0x930073e) returned 1 [0068.294] RestoreDC (hdc=0x2b010758, nSavedDC=-1) returned 1 [0068.294] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0068.294] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b010758) returned 0x0 [0068.294] GdipGetDC (graphics=0x1c46d570, hdc=0x43d0a0) returned 0x0 [0068.294] BitBlt (hdc=0xa0100d0, x=0, y=0, cx=125, cy=36, hdcSrc=0x2b010758, x1=0, y1=0, rop=0xcc0020) returned 1 [0068.295] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0068.295] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b010758) returned 0x0 [0068.295] SelectPalette (hdc=0xa0100d0, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0068.296] SelectObject (hdc=0x2b010758, h=0x185000f) returned 0x2805055a [0068.296] DeleteDC (hdc=0x2b010758) returned 1 [0068.296] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0068.296] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0068.296] EndPaint (hWnd=0xa01fa, lpPaint=0x43d1a8) returned 1 [0068.296] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x2594420, cPoints=0x1 | out: lpPoints=0x2594420) returned 39715228 [0068.296] WindowFromPoint (Point=0x26a000001be) returned 0xa01fa [0068.297] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26a01be) returned 0x1 [0068.298] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0068.298] NotifyWinEvent (event=0x800c, hwnd=0xa01fa, idObject=-4, idChild=0) [0068.313] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0xfffffffffffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0068.314] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43da80) returned 0x0 [0068.314] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43da80) returned 0x0 [0068.320] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43d4b0 | out: lpwndpl=0x43d4b0) returned 1 [0068.320] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x47, wParam=0x0, lParam=0x43da80) returned 0x0 [0068.320] GetClientRect (in: hWnd=0x8016e, lpRect=0x43d250 | out: lpRect=0x43d250) returned 1 [0068.320] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43d250 | out: lpRect=0x43d250) returned 1 [0069.409] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x5f7fc0 [0069.409] RtlMoveMemory (in: Destination=0x5f7fc0, Source=0x2594d08, Length=0x70 | out: Destination=0x5f7fc0) [0069.409] ShellExecuteExW (in: pExecInfo=0x2594f18*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2594f18*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0069.416] GetKeyState (nVirtKey=16) returned 0 [0069.416] GetKeyState (nVirtKey=17) returned 0 [0069.416] GetKeyState (nVirtKey=18) returned -127 [0069.417] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x104, wParam=0x12, lParam=0x20380001) returned 0x0 [0069.418] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43d7c0) returned 0x0 [0069.421] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43d1f0 | out: lpwndpl=0x43d1f0) returned 1 [0069.421] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x47, wParam=0x0, lParam=0x43d7c0) returned 0x0 [0069.421] GetClientRect (in: hWnd=0x8016e, lpRect=0x43cf90 | out: lpRect=0x43cf90) returned 1 [0069.421] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43cf90 | out: lpRect=0x43cf90) returned 1 [0069.422] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x47, wParam=0x0, lParam=0x43d7c0) returned 0x0 [0069.423] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0069.424] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0069.424] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0069.433] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x1c, wParam=0x0, lParam=0x7f8) returned 0x0 [0069.433] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x1c, wParam=0x0, lParam=0x7f8) returned 0x0 [0069.433] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x1c, wParam=0x0, lParam=0x7f8) returned 0x0 [0069.433] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0069.434] GetStockObject (i=5) returned 0x1900015 [0069.434] GetDlgItem (hDlg=0x8016e, nIDDlgItem=655866) returned 0xa01fa [0069.434] SendMessageW (hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43cbc0) returned 0x0 [0069.434] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43cbc0) returned 0x0 [0069.435] GetCapture () returned 0x0 [0069.435] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0069.435] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0069.435] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0069.436] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26a01be) returned 0x1 [0069.436] SetCursor (hCursor=0x200149) returned 0x200149 [0069.436] GetKeyState (nVirtKey=1) returned 0 [0069.436] GetKeyState (nVirtKey=2) returned 0 [0069.436] GetKeyState (nVirtKey=4) returned 0 [0069.436] GetKeyState (nVirtKey=5) returned 0 [0069.436] GetKeyState (nVirtKey=6) returned 0 [0069.436] BeginPaint (in: hWnd=0x8016e, lpPaint=0x43ce08 | out: lpPaint=0x43ce08) returned 0x10105c2 [0069.436] SelectPalette (hdc=0x10105c2, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0069.436] GetWindowTextLengthW (hWnd=0x8016e) returned 18 [0069.437] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x12 [0069.437] GetSystemMetrics (nIndex=42) returned 0 [0069.437] CoTaskMemAlloc (cb=0x2a) returned 0x1f2e0f90 [0069.437] GetWindowTextW (in: hWnd=0x8016e, lpString=0x1f2e0f90, nMaxCount=19 | out: lpString="Desktop Ransomware") returned 18 [0069.437] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0xd, wParam=0x13, lParam=0x1f2e0f90) returned 0x12 [0069.437] CoTaskMemFree (pv=0x1f2e0f90) [0069.437] SelectPalette (hdc=0x10105c2, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0069.437] EndPaint (hWnd=0x8016e, lpPaint=0x43ce18) returned 1 [0069.437] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x43cd58 | out: lpPaint=0x43cd58) returned 0x501071f [0069.437] SelectPalette (hdc=0x501071f, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0069.437] CreateCompatibleDC (hdc=0x501071f) returned 0x25010751 [0069.437] SelectObject (hdc=0x25010751, h=0x2805055a) returned 0x185000f [0069.438] GdipCreateFromHDC (hdc=0x25010751, graphics=0x43cb60) returned 0x0 [0069.438] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0069.438] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0069.438] GdipCreateMatrix (matrix=0x43cc90) returned 0x0 [0069.438] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c46d270) returned 0x0 [0069.438] GdipIsMatrixIdentity (matrix=0x1c46d270, result=0x43ccf0) returned 0x0 [0069.438] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0f90 [0069.438] GdipGetMatrixElements (matrix=0x1c46d270, matrixOut=0x1f2e0f90) returned 0x0 [0069.438] LocalFree (hMem=0x1f2e0f90) returned 0x0 [0069.438] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.438] GdipDeleteMatrix (matrix=0x1c46d270) returned 0x0 [0069.438] GdipCreateRegion (region=0x43cc90) returned 0x0 [0069.438] GdipGetClip (graphics=0x1c46d570, region=0x1c46bbe0) returned 0x0 [0069.438] GdipIsInfiniteRegion (region=0x1c46bbe0, graphics=0x1c46d570, result=0x43ccc0) returned 0x0 [0069.439] GdipSaveGraphics (graphics=0x1c46d570, state=0x43cd90) returned 0x0 [0069.439] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffda90dbd) returned 0x0 [0069.439] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.439] GdipDeleteRegion (region=0x1c46bbe0) returned 0x0 [0069.439] GdipGetDC (graphics=0x1c46d570, hdc=0x43c180) returned 0x0 [0069.439] GetCurrentObject (hdc=0x25010751, type=0x1) returned 0x1b00017 [0069.439] GetCurrentObject (hdc=0x25010751, type=0x2) returned 0x1900010 [0069.439] GetCurrentObject (hdc=0x25010751, type=0x7) returned 0x2805055a [0069.439] GetCurrentObject (hdc=0x25010751, type=0x6) returned 0x18a0048 [0069.440] SaveDC (hdc=0x25010751) returned 1 [0069.440] GetNearestColor (hdc=0x25010751, color=0xf0f0f0) returned 0xf0f0f0 [0069.440] GetNearestColor (hdc=0x25010751, color=0xa0a0a0) returned 0xa0a0a0 [0069.440] GetNearestColor (hdc=0x25010751, color=0x696969) returned 0x696969 [0069.440] GetNearestColor (hdc=0x25010751, color=0xa0a0a0) returned 0xa0a0a0 [0069.440] GetNearestColor (hdc=0x25010751, color=0x0) returned 0x0 [0069.440] GetNearestColor (hdc=0x25010751, color=0xffffff) returned 0xffffff [0069.441] GetNearestColor (hdc=0x25010751, color=0xe5e5e5) returned 0xe5e5e5 [0069.441] GetNearestColor (hdc=0x25010751, color=0xd8d8d8) returned 0xd8d8d8 [0069.441] GetNearestColor (hdc=0x25010751, color=0x0) returned 0x0 [0069.441] RestoreDC (hdc=0x25010751, nSavedDC=-1) returned 1 [0069.441] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.441] GdipReleaseDC (graphics=0x1c46d570, hdc=0x25010751) returned 0x0 [0069.442] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0069.442] CoTaskMemAlloc (cb=0x13) returned 0x633aa0 [0069.442] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0069.442] CoTaskMemFree (pv=0x633aa0) [0069.442] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43c870) returned 0x0 [0069.442] GdipSetStringFormatAlign (format=0x1c46a5e0, align=0x1) returned 0x0 [0069.442] GdipSetStringFormatLineAlign (format=0x1c46a5e0, align=0x1) returned 0x0 [0069.442] GdipSetStringFormatHotkeyPrefix (format=0x1c46a5e0, hotkeyPrefix=2) returned 0x0 [0069.442] GdipGetStringFormatFlags (format=0x1c46a5e0, flags=0x43c8a0) returned 0x0 [0069.442] GdipGetStringFormatTrimming (format=0x1c46a5e0, trimming=0x43c8a0) returned 0x0 [0069.442] GdipGetStringFormatHotkeyPrefix (format=0x1c46a5e0, hotkeyPrefix=0x43c8a0) returned 0x0 [0069.442] GdipGetFontSize (font=0x1c46a5e0, size=0x43c8a0) returned 0x0 [0069.442] GdipGetFontStyle (font=0x1c46a5e0, style=0x43c8a0) returned 0x0 [0069.443] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.443] GdipDeleteStringFormat (format=0x1c46a5e0) returned 0x0 [0069.443] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0069.443] CoTaskMemAlloc (cb=0x13) returned 0x633c60 [0069.443] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0069.443] CoTaskMemFree (pv=0x633c60) [0069.443] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43c530) returned 0x0 [0069.444] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43c540) returned 0x0 [0069.444] GdipSetStringFormatFlags (format=0x1c46a5e0, flags=0) returned 0x0 [0069.444] GdipSetStringFormatTrimming (format=0x1c46a5e0, trimming=0x1) returned 0x0 [0069.444] GdipSetStringFormatHotkeyPrefix (format=0x1c46a5e0, hotkeyPrefix=2) returned 0x0 [0069.444] GdipSetStringFormatAlign (format=0x1c46a5e0, align=0x1) returned 0x0 [0069.444] GdipSetStringFormatLineAlign (format=0x1c46a5e0, align=0x1) returned 0x0 [0069.444] GdipMeasureString (graphics=0x1c46c700, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43c458, stringFormat=0x1c46a5e0, boundingBox=0x43c448, codepointsFitted=0x43c444, linesFilled=0x43c440) returned 0x0 [0069.444] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.444] GdipDeleteStringFormat (format=0x1c46a5e0) returned 0x0 [0069.444] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.444] GdipDeleteGraphics (graphics=0x1c46c700) returned 0x0 [0069.444] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0069.445] CoTaskMemAlloc (cb=0x13) returned 0x633f40 [0069.445] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0069.445] CoTaskMemFree (pv=0x633f40) [0069.445] GdipCreateRegion (region=0x43c4a0) returned 0x0 [0069.445] GdipGetClip (graphics=0x1c46d570, region=0x1c46bbe0) returned 0x0 [0069.445] GdipCreateMatrix (matrix=0x43c4a0) returned 0x0 [0069.445] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c468ce0) returned 0x0 [0069.445] GdipIsMatrixIdentity (matrix=0x1c468ce0, result=0x43c500) returned 0x0 [0069.445] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e04d0 [0069.445] GdipGetMatrixElements (matrix=0x1c468ce0, matrixOut=0x1f2e04d0) returned 0x0 [0069.446] LocalFree (hMem=0x1f2e04d0) returned 0x0 [0069.446] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0790 [0069.446] GdipGetMatrixElements (matrix=0x1c468ce0, matrixOut=0x1f2e0790) returned 0x0 [0069.446] LocalFree (hMem=0x1f2e0790) returned 0x0 [0069.446] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.446] GdipDeleteMatrix (matrix=0x1c468ce0) returned 0x0 [0069.446] GdipIsInfiniteRegion (region=0x1c46bbe0, graphics=0x1c46d570, result=0x43c550) returned 0x0 [0069.446] GdipIsInfiniteRegion (region=0x1c46bbe0, graphics=0x1c46d570, result=0x43c510) returned 0x0 [0069.446] GdipGetRegionHRgn (region=0x1c46bbe0, graphics=0x1c46d570, hRgn=0x43c510) returned 0x0 [0069.446] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.446] GdipDeleteRegion (region=0x1c46bbe0) returned 0x0 [0069.446] GdipGetDC (graphics=0x1c46d570, hdc=0x43c580) returned 0x0 [0069.446] GetCurrentObject (hdc=0x25010751, type=0x1) returned 0x1b00017 [0069.446] GetCurrentObject (hdc=0x25010751, type=0x2) returned 0x1900010 [0069.446] GetCurrentObject (hdc=0x25010751, type=0x7) returned 0x2805055a [0069.446] GetCurrentObject (hdc=0x25010751, type=0x6) returned 0x18a0048 [0069.447] SaveDC (hdc=0x25010751) returned 1 [0069.447] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x430406cc [0069.447] GetClipRgn (hdc=0x25010751, hrgn=0x430406cc) returned 0 [0069.447] SelectClipRgn (hdc=0x25010751, hrgn=0x3d0405d8) returned 2 [0069.447] DeleteObject (ho=0x430406cc) returned 1 [0069.448] DeleteObject (ho=0x3d0405d8) returned 1 [0069.448] OffsetViewportOrgEx (in: hdc=0x25010751, x=0, y=0, lppt=0x2595cf8 | out: lppt=0x2595cf8) returned 1 [0069.448] GetNearestColor (hdc=0x25010751, color=0xf0f0f0) returned 0xf0f0f0 [0069.448] CreateSolidBrush (color=0xf0f0f0) returned 0xd10075d [0069.448] FillRect (hDC=0x25010751, lprc=0x43c550, hbr=0xd10075d) returned 1 [0069.448] DeleteObject (ho=0xd10075d) returned 1 [0069.448] RestoreDC (hdc=0x25010751, nSavedDC=-1) returned 1 [0069.448] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.448] GdipReleaseDC (graphics=0x1c46d570, hdc=0x25010751) returned 0x0 [0069.448] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0069.449] CoTaskMemAlloc (cb=0x13) returned 0x633840 [0069.449] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0069.449] CoTaskMemFree (pv=0x633840) [0069.449] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43c5d0) returned 0x0 [0069.449] GdipSetStringFormatAlign (format=0x1c46a5e0, align=0x1) returned 0x0 [0069.449] GdipSetStringFormatLineAlign (format=0x1c46a5e0, align=0x1) returned 0x0 [0069.449] GdipSetStringFormatHotkeyPrefix (format=0x1c46a5e0, hotkeyPrefix=2) returned 0x0 [0069.449] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x43c640) returned 0x0 [0069.449] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43c550, stringFormat=0x1c46a5e0, brush=0x1c46a6c0) returned 0x0 [0069.450] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.450] GdipDeleteBrush (brush=0x1c46a6c0) returned 0x0 [0069.450] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.450] GdipDeleteStringFormat (format=0x1c46a5e0) returned 0x0 [0069.450] GetFocus () returned 0x0 [0069.450] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0069.450] CoTaskMemAlloc (cb=0x13) returned 0x633d00 [0069.451] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0069.451] CoTaskMemFree (pv=0x633d00) [0069.451] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x43c930) returned 0x0 [0069.451] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0069.451] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.451] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0069.451] GdipCreateRegion (region=0x43c400) returned 0x0 [0069.451] GdipGetClip (graphics=0x1c46d570, region=0x1c46bbe0) returned 0x0 [0069.451] GdipCreateMatrix (matrix=0x43c400) returned 0x0 [0069.451] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c46d270) returned 0x0 [0069.451] GdipIsMatrixIdentity (matrix=0x1c46d270, result=0x43c460) returned 0x0 [0069.451] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0350 [0069.451] GdipGetMatrixElements (matrix=0x1c46d270, matrixOut=0x1f2e0350) returned 0x0 [0069.451] LocalFree (hMem=0x1f2e0350) returned 0x0 [0069.451] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0110 [0069.452] GdipGetMatrixElements (matrix=0x1c46d270, matrixOut=0x1f2e0110) returned 0x0 [0069.452] LocalFree (hMem=0x1f2e0110) returned 0x0 [0069.452] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.452] GdipDeleteMatrix (matrix=0x1c46d270) returned 0x0 [0069.452] GdipIsInfiniteRegion (region=0x1c46bbe0, graphics=0x1c46d570, result=0x43c4b0) returned 0x0 [0069.452] GdipIsInfiniteRegion (region=0x1c46bbe0, graphics=0x1c46d570, result=0x43c470) returned 0x0 [0069.452] GdipGetRegionHRgn (region=0x1c46bbe0, graphics=0x1c46d570, hRgn=0x43c470) returned 0x0 [0069.452] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.452] GdipDeleteRegion (region=0x1c46bbe0) returned 0x0 [0069.452] GdipGetDC (graphics=0x1c46d570, hdc=0x43c4e0) returned 0x0 [0069.452] GetCurrentObject (hdc=0x25010751, type=0x1) returned 0x1b00017 [0069.452] GetCurrentObject (hdc=0x25010751, type=0x2) returned 0x1900010 [0069.452] GetCurrentObject (hdc=0x25010751, type=0x7) returned 0x2805055a [0069.452] GetCurrentObject (hdc=0x25010751, type=0x6) returned 0x18a0048 [0069.453] SaveDC (hdc=0x25010751) returned 1 [0069.453] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3e0405d8 [0069.453] GetClipRgn (hdc=0x25010751, hrgn=0x3e0405d8) returned 0 [0069.453] SelectClipRgn (hdc=0x25010751, hrgn=0x440406cc) returned 2 [0069.453] DeleteObject (ho=0x3e0405d8) returned 1 [0069.453] DeleteObject (ho=0x440406cc) returned 1 [0069.453] OffsetViewportOrgEx (in: hdc=0x25010751, x=0, y=0, lppt=0x2596298 | out: lppt=0x2596298) returned 1 [0069.453] GetROP2 (hdc=0x25010751) returned 13 [0069.453] GetBkMode (hdc=0x25010751) returned 2 [0069.453] SetBkMode (hdc=0x25010751, mode=1) returned 2 [0069.453] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x6300778 [0069.453] SelectObject (hdc=0x25010751, h=0x6300778) returned 0x1b00017 [0069.453] MoveToEx (in: hdc=0x25010751, x=123, y=1, lppt=0x2596300 | out: lppt=0x2596300) returned 1 [0069.453] LineTo (hdc=0x25010751, x=1, y=1) returned 1 [0069.453] SetBkMode (hdc=0x25010751, mode=2) returned 1 [0069.454] MoveToEx (in: hdc=0x25010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.454] GetROP2 (hdc=0x25010751) returned 13 [0069.454] GetBkMode (hdc=0x25010751) returned 2 [0069.454] SetBkMode (hdc=0x25010751, mode=1) returned 2 [0069.454] SelectObject (hdc=0x25010751, h=0x6300778) returned 0x6300778 [0069.454] MoveToEx (in: hdc=0x25010751, x=1, y=1, lppt=0x2596318 | out: lppt=0x2596318) returned 1 [0069.454] LineTo (hdc=0x25010751, x=1, y=34) returned 1 [0069.454] SetBkMode (hdc=0x25010751, mode=2) returned 1 [0069.454] MoveToEx (in: hdc=0x25010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.454] SelectObject (hdc=0x25010751, h=0x1b00017) returned 0x6300778 [0069.454] DeleteObject (ho=0x6300778) returned 1 [0069.454] GetROP2 (hdc=0x25010751) returned 13 [0069.454] GetBkMode (hdc=0x25010751) returned 2 [0069.454] SetBkMode (hdc=0x25010751, mode=1) returned 2 [0069.454] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xd300762 [0069.454] SelectObject (hdc=0x25010751, h=0xd300762) returned 0x1b00017 [0069.454] MoveToEx (in: hdc=0x25010751, x=1, y=34, lppt=0x2596380 | out: lppt=0x2596380) returned 1 [0069.454] LineTo (hdc=0x25010751, x=123, y=34) returned 1 [0069.455] SetBkMode (hdc=0x25010751, mode=2) returned 1 [0069.455] MoveToEx (in: hdc=0x25010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.455] GetROP2 (hdc=0x25010751) returned 13 [0069.455] GetBkMode (hdc=0x25010751) returned 2 [0069.455] SetBkMode (hdc=0x25010751, mode=1) returned 2 [0069.455] SelectObject (hdc=0x25010751, h=0xd300762) returned 0xd300762 [0069.455] MoveToEx (in: hdc=0x25010751, x=123, y=34, lppt=0x2596398 | out: lppt=0x2596398) returned 1 [0069.455] LineTo (hdc=0x25010751, x=123, y=0) returned 1 [0069.455] SetBkMode (hdc=0x25010751, mode=2) returned 1 [0069.455] MoveToEx (in: hdc=0x25010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.455] SelectObject (hdc=0x25010751, h=0x1b00017) returned 0xd300762 [0069.455] DeleteObject (ho=0xd300762) returned 1 [0069.455] GetROP2 (hdc=0x25010751) returned 13 [0069.455] GetBkMode (hdc=0x25010751) returned 2 [0069.455] SetBkMode (hdc=0x25010751, mode=1) returned 2 [0069.455] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x7300778 [0069.455] SelectObject (hdc=0x25010751, h=0x7300778) returned 0x1b00017 [0069.455] MoveToEx (in: hdc=0x25010751, x=122, y=2, lppt=0x2596400 | out: lppt=0x2596400) returned 1 [0069.455] LineTo (hdc=0x25010751, x=2, y=2) returned 1 [0069.456] SetBkMode (hdc=0x25010751, mode=2) returned 1 [0069.515] MoveToEx (in: hdc=0x25010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.515] GetROP2 (hdc=0x25010751) returned 13 [0069.515] GetBkMode (hdc=0x25010751) returned 2 [0069.515] SetBkMode (hdc=0x25010751, mode=1) returned 2 [0069.515] SelectObject (hdc=0x25010751, h=0x7300778) returned 0x7300778 [0069.515] MoveToEx (in: hdc=0x25010751, x=2, y=2, lppt=0x2596418 | out: lppt=0x2596418) returned 1 [0069.515] LineTo (hdc=0x25010751, x=2, y=33) returned 1 [0069.515] SetBkMode (hdc=0x25010751, mode=2) returned 1 [0069.515] MoveToEx (in: hdc=0x25010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.516] SelectObject (hdc=0x25010751, h=0x1b00017) returned 0x7300778 [0069.516] DeleteObject (ho=0x7300778) returned 1 [0069.516] GetROP2 (hdc=0x25010751) returned 13 [0069.516] GetBkMode (hdc=0x25010751) returned 2 [0069.516] SetBkMode (hdc=0x25010751, mode=1) returned 2 [0069.516] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xe300762 [0069.516] SelectObject (hdc=0x25010751, h=0xe300762) returned 0x1b00017 [0069.516] MoveToEx (in: hdc=0x25010751, x=2, y=33, lppt=0x2596480 | out: lppt=0x2596480) returned 1 [0069.516] LineTo (hdc=0x25010751, x=122, y=33) returned 1 [0069.516] SetBkMode (hdc=0x25010751, mode=2) returned 1 [0069.516] MoveToEx (in: hdc=0x25010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.516] GetROP2 (hdc=0x25010751) returned 13 [0069.516] GetBkMode (hdc=0x25010751) returned 2 [0069.516] SetBkMode (hdc=0x25010751, mode=1) returned 2 [0069.516] SelectObject (hdc=0x25010751, h=0xe300762) returned 0xe300762 [0069.516] MoveToEx (in: hdc=0x25010751, x=122, y=33, lppt=0x2596498 | out: lppt=0x2596498) returned 1 [0069.516] LineTo (hdc=0x25010751, x=122, y=1) returned 1 [0069.517] SetBkMode (hdc=0x25010751, mode=2) returned 1 [0069.517] MoveToEx (in: hdc=0x25010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.517] SelectObject (hdc=0x25010751, h=0x1b00017) returned 0xe300762 [0069.517] DeleteObject (ho=0xe300762) returned 1 [0069.517] RestoreDC (hdc=0x25010751, nSavedDC=-1) returned 1 [0069.517] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.517] GdipReleaseDC (graphics=0x1c46d570, hdc=0x25010751) returned 0x0 [0069.517] GdipGetDC (graphics=0x1c46d570, hdc=0x43cc60) returned 0x0 [0069.517] BitBlt (hdc=0x501071f, x=0, y=0, cx=125, cy=36, hdcSrc=0x25010751, x1=0, y1=0, rop=0xcc0020) returned 1 [0069.519] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.519] GdipReleaseDC (graphics=0x1c46d570, hdc=0x25010751) returned 0x0 [0069.519] SelectPalette (hdc=0x501071f, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0069.519] SelectObject (hdc=0x25010751, h=0x185000f) returned 0x2805055a [0069.519] DeleteDC (hdc=0x25010751) returned 1 [0069.519] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.519] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0069.519] EndPaint (hWnd=0xa01fa, lpPaint=0x43cd68) returned 1 [0069.520] BeginPaint (in: hWnd=0x20200, lpPaint=0x43cd58 | out: lpPaint=0x43cd58) returned 0xa0100d0 [0069.520] SelectPalette (hdc=0xa0100d0, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0069.520] CreateCompatibleDC (hdc=0xa0100d0) returned 0x27010751 [0069.520] SelectObject (hdc=0x27010751, h=0x2805055a) returned 0x185000f [0069.520] GdipCreateFromHDC (hdc=0x27010751, graphics=0x43cb60) returned 0x0 [0069.520] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0069.520] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=84, height=25, combineMode=0x0) returned 0x0 [0069.520] GdipCreateMatrix (matrix=0x43cc90) returned 0x0 [0069.520] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c468ce0) returned 0x0 [0069.520] GdipIsMatrixIdentity (matrix=0x1c468ce0, result=0x43ccf0) returned 0x0 [0069.520] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0310 [0069.520] GdipGetMatrixElements (matrix=0x1c468ce0, matrixOut=0x1f2e0310) returned 0x0 [0069.521] LocalFree (hMem=0x1f2e0310) returned 0x0 [0069.521] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.521] GdipDeleteMatrix (matrix=0x1c468ce0) returned 0x0 [0069.521] GdipCreateRegion (region=0x43cc90) returned 0x0 [0069.521] GdipGetClip (graphics=0x1c46d570, region=0x1c46bbe0) returned 0x0 [0069.521] GdipIsInfiniteRegion (region=0x1c46bbe0, graphics=0x1c46d570, result=0x43ccc0) returned 0x0 [0069.521] GdipSaveGraphics (graphics=0x1c46d570, state=0x43cd90) returned 0x0 [0069.521] GetWindowTextLengthW (hWnd=0x20200) returned 7 [0069.521] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0069.521] GetSystemMetrics (nIndex=42) returned 0 [0069.521] CoTaskMemAlloc (cb=0x14) returned 0x633dc0 [0069.521] GetWindowTextW (in: hWnd=0x20200, lpString=0x633dc0, nMaxCount=8 | out: lpString="LHNIWSJ") returned 7 [0069.521] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xd, wParam=0x8, lParam=0x633dc0) returned 0x7 [0069.521] CoTaskMemFree (pv=0x633dc0) [0069.521] GetClientRect (in: hWnd=0x20200, lpRect=0x43cd00 | out: lpRect=0x43cd00) returned 1 [0069.522] GdipCreateRegion (region=0x43c780) returned 0x0 [0069.522] GdipGetClip (graphics=0x1c46d570, region=0x1c46a6c0) returned 0x0 [0069.522] GdipCreateMatrix (matrix=0x43c780) returned 0x0 [0069.522] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c46d270) returned 0x0 [0069.523] GdipIsMatrixIdentity (matrix=0x1c46d270, result=0x43c7e0) returned 0x0 [0069.523] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e00d0 [0069.523] GdipGetMatrixElements (matrix=0x1c46d270, matrixOut=0x1f2e00d0) returned 0x0 [0069.523] LocalFree (hMem=0x1f2e00d0) returned 0x0 [0069.525] GdipCombineRegionRegion (region=0x1c46a6c0, region2=0x1c46bbe0, combineMode=0x1) returned 0x0 [0069.525] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e08d0 [0069.525] GdipGetMatrixElements (matrix=0x1c46d270, matrixOut=0x1f2e08d0) returned 0x0 [0069.525] LocalFree (hMem=0x1f2e08d0) returned 0x0 [0069.525] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.525] GdipDeleteMatrix (matrix=0x1c46d270) returned 0x0 [0069.525] GdipIsInfiniteRegion (region=0x1c46a6c0, graphics=0x1c46d570, result=0x43c830) returned 0x0 [0069.525] GdipIsInfiniteRegion (region=0x1c46a6c0, graphics=0x1c46d570, result=0x43c7f0) returned 0x0 [0069.525] GdipGetRegionHRgn (region=0x1c46a6c0, graphics=0x1c46d570, hRgn=0x43c7f0) returned 0x0 [0069.525] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.525] GdipDeleteRegion (region=0x1c46a6c0) returned 0x0 [0069.525] GdipGetDC (graphics=0x1c46d570, hdc=0x43c860) returned 0x0 [0069.525] GetCurrentObject (hdc=0x27010751, type=0x1) returned 0x1b00017 [0069.525] GetCurrentObject (hdc=0x27010751, type=0x2) returned 0x1900010 [0069.525] GetCurrentObject (hdc=0x27010751, type=0x7) returned 0x2805055a [0069.526] GetCurrentObject (hdc=0x27010751, type=0x6) returned 0x18a0048 [0069.526] SaveDC (hdc=0x27010751) returned 1 [0069.526] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x450406cc [0069.526] GetClipRgn (hdc=0x27010751, hrgn=0x450406cc) returned 0 [0069.526] SelectClipRgn (hdc=0x27010751, hrgn=0x3f0405d8) returned 2 [0069.526] DeleteObject (ho=0x450406cc) returned 1 [0069.526] DeleteObject (ho=0x3f0405d8) returned 1 [0069.526] OffsetViewportOrgEx (in: hdc=0x27010751, x=0, y=0, lppt=0x2596a78 | out: lppt=0x2596a78) returned 1 [0069.526] GetNearestColor (hdc=0x27010751, color=0x0) returned 0x0 [0069.526] CreateSolidBrush (color=0x0) returned 0xe10075d [0069.526] FillRect (hDC=0x27010751, lprc=0x43c830, hbr=0xe10075d) returned 1 [0069.526] DeleteObject (ho=0xe10075d) returned 1 [0069.526] RestoreDC (hdc=0x27010751, nSavedDC=-1) returned 1 [0069.526] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.527] GdipReleaseDC (graphics=0x1c46d570, hdc=0x27010751) returned 0x0 [0069.527] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffda60dbd) returned 0x0 [0069.527] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.527] GdipDeleteRegion (region=0x1c46bbe0) returned 0x0 [0069.527] GetWindowTextLengthW (hWnd=0x20200) returned 7 [0069.527] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0069.527] GetSystemMetrics (nIndex=42) returned 0 [0069.527] CoTaskMemAlloc (cb=0x14) returned 0x633f40 [0069.527] GetWindowTextW (in: hWnd=0x20200, lpString=0x633f40, nMaxCount=8 | out: lpString="LHNIWSJ") returned 7 [0069.527] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xd, wParam=0x8, lParam=0x633f40) returned 0x7 [0069.527] CoTaskMemFree (pv=0x633f40) [0069.529] GdipGetDC (graphics=0x1c46d570, hdc=0x43c8c0) returned 0x0 [0069.529] GetCurrentObject (hdc=0x27010751, type=0x1) returned 0x1b00017 [0069.529] GetCurrentObject (hdc=0x27010751, type=0x2) returned 0x1900010 [0069.529] GetCurrentObject (hdc=0x27010751, type=0x7) returned 0x2805055a [0069.529] GetCurrentObject (hdc=0x27010751, type=0x6) returned 0x18a0048 [0069.529] SaveDC (hdc=0x27010751) returned 1 [0069.529] GetNearestColor (hdc=0x27010751, color=0x80) returned 0x80 [0069.529] RestoreDC (hdc=0x27010751, nSavedDC=-1) returned 1 [0069.529] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.529] GdipReleaseDC (graphics=0x1c46d570, hdc=0x27010751) returned 0x0 [0069.529] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43c850) returned 0x0 [0069.529] GdipSetStringFormatAlign (format=0x1c46a5e0, align=0x0) returned 0x0 [0069.529] GdipSetStringFormatLineAlign (format=0x1c46a5e0, align=0x0) returned 0x0 [0069.529] GdipSetStringFormatHotkeyPrefix (format=0x1c46a5e0, hotkeyPrefix=2) returned 0x0 [0069.529] GdipGetStringFormatFlags (format=0x1c46a5e0, flags=0x43c870) returned 0x0 [0069.529] GdipSetStringFormatFlags (format=0x1c46a5e0, flags=2048) returned 0x0 [0069.530] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x43c8c0) returned 0x0 [0069.530] GdipDrawString (graphics=0x1c46d570, string="LHNIWSJ", length=7, font=0x1c467850, layoutRect=0x43c7d0, stringFormat=0x1c46a5e0, brush=0x1c46a6c0) returned 0x0 [0069.531] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.531] GdipDeleteBrush (brush=0x1c46a6c0) returned 0x0 [0069.531] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.531] GdipDeleteStringFormat (format=0x1c46a5e0) returned 0x0 [0069.531] GdipGetDC (graphics=0x1c46d570, hdc=0x43cc60) returned 0x0 [0069.531] BitBlt (hdc=0xa0100d0, x=0, y=0, cx=84, cy=25, hdcSrc=0x27010751, x1=0, y1=0, rop=0xcc0020) returned 1 [0069.532] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.532] GdipReleaseDC (graphics=0x1c46d570, hdc=0x27010751) returned 0x0 [0069.532] SelectPalette (hdc=0xa0100d0, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0069.532] SelectObject (hdc=0x27010751, h=0x185000f) returned 0x2805055a [0069.532] DeleteDC (hdc=0x27010751) returned 1 [0069.532] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.532] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0069.532] EndPaint (hWnd=0x20200, lpPaint=0x43cd68) returned 1 [0069.533] BeginPaint (in: hWnd=0x400f0, lpPaint=0x43cd58 | out: lpPaint=0x43cd58) returned 0x10105c2 [0069.533] SelectPalette (hdc=0x10105c2, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0069.533] CreateCompatibleDC (hdc=0x10105c2) returned 0x29010751 [0069.533] SelectObject (hdc=0x29010751, h=0x2805055a) returned 0x185000f [0069.533] GdipCreateFromHDC (hdc=0x29010751, graphics=0x43cb60) returned 0x0 [0069.533] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0069.533] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=87, height=25, combineMode=0x0) returned 0x0 [0069.533] GdipCreateMatrix (matrix=0x43cc90) returned 0x0 [0069.533] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c468ce0) returned 0x0 [0069.533] GdipIsMatrixIdentity (matrix=0x1c468ce0, result=0x43ccf0) returned 0x0 [0069.533] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0e90 [0069.534] GdipGetMatrixElements (matrix=0x1c468ce0, matrixOut=0x1f2e0e90) returned 0x0 [0069.534] LocalFree (hMem=0x1f2e0e90) returned 0x0 [0069.534] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.534] GdipDeleteMatrix (matrix=0x1c468ce0) returned 0x0 [0069.537] GdipCreateRegion (region=0x43cc90) returned 0x0 [0069.537] GdipGetClip (graphics=0x1c46d570, region=0x1c46cb70) returned 0x0 [0069.537] GdipIsInfiniteRegion (region=0x1c46cb70, graphics=0x1c46d570, result=0x43ccc0) returned 0x0 [0069.537] GdipSaveGraphics (graphics=0x1c46d570, state=0x43cd90) returned 0x0 [0069.537] GetWindowTextLengthW (hWnd=0x400f0) returned 9 [0069.537] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9 [0069.537] GetSystemMetrics (nIndex=42) returned 0 [0069.537] CoTaskMemAlloc (cb=0x18) returned 0x633ea0 [0069.537] GetWindowTextW (in: hWnd=0x400f0, lpString=0x633ea0, nMaxCount=10 | out: lpString="Enter PIN") returned 9 [0069.537] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0xd, wParam=0xa, lParam=0x633ea0) returned 0x9 [0069.537] CoTaskMemFree (pv=0x633ea0) [0069.537] GetClientRect (in: hWnd=0x400f0, lpRect=0x43cd00 | out: lpRect=0x43cd00) returned 1 [0069.537] GdipCreateRegion (region=0x43c780) returned 0x0 [0069.537] GdipGetClip (graphics=0x1c46d570, region=0x1c46c970) returned 0x0 [0069.537] GdipCreateMatrix (matrix=0x43c780) returned 0x0 [0069.538] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c46d270) returned 0x0 [0069.538] GdipIsMatrixIdentity (matrix=0x1c46d270, result=0x43c7e0) returned 0x0 [0069.538] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0310 [0069.538] GdipGetMatrixElements (matrix=0x1c46d270, matrixOut=0x1f2e0310) returned 0x0 [0069.538] LocalFree (hMem=0x1f2e0310) returned 0x0 [0069.538] GdipCombineRegionRegion (region=0x1c46c970, region2=0x1c46cb70, combineMode=0x1) returned 0x0 [0069.538] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0790 [0069.538] GdipGetMatrixElements (matrix=0x1c46d270, matrixOut=0x1f2e0790) returned 0x0 [0069.538] LocalFree (hMem=0x1f2e0790) returned 0x0 [0069.538] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.538] GdipDeleteMatrix (matrix=0x1c46d270) returned 0x0 [0069.538] GdipIsInfiniteRegion (region=0x1c46c970, graphics=0x1c46d570, result=0x43c830) returned 0x0 [0069.538] GdipIsInfiniteRegion (region=0x1c46c970, graphics=0x1c46d570, result=0x43c7f0) returned 0x0 [0069.538] GdipGetRegionHRgn (region=0x1c46c970, graphics=0x1c46d570, hRgn=0x43c7f0) returned 0x0 [0069.538] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.538] GdipDeleteRegion (region=0x1c46c970) returned 0x0 [0069.538] GdipGetDC (graphics=0x1c46d570, hdc=0x43c860) returned 0x0 [0069.538] GetCurrentObject (hdc=0x29010751, type=0x1) returned 0x1b00017 [0069.538] GetCurrentObject (hdc=0x29010751, type=0x2) returned 0x1900010 [0069.538] GetCurrentObject (hdc=0x29010751, type=0x7) returned 0x2805055a [0069.538] GetCurrentObject (hdc=0x29010751, type=0x6) returned 0x18a0048 [0069.539] SaveDC (hdc=0x29010751) returned 1 [0069.539] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x400405d8 [0069.539] GetClipRgn (hdc=0x29010751, hrgn=0x400405d8) returned 0 [0069.539] SelectClipRgn (hdc=0x29010751, hrgn=0x460406cc) returned 2 [0069.539] DeleteObject (ho=0x400405d8) returned 1 [0069.539] DeleteObject (ho=0x460406cc) returned 1 [0069.539] OffsetViewportOrgEx (in: hdc=0x29010751, x=0, y=0, lppt=0x2597580 | out: lppt=0x2597580) returned 1 [0069.539] GetNearestColor (hdc=0x29010751, color=0x0) returned 0x0 [0069.539] CreateSolidBrush (color=0x0) returned 0xf10075d [0069.539] FillRect (hDC=0x29010751, lprc=0x43c830, hbr=0xf10075d) returned 1 [0069.539] DeleteObject (ho=0xf10075d) returned 1 [0069.539] RestoreDC (hdc=0x29010751, nSavedDC=-1) returned 1 [0069.539] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.539] GdipReleaseDC (graphics=0x1c46d570, hdc=0x29010751) returned 0x0 [0069.539] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffda40dbd) returned 0x0 [0069.539] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.539] GdipDeleteRegion (region=0x1c46cb70) returned 0x0 [0069.539] GetWindowTextLengthW (hWnd=0x400f0) returned 9 [0069.539] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9 [0069.540] GetSystemMetrics (nIndex=42) returned 0 [0069.540] CoTaskMemAlloc (cb=0x18) returned 0x633e40 [0069.540] GetWindowTextW (in: hWnd=0x400f0, lpString=0x633e40, nMaxCount=10 | out: lpString="Enter PIN") returned 9 [0069.540] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0xd, wParam=0xa, lParam=0x633e40) returned 0x9 [0069.540] CoTaskMemFree (pv=0x633e40) [0069.540] GdipGetDC (graphics=0x1c46d570, hdc=0x43c8c0) returned 0x0 [0069.540] GetCurrentObject (hdc=0x29010751, type=0x1) returned 0x1b00017 [0069.540] GetCurrentObject (hdc=0x29010751, type=0x2) returned 0x1900010 [0069.540] GetCurrentObject (hdc=0x29010751, type=0x7) returned 0x2805055a [0069.540] GetCurrentObject (hdc=0x29010751, type=0x6) returned 0x18a0048 [0069.540] SaveDC (hdc=0x29010751) returned 1 [0069.540] GetNearestColor (hdc=0x29010751, color=0x80) returned 0x80 [0069.540] RestoreDC (hdc=0x29010751, nSavedDC=-1) returned 1 [0069.540] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.540] GdipReleaseDC (graphics=0x1c46d570, hdc=0x29010751) returned 0x0 [0069.540] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43c850) returned 0x0 [0069.540] GdipSetStringFormatAlign (format=0x1c46a5e0, align=0x0) returned 0x0 [0069.540] GdipSetStringFormatLineAlign (format=0x1c46a5e0, align=0x0) returned 0x0 [0069.540] GdipSetStringFormatHotkeyPrefix (format=0x1c46a5e0, hotkeyPrefix=2) returned 0x0 [0069.541] GdipGetStringFormatFlags (format=0x1c46a5e0, flags=0x43c870) returned 0x0 [0069.541] GdipSetStringFormatFlags (format=0x1c46a5e0, flags=2048) returned 0x0 [0069.541] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x43c8c0) returned 0x0 [0069.541] GdipDrawString (graphics=0x1c46d570, string="Enter PIN", length=9, font=0x1c467810, layoutRect=0x43c7d0, stringFormat=0x1c46a5e0, brush=0x1c46cce0) returned 0x0 [0069.542] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.542] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0069.542] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.542] GdipDeleteStringFormat (format=0x1c46a5e0) returned 0x0 [0069.542] GdipGetDC (graphics=0x1c46d570, hdc=0x43cc60) returned 0x0 [0069.542] BitBlt (hdc=0x10105c2, x=0, y=0, cx=87, cy=25, hdcSrc=0x29010751, x1=0, y1=0, rop=0xcc0020) returned 1 [0069.542] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.542] GdipReleaseDC (graphics=0x1c46d570, hdc=0x29010751) returned 0x0 [0069.543] SelectPalette (hdc=0x10105c2, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0069.543] SelectObject (hdc=0x29010751, h=0x185000f) returned 0x2805055a [0069.543] DeleteDC (hdc=0x29010751) returned 1 [0069.543] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.543] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0069.543] EndPaint (hWnd=0x400f0, lpPaint=0x43cd68) returned 1 [0069.543] BeginPaint (in: hWnd=0x20208, lpPaint=0x43cd58 | out: lpPaint=0x43cd58) returned 0x501071f [0069.543] SelectPalette (hdc=0x501071f, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0069.543] CreateCompatibleDC (hdc=0x501071f) returned 0x2b010751 [0069.543] DeleteObject (ho=0x2805055a) returned 1 [0069.544] GetObjectType (h=0x501071f) returned 0x3 [0069.544] CreateCompatibleBitmap (hdc=0x501071f, cx=1, cy=1) returned 0x6205053b [0069.544] GetDIBits (in: hdc=0x501071f, hbm=0x6205053b, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x43c478, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43c478) returned 1 [0069.544] GetDIBits (in: hdc=0x501071f, hbm=0x6205053b, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x43c478, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43c478) returned 1 [0069.544] DeleteObject (ho=0x6205053b) returned 1 [0069.544] CreateDIBSection (in: hdc=0x501071f, lpbmi=0x43c650, usage=0x0, ppvBits=0x43c648, hSection=0x0, offset=0x0 | out: ppvBits=0x43c648) returned 0x2905055a [0069.544] SelectObject (hdc=0x2b010751, h=0x2905055a) returned 0x185000f [0069.544] GdipCreateFromHDC (hdc=0x2b010751, graphics=0x43cb60) returned 0x0 [0069.545] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0069.545] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=38, combineMode=0x0) returned 0x0 [0069.545] GdipCreateMatrix (matrix=0x43cc90) returned 0x0 [0069.545] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c46ca50) returned 0x0 [0069.545] GdipIsMatrixIdentity (matrix=0x1c46ca50, result=0x43ccf0) returned 0x0 [0069.545] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0210 [0069.545] GdipGetMatrixElements (matrix=0x1c46ca50, matrixOut=0x1f2e0210) returned 0x0 [0069.545] LocalFree (hMem=0x1f2e0210) returned 0x0 [0069.545] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.545] GdipDeleteMatrix (matrix=0x1c46ca50) returned 0x0 [0069.545] GdipCreateRegion (region=0x43cc90) returned 0x0 [0069.545] GdipGetClip (graphics=0x1c46d570, region=0x1c46cb70) returned 0x0 [0069.545] GdipIsInfiniteRegion (region=0x1c46cb70, graphics=0x1c46d570, result=0x43ccc0) returned 0x0 [0069.545] GdipSaveGraphics (graphics=0x1c46d570, state=0x43cd90) returned 0x0 [0069.545] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffda20dbd) returned 0x0 [0069.545] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.545] GdipDeleteRegion (region=0x1c46cb70) returned 0x0 [0069.545] GdipGetDC (graphics=0x1c46d570, hdc=0x43c180) returned 0x0 [0069.546] GetCurrentObject (hdc=0x2b010751, type=0x1) returned 0x1b00017 [0069.546] GetCurrentObject (hdc=0x2b010751, type=0x2) returned 0x1900010 [0069.546] GetCurrentObject (hdc=0x2b010751, type=0x7) returned 0x2905055a [0069.546] GetCurrentObject (hdc=0x2b010751, type=0x6) returned 0x18a0048 [0069.546] SaveDC (hdc=0x2b010751) returned 1 [0069.546] GetNearestColor (hdc=0x2b010751, color=0xf0f0f0) returned 0xf0f0f0 [0069.546] GetNearestColor (hdc=0x2b010751, color=0xa0a0a0) returned 0xa0a0a0 [0069.546] GetNearestColor (hdc=0x2b010751, color=0x696969) returned 0x696969 [0069.546] GetNearestColor (hdc=0x2b010751, color=0xa0a0a0) returned 0xa0a0a0 [0069.546] GetNearestColor (hdc=0x2b010751, color=0x0) returned 0x0 [0069.546] GetNearestColor (hdc=0x2b010751, color=0xffffff) returned 0xffffff [0069.546] GetNearestColor (hdc=0x2b010751, color=0xe5e5e5) returned 0xe5e5e5 [0069.546] GetNearestColor (hdc=0x2b010751, color=0xd8d8d8) returned 0xd8d8d8 [0069.546] GetNearestColor (hdc=0x2b010751, color=0x0) returned 0x0 [0069.546] RestoreDC (hdc=0x2b010751, nSavedDC=-1) returned 1 [0069.546] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.547] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b010751) returned 0x0 [0069.547] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0069.547] CoTaskMemAlloc (cb=0x13) returned 0x633e40 [0069.547] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0069.547] CoTaskMemFree (pv=0x633e40) [0069.547] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43c870) returned 0x0 [0069.548] GdipSetStringFormatAlign (format=0x1c46a5e0, align=0x1) returned 0x0 [0069.548] GdipSetStringFormatLineAlign (format=0x1c46a5e0, align=0x1) returned 0x0 [0069.548] GdipSetStringFormatHotkeyPrefix (format=0x1c46a5e0, hotkeyPrefix=2) returned 0x0 [0069.548] GdipGetStringFormatFlags (format=0x1c46a5e0, flags=0x43c8a0) returned 0x0 [0069.548] GdipGetStringFormatTrimming (format=0x1c46a5e0, trimming=0x43c8a0) returned 0x0 [0069.548] GdipGetStringFormatHotkeyPrefix (format=0x1c46a5e0, hotkeyPrefix=0x43c8a0) returned 0x0 [0069.548] GdipGetFontSize (font=0x1c46a5e0, size=0x43c8a0) returned 0x0 [0069.548] GdipGetFontStyle (font=0x1c46a5e0, style=0x43c8a0) returned 0x0 [0069.548] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.548] GdipDeleteStringFormat (format=0x1c46a5e0) returned 0x0 [0069.548] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0069.548] CoTaskMemAlloc (cb=0x13) returned 0x633d00 [0069.549] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0069.549] CoTaskMemFree (pv=0x633d00) [0069.549] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43c530) returned 0x0 [0069.549] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43c540) returned 0x0 [0069.549] GdipSetStringFormatFlags (format=0x1c46a5e0, flags=0) returned 0x0 [0069.549] GdipSetStringFormatTrimming (format=0x1c46a5e0, trimming=0x1) returned 0x0 [0069.549] GdipSetStringFormatHotkeyPrefix (format=0x1c46a5e0, hotkeyPrefix=2) returned 0x0 [0069.549] GdipSetStringFormatAlign (format=0x1c46a5e0, align=0x1) returned 0x0 [0069.549] GdipSetStringFormatLineAlign (format=0x1c46a5e0, align=0x1) returned 0x0 [0069.549] GdipMeasureString (graphics=0x1c470d30, string="Decryption", length=10, font=0x1c4677d0, layoutRect=0x43c458, stringFormat=0x1c46a5e0, boundingBox=0x43c448, codepointsFitted=0x43c444, linesFilled=0x43c440) returned 0x0 [0069.549] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.550] GdipDeleteStringFormat (format=0x1c46a5e0) returned 0x0 [0069.550] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.550] GdipDeleteGraphics (graphics=0x1c470d30) returned 0x0 [0069.550] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0069.550] CoTaskMemAlloc (cb=0x13) returned 0x633c00 [0069.551] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0069.551] CoTaskMemFree (pv=0x633c00) [0069.551] GdipCreateRegion (region=0x43c4a0) returned 0x0 [0069.551] GdipGetClip (graphics=0x1c46d570, region=0x1c46cb70) returned 0x0 [0069.551] GdipCreateMatrix (matrix=0x43c4a0) returned 0x0 [0069.551] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c46d270) returned 0x0 [0069.551] GdipIsMatrixIdentity (matrix=0x1c46d270, result=0x43c500) returned 0x0 [0069.551] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0410 [0069.551] GdipGetMatrixElements (matrix=0x1c46d270, matrixOut=0x1f2e0410) returned 0x0 [0069.551] LocalFree (hMem=0x1f2e0410) returned 0x0 [0069.551] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e06d0 [0069.551] GdipGetMatrixElements (matrix=0x1c46d270, matrixOut=0x1f2e06d0) returned 0x0 [0069.551] LocalFree (hMem=0x1f2e06d0) returned 0x0 [0069.551] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.551] GdipDeleteMatrix (matrix=0x1c46d270) returned 0x0 [0069.551] GdipIsInfiniteRegion (region=0x1c46cb70, graphics=0x1c46d570, result=0x43c550) returned 0x0 [0069.551] GdipIsInfiniteRegion (region=0x1c46cb70, graphics=0x1c46d570, result=0x43c510) returned 0x0 [0069.551] GdipGetRegionHRgn (region=0x1c46cb70, graphics=0x1c46d570, hRgn=0x43c510) returned 0x0 [0069.551] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.551] GdipDeleteRegion (region=0x1c46cb70) returned 0x0 [0069.551] GdipGetDC (graphics=0x1c46d570, hdc=0x43c580) returned 0x0 [0069.552] GetCurrentObject (hdc=0x2b010751, type=0x1) returned 0x1b00017 [0069.552] GetCurrentObject (hdc=0x2b010751, type=0x2) returned 0x1900010 [0069.552] GetCurrentObject (hdc=0x2b010751, type=0x7) returned 0x2905055a [0069.552] GetCurrentObject (hdc=0x2b010751, type=0x6) returned 0x18a0048 [0069.552] SaveDC (hdc=0x2b010751) returned 1 [0069.552] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x470406cc [0069.552] GetClipRgn (hdc=0x2b010751, hrgn=0x470406cc) returned 0 [0069.552] SelectClipRgn (hdc=0x2b010751, hrgn=0x410405d8) returned 2 [0069.552] DeleteObject (ho=0x470406cc) returned 1 [0069.552] DeleteObject (ho=0x410405d8) returned 1 [0069.552] OffsetViewportOrgEx (in: hdc=0x2b010751, x=0, y=0, lppt=0x2599610 | out: lppt=0x2599610) returned 1 [0069.552] GetNearestColor (hdc=0x2b010751, color=0xf0f0f0) returned 0xf0f0f0 [0069.552] CreateSolidBrush (color=0xf0f0f0) returned 0x1010075d [0069.552] FillRect (hDC=0x2b010751, lprc=0x43c550, hbr=0x1010075d) returned 1 [0069.553] DeleteObject (ho=0x1010075d) returned 1 [0069.553] RestoreDC (hdc=0x2b010751, nSavedDC=-1) returned 1 [0069.553] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.553] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b010751) returned 0x0 [0069.553] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0069.553] CoTaskMemAlloc (cb=0x13) returned 0x633d00 [0069.554] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0069.554] CoTaskMemFree (pv=0x633d00) [0069.554] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43c5d0) returned 0x0 [0069.554] GdipSetStringFormatAlign (format=0x1c46a5e0, align=0x1) returned 0x0 [0069.554] GdipSetStringFormatLineAlign (format=0x1c46a5e0, align=0x1) returned 0x0 [0069.554] GdipSetStringFormatHotkeyPrefix (format=0x1c46a5e0, hotkeyPrefix=2) returned 0x0 [0069.554] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x43c640) returned 0x0 [0069.554] GdipDrawString (graphics=0x1c46d570, string="Decryption", length=10, font=0x1c4677d0, layoutRect=0x43c550, stringFormat=0x1c46a5e0, brush=0x1c46cce0) returned 0x0 [0069.560] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.560] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0069.560] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.560] GdipDeleteStringFormat (format=0x1c46a5e0) returned 0x0 [0069.560] GetFocus () returned 0x0 [0069.561] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0069.561] CoTaskMemAlloc (cb=0x13) returned 0x633aa0 [0069.561] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0069.561] CoTaskMemFree (pv=0x633aa0) [0069.561] GdipCreateRegion (region=0x43c400) returned 0x0 [0069.561] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0069.561] GdipCreateMatrix (matrix=0x43c400) returned 0x0 [0069.561] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4713b0) returned 0x0 [0069.561] GdipIsMatrixIdentity (matrix=0x1c4713b0, result=0x43c460) returned 0x0 [0069.561] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0610 [0069.561] GdipGetMatrixElements (matrix=0x1c4713b0, matrixOut=0x1f2e0610) returned 0x0 [0069.561] LocalFree (hMem=0x1f2e0610) returned 0x0 [0069.561] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e02d0 [0069.562] GdipGetMatrixElements (matrix=0x1c4713b0, matrixOut=0x1f2e02d0) returned 0x0 [0069.562] LocalFree (hMem=0x1f2e02d0) returned 0x0 [0069.562] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.562] GdipDeleteMatrix (matrix=0x1c4713b0) returned 0x0 [0069.562] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43c4b0) returned 0x0 [0069.562] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43c470) returned 0x0 [0069.562] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43c470) returned 0x0 [0069.562] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.562] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0069.562] GdipGetDC (graphics=0x1c46d570, hdc=0x43c4e0) returned 0x0 [0069.562] GetCurrentObject (hdc=0x2b010751, type=0x1) returned 0x1b00017 [0069.562] GetCurrentObject (hdc=0x2b010751, type=0x2) returned 0x1900010 [0069.562] GetCurrentObject (hdc=0x2b010751, type=0x7) returned 0x2905055a [0069.562] GetCurrentObject (hdc=0x2b010751, type=0x6) returned 0x18a0048 [0069.562] SaveDC (hdc=0x2b010751) returned 1 [0069.562] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x420405d8 [0069.562] GetClipRgn (hdc=0x2b010751, hrgn=0x420405d8) returned 0 [0069.562] SelectClipRgn (hdc=0x2b010751, hrgn=0x480406cc) returned 2 [0069.562] DeleteObject (ho=0x420405d8) returned 1 [0069.563] DeleteObject (ho=0x480406cc) returned 1 [0069.563] OffsetViewportOrgEx (in: hdc=0x2b010751, x=0, y=0, lppt=0x2599b70 | out: lppt=0x2599b70) returned 1 [0069.563] GetROP2 (hdc=0x2b010751) returned 13 [0069.563] GetBkMode (hdc=0x2b010751) returned 2 [0069.563] SetBkMode (hdc=0x2b010751, mode=1) returned 2 [0069.563] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0xf300762 [0069.563] SelectObject (hdc=0x2b010751, h=0xf300762) returned 0x1b00017 [0069.563] MoveToEx (in: hdc=0x2b010751, x=124, y=0, lppt=0x2599bd8 | out: lppt=0x2599bd8) returned 1 [0069.563] LineTo (hdc=0x2b010751, x=0, y=0) returned 1 [0069.563] SetBkMode (hdc=0x2b010751, mode=2) returned 1 [0069.563] MoveToEx (in: hdc=0x2b010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.563] GetROP2 (hdc=0x2b010751) returned 13 [0069.563] GetBkMode (hdc=0x2b010751) returned 2 [0069.563] SetBkMode (hdc=0x2b010751, mode=1) returned 2 [0069.563] SelectObject (hdc=0x2b010751, h=0xf300762) returned 0xf300762 [0069.563] MoveToEx (in: hdc=0x2b010751, x=0, y=0, lppt=0x2599bf0 | out: lppt=0x2599bf0) returned 1 [0069.563] LineTo (hdc=0x2b010751, x=0, y=37) returned 1 [0069.563] SetBkMode (hdc=0x2b010751, mode=2) returned 1 [0069.563] MoveToEx (in: hdc=0x2b010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.563] SelectObject (hdc=0x2b010751, h=0x1b00017) returned 0xf300762 [0069.563] DeleteObject (ho=0xf300762) returned 1 [0069.563] GetROP2 (hdc=0x2b010751) returned 13 [0069.563] GetBkMode (hdc=0x2b010751) returned 2 [0069.564] SetBkMode (hdc=0x2b010751, mode=1) returned 2 [0069.564] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x8300778 [0069.564] SelectObject (hdc=0x2b010751, h=0x8300778) returned 0x1b00017 [0069.564] MoveToEx (in: hdc=0x2b010751, x=0, y=37, lppt=0x2599c58 | out: lppt=0x2599c58) returned 1 [0069.564] LineTo (hdc=0x2b010751, x=124, y=37) returned 1 [0069.564] SetBkMode (hdc=0x2b010751, mode=2) returned 1 [0069.564] MoveToEx (in: hdc=0x2b010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.564] GetROP2 (hdc=0x2b010751) returned 13 [0069.564] GetBkMode (hdc=0x2b010751) returned 2 [0069.564] SetBkMode (hdc=0x2b010751, mode=1) returned 2 [0069.564] SelectObject (hdc=0x2b010751, h=0x8300778) returned 0x8300778 [0069.564] MoveToEx (in: hdc=0x2b010751, x=124, y=37, lppt=0x2599c70 | out: lppt=0x2599c70) returned 1 [0069.564] LineTo (hdc=0x2b010751, x=124, y=-1) returned 1 [0069.564] SetBkMode (hdc=0x2b010751, mode=2) returned 1 [0069.564] MoveToEx (in: hdc=0x2b010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.564] SelectObject (hdc=0x2b010751, h=0x1b00017) returned 0x8300778 [0069.564] DeleteObject (ho=0x8300778) returned 1 [0069.564] GetROP2 (hdc=0x2b010751) returned 13 [0069.564] GetBkMode (hdc=0x2b010751) returned 2 [0069.564] SetBkMode (hdc=0x2b010751, mode=1) returned 2 [0069.564] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x10300762 [0069.565] SelectObject (hdc=0x2b010751, h=0x10300762) returned 0x1b00017 [0069.565] MoveToEx (in: hdc=0x2b010751, x=123, y=1, lppt=0x2599cd8 | out: lppt=0x2599cd8) returned 1 [0069.565] LineTo (hdc=0x2b010751, x=1, y=1) returned 1 [0069.565] SetBkMode (hdc=0x2b010751, mode=2) returned 1 [0069.565] MoveToEx (in: hdc=0x2b010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.565] GetROP2 (hdc=0x2b010751) returned 13 [0069.565] GetBkMode (hdc=0x2b010751) returned 2 [0069.565] SetBkMode (hdc=0x2b010751, mode=1) returned 2 [0069.568] SelectObject (hdc=0x2b010751, h=0x10300762) returned 0x10300762 [0069.568] MoveToEx (in: hdc=0x2b010751, x=1, y=1, lppt=0x2599cf0 | out: lppt=0x2599cf0) returned 1 [0069.568] LineTo (hdc=0x2b010751, x=1, y=36) returned 1 [0069.568] SetBkMode (hdc=0x2b010751, mode=2) returned 1 [0069.568] MoveToEx (in: hdc=0x2b010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.568] SelectObject (hdc=0x2b010751, h=0x1b00017) returned 0x10300762 [0069.568] DeleteObject (ho=0x10300762) returned 1 [0069.568] GetROP2 (hdc=0x2b010751) returned 13 [0069.568] GetBkMode (hdc=0x2b010751) returned 2 [0069.568] SetBkMode (hdc=0x2b010751, mode=1) returned 2 [0069.568] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x9300778 [0069.568] SelectObject (hdc=0x2b010751, h=0x9300778) returned 0x1b00017 [0069.568] MoveToEx (in: hdc=0x2b010751, x=1, y=36, lppt=0x2599d58 | out: lppt=0x2599d58) returned 1 [0069.569] LineTo (hdc=0x2b010751, x=123, y=36) returned 1 [0069.569] SetBkMode (hdc=0x2b010751, mode=2) returned 1 [0069.569] MoveToEx (in: hdc=0x2b010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.569] GetROP2 (hdc=0x2b010751) returned 13 [0069.569] GetBkMode (hdc=0x2b010751) returned 2 [0069.569] SetBkMode (hdc=0x2b010751, mode=1) returned 2 [0069.569] SelectObject (hdc=0x2b010751, h=0x9300778) returned 0x9300778 [0069.569] MoveToEx (in: hdc=0x2b010751, x=123, y=36, lppt=0x2599d70 | out: lppt=0x2599d70) returned 1 [0069.569] LineTo (hdc=0x2b010751, x=123, y=0) returned 1 [0069.569] SetBkMode (hdc=0x2b010751, mode=2) returned 1 [0069.569] MoveToEx (in: hdc=0x2b010751, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0069.569] SelectObject (hdc=0x2b010751, h=0x1b00017) returned 0x9300778 [0069.569] DeleteObject (ho=0x9300778) returned 1 [0069.569] RestoreDC (hdc=0x2b010751, nSavedDC=-1) returned 1 [0069.569] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.569] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b010751) returned 0x0 [0069.569] GdipGetDC (graphics=0x1c46d570, hdc=0x43cc60) returned 0x0 [0069.569] BitBlt (hdc=0x501071f, x=0, y=0, cx=125, cy=38, hdcSrc=0x2b010751, x1=0, y1=0, rop=0xcc0020) returned 1 [0069.571] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.571] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b010751) returned 0x0 [0069.571] SelectPalette (hdc=0x501071f, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0069.571] SelectObject (hdc=0x2b010751, h=0x185000f) returned 0x2905055a [0069.571] DeleteDC (hdc=0x2b010751) returned 1 [0069.571] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.571] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0069.572] EndPaint (hWnd=0x20208, lpPaint=0x43cd68) returned 1 [0069.572] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x1 [0069.572] SetTextColor (hdc=0xa0100d0, color=0x0) returned 0x0 [0069.572] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff [0069.573] SetTextColor (hdc=0xa0100d0, color=0x0) returned 0x0 [0069.573] SetBkColor (hdc=0xa0100d0, color=0xffffff) returned 0xffffff [0069.574] BeginPaint (in: hWnd=0x20230, lpPaint=0x43cd58 | out: lpPaint=0x43cd58) returned 0x10105c2 [0069.574] SelectPalette (hdc=0x10105c2, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0069.574] CreateCompatibleDC (hdc=0x10105c2) returned 0x2e010751 [0069.574] SelectObject (hdc=0x2e010751, h=0x2905055a) returned 0x185000f [0069.574] GdipCreateFromHDC (hdc=0x2e010751, graphics=0x43cb60) returned 0x0 [0069.574] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0069.574] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=60, height=25, combineMode=0x0) returned 0x0 [0069.574] GdipCreateMatrix (matrix=0x43cc90) returned 0x0 [0069.574] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4713f0) returned 0x0 [0069.574] GdipIsMatrixIdentity (matrix=0x1c4713f0, result=0x43ccf0) returned 0x0 [0069.574] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0a90 [0069.574] GdipGetMatrixElements (matrix=0x1c4713f0, matrixOut=0x1f2e0a90) returned 0x0 [0069.574] LocalFree (hMem=0x1f2e0a90) returned 0x0 [0069.574] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.574] GdipDeleteMatrix (matrix=0x1c4713f0) returned 0x0 [0069.574] GdipCreateRegion (region=0x43cc90) returned 0x0 [0069.575] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0069.575] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43ccc0) returned 0x0 [0069.575] GdipSaveGraphics (graphics=0x1c46d570, state=0x43cd90) returned 0x0 [0069.575] GetWindowTextLengthW (hWnd=0x20230) returned 6 [0069.575] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0069.575] GetSystemMetrics (nIndex=42) returned 0 [0069.575] CoTaskMemAlloc (cb=0x12) returned 0x633e40 [0069.575] GetWindowTextW (in: hWnd=0x20230, lpString=0x633e40, nMaxCount=7 | out: lpString="PIN = ") returned 6 [0069.575] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0xd, wParam=0x7, lParam=0x633e40) returned 0x6 [0069.575] CoTaskMemFree (pv=0x633e40) [0069.575] GetClientRect (in: hWnd=0x20230, lpRect=0x43cd00 | out: lpRect=0x43cd00) returned 1 [0069.575] GdipCreateRegion (region=0x43c780) returned 0x0 [0069.575] GdipGetClip (graphics=0x1c46d570, region=0x1c470e90) returned 0x0 [0069.575] GdipCreateMatrix (matrix=0x43c780) returned 0x0 [0069.575] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471070) returned 0x0 [0069.575] GdipIsMatrixIdentity (matrix=0x1c471070, result=0x43c7e0) returned 0x0 [0069.575] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e05d0 [0069.575] GdipGetMatrixElements (matrix=0x1c471070, matrixOut=0x1f2e05d0) returned 0x0 [0069.575] LocalFree (hMem=0x1f2e05d0) returned 0x0 [0069.576] GdipCombineRegionRegion (region=0x1c470e90, region2=0x1c46a710, combineMode=0x1) returned 0x0 [0069.576] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e00d0 [0069.576] GdipGetMatrixElements (matrix=0x1c471070, matrixOut=0x1f2e00d0) returned 0x0 [0069.576] LocalFree (hMem=0x1f2e00d0) returned 0x0 [0069.576] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.576] GdipDeleteMatrix (matrix=0x1c471070) returned 0x0 [0069.576] GdipIsInfiniteRegion (region=0x1c470e90, graphics=0x1c46d570, result=0x43c830) returned 0x0 [0069.576] GdipIsInfiniteRegion (region=0x1c470e90, graphics=0x1c46d570, result=0x43c7f0) returned 0x0 [0069.576] GdipGetRegionHRgn (region=0x1c470e90, graphics=0x1c46d570, hRgn=0x43c7f0) returned 0x0 [0069.576] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.576] GdipDeleteRegion (region=0x1c470e90) returned 0x0 [0069.576] GdipGetDC (graphics=0x1c46d570, hdc=0x43c860) returned 0x0 [0069.576] GetCurrentObject (hdc=0x2e010751, type=0x1) returned 0x1b00017 [0069.576] GetCurrentObject (hdc=0x2e010751, type=0x2) returned 0x1900010 [0069.576] GetCurrentObject (hdc=0x2e010751, type=0x7) returned 0x2905055a [0069.576] GetCurrentObject (hdc=0x2e010751, type=0x6) returned 0x18a0048 [0069.576] SaveDC (hdc=0x2e010751) returned 1 [0069.576] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x490406cc [0069.576] GetClipRgn (hdc=0x2e010751, hrgn=0x490406cc) returned 0 [0069.576] SelectClipRgn (hdc=0x2e010751, hrgn=0x430405d8) returned 2 [0069.577] DeleteObject (ho=0x490406cc) returned 1 [0069.577] DeleteObject (ho=0x430405d8) returned 1 [0069.577] OffsetViewportOrgEx (in: hdc=0x2e010751, x=0, y=0, lppt=0x259a4b8 | out: lppt=0x259a4b8) returned 1 [0069.577] GetNearestColor (hdc=0x2e010751, color=0x0) returned 0x0 [0069.577] CreateSolidBrush (color=0x0) returned 0x1110075d [0069.577] FillRect (hDC=0x2e010751, lprc=0x43c830, hbr=0x1110075d) returned 1 [0069.577] DeleteObject (ho=0x1110075d) returned 1 [0069.577] RestoreDC (hdc=0x2e010751, nSavedDC=-1) returned 1 [0069.577] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.577] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2e010751) returned 0x0 [0069.577] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd9f0dbd) returned 0x0 [0069.577] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.577] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0069.577] GetWindowTextLengthW (hWnd=0x20230) returned 6 [0069.577] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0069.577] GetSystemMetrics (nIndex=42) returned 0 [0069.577] CoTaskMemAlloc (cb=0x12) returned 0x633aa0 [0069.577] GetWindowTextW (in: hWnd=0x20230, lpString=0x633aa0, nMaxCount=7 | out: lpString="PIN = ") returned 6 [0069.577] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0xd, wParam=0x7, lParam=0x633aa0) returned 0x6 [0069.578] CoTaskMemFree (pv=0x633aa0) [0069.578] GdipGetDC (graphics=0x1c46d570, hdc=0x43c8c0) returned 0x0 [0069.578] GetCurrentObject (hdc=0x2e010751, type=0x1) returned 0x1b00017 [0069.578] GetCurrentObject (hdc=0x2e010751, type=0x2) returned 0x1900010 [0069.578] GetCurrentObject (hdc=0x2e010751, type=0x7) returned 0x2905055a [0069.578] GetCurrentObject (hdc=0x2e010751, type=0x6) returned 0x18a0048 [0069.578] SaveDC (hdc=0x2e010751) returned 1 [0069.578] GetNearestColor (hdc=0x2e010751, color=0x80) returned 0x80 [0069.578] RestoreDC (hdc=0x2e010751, nSavedDC=-1) returned 1 [0069.578] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.578] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2e010751) returned 0x0 [0069.578] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43c850) returned 0x0 [0069.578] GdipSetStringFormatAlign (format=0x1c46a5e0, align=0x0) returned 0x0 [0069.578] GdipSetStringFormatLineAlign (format=0x1c46a5e0, align=0x0) returned 0x0 [0069.578] GdipSetStringFormatHotkeyPrefix (format=0x1c46a5e0, hotkeyPrefix=2) returned 0x0 [0069.578] GdipGetStringFormatFlags (format=0x1c46a5e0, flags=0x43c870) returned 0x0 [0069.578] GdipSetStringFormatFlags (format=0x1c46a5e0, flags=2048) returned 0x0 [0069.578] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x43c8c0) returned 0x0 [0069.579] GdipDrawString (graphics=0x1c46d570, string="PIN = ", length=6, font=0x1c4618f0, layoutRect=0x43c7d0, stringFormat=0x1c46a5e0, brush=0x1c46cce0) returned 0x0 [0069.579] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.580] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0069.580] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.580] GdipDeleteStringFormat (format=0x1c46a5e0) returned 0x0 [0069.580] GdipGetDC (graphics=0x1c46d570, hdc=0x43cc60) returned 0x0 [0069.580] BitBlt (hdc=0x10105c2, x=0, y=0, cx=60, cy=25, hdcSrc=0x2e010751, x1=0, y1=0, rop=0xcc0020) returned 1 [0069.580] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.580] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2e010751) returned 0x0 [0069.580] SelectPalette (hdc=0x10105c2, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0069.580] SelectObject (hdc=0x2e010751, h=0x185000f) returned 0x2905055a [0069.580] DeleteDC (hdc=0x2e010751) returned 1 [0069.580] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.580] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0069.580] EndPaint (hWnd=0x20230, lpPaint=0x43cd68) returned 1 [0069.585] BeginPaint (in: hWnd=0x20222, lpPaint=0x43cd58 | out: lpPaint=0x43cd58) returned 0x501071f [0069.585] SelectPalette (hdc=0x501071f, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0069.585] CreateCompatibleDC (hdc=0x501071f) returned 0x30010751 [0069.585] GetObjectType (h=0x501071f) returned 0x3 [0069.585] CreateCompatibleBitmap (hdc=0x501071f, cx=1, cy=1) returned 0x35050763 [0069.585] GetDIBits (in: hdc=0x501071f, hbm=0x35050763, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x43c3e8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43c3e8) returned 1 [0069.585] GetDIBits (in: hdc=0x501071f, hbm=0x35050763, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x43c3e8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43c3e8) returned 1 [0069.585] DeleteObject (ho=0x35050763) returned 1 [0069.585] CreateDIBSection (in: hdc=0x501071f, lpbmi=0x43c5c0, usage=0x0, ppvBits=0x43c5b8, hSection=0x0, offset=0x0 | out: ppvBits=0x43c5b8) returned 0xa050778 [0069.586] SelectObject (hdc=0x30010751, h=0xa050778) returned 0x185000f [0069.586] GdipCreateFromHDC (hdc=0x30010751, graphics=0x43cad0) returned 0x0 [0069.586] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0069.586] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=348, height=63, combineMode=0x0) returned 0x0 [0069.586] GdipCreateMatrix (matrix=0x43cc90) returned 0x0 [0069.586] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471470) returned 0x0 [0069.586] GdipIsMatrixIdentity (matrix=0x1c471470, result=0x43ccf0) returned 0x0 [0069.586] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0b90 [0069.586] GdipGetMatrixElements (matrix=0x1c471470, matrixOut=0x1f2e0b90) returned 0x0 [0069.586] LocalFree (hMem=0x1f2e0b90) returned 0x0 [0069.586] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.586] GdipDeleteMatrix (matrix=0x1c471470) returned 0x0 [0069.586] GdipCreateRegion (region=0x43cc90) returned 0x0 [0069.587] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0069.587] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43ccc0) returned 0x0 [0069.587] GdipSaveGraphics (graphics=0x1c46d570, state=0x43cd90) returned 0x0 [0069.587] GetWindowTextLengthW (hWnd=0x20222) returned 94 [0069.587] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5e [0069.587] GetSystemMetrics (nIndex=42) returned 0 [0069.587] CoTaskMemAlloc (cb=0xc2) returned 0x6238c0 [0069.587] GetWindowTextW (in: hWnd=0x20222, lpString=0x6238c0, nMaxCount=95 | out: lpString="Oooooops All your files on the desktop\r\nare encrypted To decrypt files enter PIN\r\nsee you soon") returned 94 [0069.587] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0xd, wParam=0x5f, lParam=0x6238c0) returned 0x5e [0069.587] CoTaskMemFree (pv=0x6238c0) [0069.587] GetClientRect (in: hWnd=0x20222, lpRect=0x43cd00 | out: lpRect=0x43cd00) returned 1 [0069.587] GdipCreateRegion (region=0x43c780) returned 0x0 [0069.587] GdipGetClip (graphics=0x1c46d570, region=0x1c470e90) returned 0x0 [0069.587] GdipCreateMatrix (matrix=0x43c780) returned 0x0 [0069.587] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471430) returned 0x0 [0069.587] GdipIsMatrixIdentity (matrix=0x1c471430, result=0x43c7e0) returned 0x0 [0069.587] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0190 [0069.587] GdipGetMatrixElements (matrix=0x1c471430, matrixOut=0x1f2e0190) returned 0x0 [0069.587] LocalFree (hMem=0x1f2e0190) returned 0x0 [0069.587] GdipCombineRegionRegion (region=0x1c470e90, region2=0x1c46a710, combineMode=0x1) returned 0x0 [0069.587] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0c90 [0069.588] GdipGetMatrixElements (matrix=0x1c471430, matrixOut=0x1f2e0c90) returned 0x0 [0069.588] LocalFree (hMem=0x1f2e0c90) returned 0x0 [0069.588] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.588] GdipDeleteMatrix (matrix=0x1c471430) returned 0x0 [0069.588] GdipIsInfiniteRegion (region=0x1c470e90, graphics=0x1c46d570, result=0x43c830) returned 0x0 [0069.588] GdipIsInfiniteRegion (region=0x1c470e90, graphics=0x1c46d570, result=0x43c7f0) returned 0x0 [0069.588] GdipGetRegionHRgn (region=0x1c470e90, graphics=0x1c46d570, hRgn=0x43c7f0) returned 0x0 [0069.588] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.588] GdipDeleteRegion (region=0x1c470e90) returned 0x0 [0069.588] GdipGetDC (graphics=0x1c46d570, hdc=0x43c860) returned 0x0 [0069.588] GetCurrentObject (hdc=0x30010751, type=0x1) returned 0x1b00017 [0069.588] GetCurrentObject (hdc=0x30010751, type=0x2) returned 0x1900010 [0069.588] GetCurrentObject (hdc=0x30010751, type=0x7) returned 0xa050778 [0069.588] GetCurrentObject (hdc=0x30010751, type=0x6) returned 0x18a0048 [0069.588] SaveDC (hdc=0x30010751) returned 1 [0069.588] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x440405d8 [0069.588] GetClipRgn (hdc=0x30010751, hrgn=0x440405d8) returned 0 [0069.589] SelectClipRgn (hdc=0x30010751, hrgn=0x4a0406cc) returned 2 [0069.589] DeleteObject (ho=0x440405d8) returned 1 [0069.589] DeleteObject (ho=0x4a0406cc) returned 1 [0069.589] OffsetViewportOrgEx (in: hdc=0x30010751, x=0, y=0, lppt=0x259c120 | out: lppt=0x259c120) returned 1 [0069.589] GetNearestColor (hdc=0x30010751, color=0x0) returned 0x0 [0069.589] CreateSolidBrush (color=0x0) returned 0x1210075d [0069.589] FillRect (hDC=0x30010751, lprc=0x43c830, hbr=0x1210075d) returned 1 [0069.590] DeleteObject (ho=0x1210075d) returned 1 [0069.590] RestoreDC (hdc=0x30010751, nSavedDC=-1) returned 1 [0069.590] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.590] GdipReleaseDC (graphics=0x1c46d570, hdc=0x30010751) returned 0x0 [0069.590] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd9d0dbd) returned 0x0 [0069.590] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.590] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0069.590] GetWindowTextLengthW (hWnd=0x20222) returned 94 [0069.591] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5e [0069.591] GetSystemMetrics (nIndex=42) returned 0 [0069.591] CoTaskMemAlloc (cb=0xc2) returned 0x6238c0 [0069.591] GetWindowTextW (in: hWnd=0x20222, lpString=0x6238c0, nMaxCount=95 | out: lpString="Oooooops All your files on the desktop\r\nare encrypted To decrypt files enter PIN\r\nsee you soon") returned 94 [0069.591] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0xd, wParam=0x5f, lParam=0x6238c0) returned 0x5e [0069.591] CoTaskMemFree (pv=0x6238c0) [0069.591] GdipGetDC (graphics=0x1c46d570, hdc=0x43c8c0) returned 0x0 [0069.591] GetCurrentObject (hdc=0x30010751, type=0x1) returned 0x1b00017 [0069.591] GetCurrentObject (hdc=0x30010751, type=0x2) returned 0x1900010 [0069.591] GetCurrentObject (hdc=0x30010751, type=0x7) returned 0xa050778 [0069.591] GetCurrentObject (hdc=0x30010751, type=0x6) returned 0x18a0048 [0069.591] SaveDC (hdc=0x30010751) returned 1 [0069.591] GetNearestColor (hdc=0x30010751, color=0x80) returned 0x80 [0069.591] RestoreDC (hdc=0x30010751, nSavedDC=-1) returned 1 [0069.591] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.591] GdipReleaseDC (graphics=0x1c46d570, hdc=0x30010751) returned 0x0 [0069.591] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43c850) returned 0x0 [0069.591] GdipSetStringFormatAlign (format=0x1c46a5e0, align=0x0) returned 0x0 [0069.591] GdipSetStringFormatLineAlign (format=0x1c46a5e0, align=0x0) returned 0x0 [0069.592] GdipSetStringFormatHotkeyPrefix (format=0x1c46a5e0, hotkeyPrefix=2) returned 0x0 [0069.592] GdipGetStringFormatFlags (format=0x1c46a5e0, flags=0x43c870) returned 0x0 [0069.592] GdipSetStringFormatFlags (format=0x1c46a5e0, flags=2048) returned 0x0 [0069.592] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x43c8c0) returned 0x0 [0069.592] GdipDrawString (graphics=0x1c46d570, string="Oooooops All your files on the desktop\r\nare encrypted To decrypt files enter PIN\r\nsee you soon", length=94, font=0x1c4618b0, layoutRect=0x43c7d0, stringFormat=0x1c46a5e0, brush=0x1c46cce0) returned 0x0 [0069.610] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.610] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0069.610] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.610] GdipDeleteStringFormat (format=0x1c46a5e0) returned 0x0 [0069.610] GdipGetDC (graphics=0x1c46d570, hdc=0x43cc60) returned 0x0 [0069.610] BitBlt (hdc=0x501071f, x=0, y=0, cx=348, cy=63, hdcSrc=0x30010751, x1=0, y1=0, rop=0xcc0020) returned 1 [0069.619] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.619] GdipReleaseDC (graphics=0x1c46d570, hdc=0x30010751) returned 0x0 [0069.619] SelectPalette (hdc=0x501071f, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0069.619] SelectObject (hdc=0x30010751, h=0x185000f) returned 0xa050778 [0069.619] DeleteDC (hdc=0x30010751) returned 1 [0069.619] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.619] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0069.619] DeleteObject (ho=0xa050778) returned 1 [0069.620] EndPaint (hWnd=0x20222, lpPaint=0x43cd68) returned 1 [0069.620] BeginPaint (in: hWnd=0x20224, lpPaint=0x43cd58 | out: lpPaint=0x43cd58) returned 0xa0100d0 [0069.620] SelectPalette (hdc=0xa0100d0, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0069.620] CreateCompatibleDC (hdc=0xa0100d0) returned 0x38010763 [0069.620] GetObjectType (h=0xa0100d0) returned 0x3 [0069.620] CreateCompatibleBitmap (hdc=0xa0100d0, cx=1, cy=1) returned 0xb050778 [0069.620] GetDIBits (in: hdc=0xa0100d0, hbm=0xb050778, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x43c3e8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43c3e8) returned 1 [0069.620] GetDIBits (in: hdc=0xa0100d0, hbm=0xb050778, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x43c3e8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43c3e8) returned 1 [0069.620] DeleteObject (ho=0xb050778) returned 1 [0069.621] CreateDIBSection (in: hdc=0xa0100d0, lpbmi=0x43c5c0, usage=0x0, ppvBits=0x43c5b8, hSection=0x0, offset=0x0 | out: ppvBits=0x43c5b8) returned 0x31050751 [0069.621] SelectObject (hdc=0x38010763, h=0x31050751) returned 0x185000f [0069.621] GdipCreateFromHDC (hdc=0x38010763, graphics=0x43cad0) returned 0x0 [0069.621] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0069.621] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=338, height=77, combineMode=0x0) returned 0x0 [0069.621] GdipCreateMatrix (matrix=0x43cc90) returned 0x0 [0069.621] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4710f0) returned 0x0 [0069.621] GdipIsMatrixIdentity (matrix=0x1c4710f0, result=0x43ccf0) returned 0x0 [0069.621] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0610 [0069.621] GdipGetMatrixElements (matrix=0x1c4710f0, matrixOut=0x1f2e0610) returned 0x0 [0069.621] LocalFree (hMem=0x1f2e0610) returned 0x0 [0069.621] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.621] GdipDeleteMatrix (matrix=0x1c4710f0) returned 0x0 [0069.622] GdipCreateRegion (region=0x43cc90) returned 0x0 [0069.622] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0069.622] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43ccc0) returned 0x0 [0069.622] GdipSaveGraphics (graphics=0x1c46d570, state=0x43cd90) returned 0x0 [0069.622] GetWindowTextLengthW (hWnd=0x20224) returned 39 [0069.622] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x27 [0069.622] GetSystemMetrics (nIndex=42) returned 0 [0069.622] CoTaskMemAlloc (cb=0x54) returned 0x1f2e2450 [0069.622] GetWindowTextW (in: hWnd=0x20224, lpString=0x1f2e2450, nMaxCount=40 | out: lpString=" Welcome in\r\nDesktop Ransomware") returned 39 [0069.622] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0xd, wParam=0x28, lParam=0x1f2e2450) returned 0x27 [0069.622] CoTaskMemFree (pv=0x1f2e2450) [0069.622] GetClientRect (in: hWnd=0x20224, lpRect=0x43cd00 | out: lpRect=0x43cd00) returned 1 [0069.622] GdipCreateRegion (region=0x43c780) returned 0x0 [0069.622] GdipGetClip (graphics=0x1c46d570, region=0x1c468be0) returned 0x0 [0069.622] GdipCreateMatrix (matrix=0x43c780) returned 0x0 [0069.622] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471730) returned 0x0 [0069.622] GdipIsMatrixIdentity (matrix=0x1c471730, result=0x43c7e0) returned 0x0 [0069.622] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e05d0 [0069.622] GdipGetMatrixElements (matrix=0x1c471730, matrixOut=0x1f2e05d0) returned 0x0 [0069.622] LocalFree (hMem=0x1f2e05d0) returned 0x0 [0069.622] GdipCombineRegionRegion (region=0x1c468be0, region2=0x1c46a710, combineMode=0x1) returned 0x0 [0069.623] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0210 [0069.623] GdipGetMatrixElements (matrix=0x1c471730, matrixOut=0x1f2e0210) returned 0x0 [0069.623] LocalFree (hMem=0x1f2e0210) returned 0x0 [0069.623] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.623] GdipDeleteMatrix (matrix=0x1c471730) returned 0x0 [0069.623] GdipIsInfiniteRegion (region=0x1c468be0, graphics=0x1c46d570, result=0x43c830) returned 0x0 [0069.623] GdipIsInfiniteRegion (region=0x1c468be0, graphics=0x1c46d570, result=0x43c7f0) returned 0x0 [0069.623] GdipGetRegionHRgn (region=0x1c468be0, graphics=0x1c46d570, hRgn=0x43c7f0) returned 0x0 [0069.623] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.623] GdipDeleteRegion (region=0x1c468be0) returned 0x0 [0069.623] GdipGetDC (graphics=0x1c46d570, hdc=0x43c860) returned 0x0 [0069.623] GetCurrentObject (hdc=0x38010763, type=0x1) returned 0x1b00017 [0069.623] GetCurrentObject (hdc=0x38010763, type=0x2) returned 0x1900010 [0069.623] GetCurrentObject (hdc=0x38010763, type=0x7) returned 0x31050751 [0069.623] GetCurrentObject (hdc=0x38010763, type=0x6) returned 0x18a0048 [0069.623] SaveDC (hdc=0x38010763) returned 1 [0069.623] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4b0406cc [0069.623] GetClipRgn (hdc=0x38010763, hrgn=0x4b0406cc) returned 0 [0069.624] SelectClipRgn (hdc=0x38010763, hrgn=0x450405d8) returned 2 [0069.624] DeleteObject (ho=0x4b0406cc) returned 1 [0069.624] DeleteObject (ho=0x450405d8) returned 1 [0069.624] OffsetViewportOrgEx (in: hdc=0x38010763, x=0, y=0, lppt=0x259ddd0 | out: lppt=0x259ddd0) returned 1 [0069.624] GetNearestColor (hdc=0x38010763, color=0x0) returned 0x0 [0069.624] CreateSolidBrush (color=0x0) returned 0x1310075d [0069.624] FillRect (hDC=0x38010763, lprc=0x43c830, hbr=0x1310075d) returned 1 [0069.626] DeleteObject (ho=0x1310075d) returned 1 [0069.626] RestoreDC (hdc=0x38010763, nSavedDC=-1) returned 1 [0069.626] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.626] GdipReleaseDC (graphics=0x1c46d570, hdc=0x38010763) returned 0x0 [0069.626] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd9b0dbd) returned 0x0 [0069.626] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.626] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0069.626] GetWindowTextLengthW (hWnd=0x20224) returned 39 [0069.626] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x27 [0069.626] GetSystemMetrics (nIndex=42) returned 0 [0069.626] CoTaskMemAlloc (cb=0x54) returned 0x1f2e2690 [0069.626] GetWindowTextW (in: hWnd=0x20224, lpString=0x1f2e2690, nMaxCount=40 | out: lpString=" Welcome in\r\nDesktop Ransomware") returned 39 [0069.626] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0xd, wParam=0x28, lParam=0x1f2e2690) returned 0x27 [0069.626] CoTaskMemFree (pv=0x1f2e2690) [0069.626] GdipGetDC (graphics=0x1c46d570, hdc=0x43c8c0) returned 0x0 [0069.626] GetCurrentObject (hdc=0x38010763, type=0x1) returned 0x1b00017 [0069.626] GetCurrentObject (hdc=0x38010763, type=0x2) returned 0x1900010 [0069.626] GetCurrentObject (hdc=0x38010763, type=0x7) returned 0x31050751 [0069.626] GetCurrentObject (hdc=0x38010763, type=0x6) returned 0x18a0048 [0069.627] SaveDC (hdc=0x38010763) returned 1 [0069.627] GetNearestColor (hdc=0x38010763, color=0x80) returned 0x80 [0069.627] RestoreDC (hdc=0x38010763, nSavedDC=-1) returned 1 [0069.627] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.627] GdipReleaseDC (graphics=0x1c46d570, hdc=0x38010763) returned 0x0 [0069.627] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43c850) returned 0x0 [0069.627] GdipSetStringFormatAlign (format=0x1c475c10, align=0x0) returned 0x0 [0069.627] GdipSetStringFormatLineAlign (format=0x1c475c10, align=0x0) returned 0x0 [0069.627] GdipSetStringFormatHotkeyPrefix (format=0x1c475c10, hotkeyPrefix=2) returned 0x0 [0069.627] GdipGetStringFormatFlags (format=0x1c475c10, flags=0x43c870) returned 0x0 [0069.627] GdipSetStringFormatFlags (format=0x1c475c10, flags=2048) returned 0x0 [0069.627] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x43c8c0) returned 0x0 [0069.627] GdipDrawString (graphics=0x1c46d570, string=" Welcome in\r\nDesktop Ransomware", length=39, font=0x1b2c34f0, layoutRect=0x43c7d0, stringFormat=0x1c475c10, brush=0x1c46cce0) returned 0x0 [0069.632] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.632] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0069.632] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.632] GdipDeleteStringFormat (format=0x1c475c10) returned 0x0 [0069.633] GdipGetDC (graphics=0x1c46d570, hdc=0x43cc60) returned 0x0 [0069.633] BitBlt (hdc=0xa0100d0, x=0, y=0, cx=338, cy=77, hdcSrc=0x38010763, x1=0, y1=0, rop=0xcc0020) returned 1 [0069.635] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.635] GdipReleaseDC (graphics=0x1c46d570, hdc=0x38010763) returned 0x0 [0069.635] SelectPalette (hdc=0xa0100d0, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0069.636] SelectObject (hdc=0x38010763, h=0x185000f) returned 0x31050751 [0069.636] DeleteDC (hdc=0x38010763) returned 1 [0069.636] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.636] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0069.636] DeleteObject (ho=0x31050751) returned 1 [0069.636] EndPaint (hWnd=0x20224, lpPaint=0x43cd68) returned 1 [0069.637] BeginPaint (in: hWnd=0x2021e, lpPaint=0x43ce08 | out: lpPaint=0x43ce08) returned 0x10105c2 [0069.637] SelectPalette (hdc=0x10105c2, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0069.637] CreateCompatibleDC (hdc=0x10105c2) returned 0xe010778 [0069.637] GetObjectType (h=0x10105c2) returned 0x3 [0069.637] CreateCompatibleBitmap (hdc=0x10105c2, cx=1, cy=1) returned 0x33050751 [0069.637] GetDIBits (in: hdc=0x10105c2, hbm=0x33050751, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x43c498, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43c498) returned 1 [0069.637] GetDIBits (in: hdc=0x10105c2, hbm=0x33050751, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x43c498, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43c498) returned 1 [0069.637] DeleteObject (ho=0x33050751) returned 1 [0069.637] CreateDIBSection (in: hdc=0x10105c2, lpbmi=0x43c670, usage=0x0, ppvBits=0x43c668, hSection=0x0, offset=0x0 | out: ppvBits=0x43c668) returned 0x39050763 [0069.638] SelectObject (hdc=0xe010778, h=0x39050763) returned 0x185000f [0069.638] GdipCreateFromHDC (hdc=0xe010778, graphics=0x43cb80) returned 0x0 [0069.638] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0069.638] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=639, height=426, combineMode=0x0) returned 0x0 [0069.638] GdipCreateMatrix (matrix=0x43cd40) returned 0x0 [0069.638] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4713b0) returned 0x0 [0069.638] GdipIsMatrixIdentity (matrix=0x1c4713b0, result=0x43cda0) returned 0x0 [0069.638] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0390 [0069.638] GdipGetMatrixElements (matrix=0x1c4713b0, matrixOut=0x1f2e0390) returned 0x0 [0069.638] LocalFree (hMem=0x1f2e0390) returned 0x0 [0069.638] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.638] GdipDeleteMatrix (matrix=0x1c4713b0) returned 0x0 [0069.638] GdipCreateRegion (region=0x43cd40) returned 0x0 [0069.639] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0069.639] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43cd70) returned 0x0 [0069.639] GdipSaveGraphics (graphics=0x1c46d570, state=0x43ce40) returned 0x0 [0069.639] GetWindowTextLengthW (hWnd=0x2021e) returned 0 [0069.639] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0069.639] GetSystemMetrics (nIndex=42) returned 0 [0069.639] CoTaskMemAlloc (cb=0x6) returned 0x64e140 [0069.639] GetWindowTextW (in: hWnd=0x2021e, lpString=0x64e140, nMaxCount=1 | out: lpString="") returned 0 [0069.639] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0xd, wParam=0x1, lParam=0x64e140) returned 0x0 [0069.639] CoTaskMemFree (pv=0x64e140) [0069.639] GetClientRect (in: hWnd=0x2021e, lpRect=0x43cdb0 | out: lpRect=0x43cdb0) returned 1 [0069.639] GdipCreateRegion (region=0x43c830) returned 0x0 [0069.639] GdipGetClip (graphics=0x1c46d570, region=0x1c468be0) returned 0x0 [0069.639] GdipCreateMatrix (matrix=0x43c830) returned 0x0 [0069.639] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4715b0) returned 0x0 [0069.639] GdipIsMatrixIdentity (matrix=0x1c4715b0, result=0x43c890) returned 0x0 [0069.639] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e0310 [0069.639] GdipGetMatrixElements (matrix=0x1c4715b0, matrixOut=0x1f2e0310) returned 0x0 [0069.639] LocalFree (hMem=0x1f2e0310) returned 0x0 [0069.639] GdipCombineRegionRegion (region=0x1c468be0, region2=0x1c46a710, combineMode=0x1) returned 0x0 [0069.640] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2e09d0 [0069.640] GdipGetMatrixElements (matrix=0x1c4715b0, matrixOut=0x1f2e09d0) returned 0x0 [0069.640] LocalFree (hMem=0x1f2e09d0) returned 0x0 [0069.640] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.640] GdipDeleteMatrix (matrix=0x1c4715b0) returned 0x0 [0069.640] GdipIsInfiniteRegion (region=0x1c468be0, graphics=0x1c46d570, result=0x43c8e0) returned 0x0 [0069.640] GdipIsInfiniteRegion (region=0x1c468be0, graphics=0x1c46d570, result=0x43c8a0) returned 0x0 [0069.640] GdipGetRegionHRgn (region=0x1c468be0, graphics=0x1c46d570, hRgn=0x43c8a0) returned 0x0 [0069.640] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.640] GdipDeleteRegion (region=0x1c468be0) returned 0x0 [0069.640] GdipGetDC (graphics=0x1c46d570, hdc=0x43c910) returned 0x0 [0069.640] GetCurrentObject (hdc=0xe010778, type=0x1) returned 0x1b00017 [0069.640] GetCurrentObject (hdc=0xe010778, type=0x2) returned 0x1900010 [0069.640] GetCurrentObject (hdc=0xe010778, type=0x7) returned 0x39050763 [0069.640] GetCurrentObject (hdc=0xe010778, type=0x6) returned 0x18a0048 [0069.640] SaveDC (hdc=0xe010778) returned 1 [0069.640] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x460405d8 [0069.640] GetClipRgn (hdc=0xe010778, hrgn=0x460405d8) returned 0 [0069.640] SelectClipRgn (hdc=0xe010778, hrgn=0x4c0406cc) returned 2 [0069.641] DeleteObject (ho=0x460405d8) returned 1 [0069.641] DeleteObject (ho=0x4c0406cc) returned 1 [0069.641] OffsetViewportOrgEx (in: hdc=0xe010778, x=0, y=0, lppt=0x259f970 | out: lppt=0x259f970) returned 1 [0069.641] GetNearestColor (hdc=0xe010778, color=0xf0f0f0) returned 0xf0f0f0 [0069.641] CreateSolidBrush (color=0xf0f0f0) returned 0x1410075d [0069.641] FillRect (hDC=0xe010778, lprc=0x43c8e0, hbr=0x1410075d) returned 1 [0069.667] DeleteObject (ho=0x1410075d) returned 1 [0069.667] RestoreDC (hdc=0xe010778, nSavedDC=-1) returned 1 [0069.667] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.667] GdipReleaseDC (graphics=0x1c46d570, hdc=0xe010778) returned 0x0 [0069.667] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd990dbd) returned 0x0 [0069.667] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.667] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0069.667] GetWindowTextLengthW (hWnd=0x2021e) returned 0 [0069.668] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0069.668] GetSystemMetrics (nIndex=42) returned 0 [0069.668] CoTaskMemAlloc (cb=0x6) returned 0x64de90 [0069.668] GetWindowTextW (in: hWnd=0x2021e, lpString=0x64de90, nMaxCount=1 | out: lpString="") returned 0 [0069.668] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0xd, wParam=0x1, lParam=0x64de90) returned 0x0 [0069.668] CoTaskMemFree (pv=0x64de90) [0069.672] GdipDrawImageRectI (graphics=0x1c46d570, image=0x1c4667f0, x=0, y=0, width=639, height=426) returned 0x0 [0069.744] GdipGetDC (graphics=0x1c46d570, hdc=0x43cd10) returned 0x0 [0069.744] BitBlt (hdc=0x10105c2, x=0, y=0, cx=639, cy=426, hdcSrc=0xe010778, x1=0, y1=0, rop=0xcc0020) returned 1 [0069.748] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.748] GdipReleaseDC (graphics=0x1c46d570, hdc=0xe010778) returned 0x0 [0069.748] SelectPalette (hdc=0x10105c2, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0069.749] SelectObject (hdc=0xe010778, h=0x185000f) returned 0x39050763 [0069.749] DeleteDC (hdc=0xe010778) returned 1 [0069.749] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0069.749] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0069.749] DeleteObject (ho=0x39050763) returned 1 [0069.758] EndPaint (hWnd=0x2021e, lpPaint=0x43ce18) returned 1 [0069.759] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x2a1, wParam=0x0, lParam=0xc0022) returned 0x0 [0070.285] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26601cd) returned 0x1 [0070.285] SetCursor (hCursor=0x200149) returned 0x200149 [0070.286] GetKeyState (nVirtKey=1) returned 0 [0070.286] GetKeyState (nVirtKey=2) returned 0 [0070.286] GetKeyState (nVirtKey=4) returned 0 [0070.286] GetKeyState (nVirtKey=5) returned 0 [0070.286] GetKeyState (nVirtKey=6) returned 0 [0070.350] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26601cd) returned 0x1 [0070.350] GetDlgItem (hDlg=0x8016e, nIDDlgItem=0) returned 0x0 [0070.350] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x210, wParam=0x201, lParam=0x182003d) returned 0x0 [0070.350] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x21, wParam=0x8016e, lParam=0x2010001) returned 0x1 [0070.350] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x21, wParam=0x8016e, lParam=0x2010001) returned 0x1 [0070.351] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43d7c0) returned 0x0 [0070.351] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43d7c0) returned 0x0 [0070.352] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43d1f0 | out: lpwndpl=0x43d1f0) returned 1 [0070.352] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x47, wParam=0x0, lParam=0x43d7c0) returned 0x0 [0070.352] GetClientRect (in: hWnd=0x8016e, lpRect=0x43cf90 | out: lpRect=0x43cf90) returned 1 [0070.352] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43cf90 | out: lpRect=0x43cf90) returned 1 [0070.352] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x47, wParam=0x0, lParam=0x43d7c0) returned 0x0 [0070.353] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0070.353] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0070.353] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0070.353] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0070.355] GetFocus () returned 0x0 [0070.355] SetFocus (hWnd=0xa01fa) returned 0x0 [0070.356] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0070.357] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0070.357] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.357] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0070.357] GetStockObject (i=5) returned 0x1900015 [0070.357] GetDlgItem (hDlg=0x8016e, nIDDlgItem=655866) returned 0xa01fa [0070.357] SendMessageW (hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43c470) returned 0x0 [0070.357] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43c470) returned 0x0 [0070.357] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0070.358] SetCursor (hCursor=0x200149) returned 0x200149 [0070.358] GetKeyState (nVirtKey=1) returned -127 [0070.358] GetKeyState (nVirtKey=2) returned 0 [0070.358] GetKeyState (nVirtKey=4) returned 0 [0070.358] GetKeyState (nVirtKey=5) returned 0 [0070.358] GetKeyState (nVirtKey=6) returned 0 [0070.358] IsWindowVisible (hWnd=0xa01fa) returned 1 [0070.358] IsWindowEnabled (hWnd=0xa01fa) returned 1 [0070.358] SetFocus (hWnd=0xa01fa) returned 0xa01fa [0070.358] GetFocus () returned 0xa01fa [0070.358] GetFocus () returned 0xa01fa [0070.358] GetFocus () returned 0xa01fa [0070.358] GetKeyState (nVirtKey=1) returned -127 [0070.358] GetKeyState (nVirtKey=2) returned 0 [0070.358] GetKeyState (nVirtKey=4) returned 0 [0070.359] GetKeyState (nVirtKey=5) returned 0 [0070.359] GetKeyState (nVirtKey=6) returned 0 [0070.359] GetCapture () returned 0x0 [0070.359] SetCapture (hWnd=0xa01fa) returned 0x0 [0070.359] GetKeyState (nVirtKey=1) returned -127 [0070.359] GetKeyState (nVirtKey=2) returned 0 [0070.359] GetKeyState (nVirtKey=4) returned 0 [0070.359] GetKeyState (nVirtKey=5) returned 0 [0070.359] GetKeyState (nVirtKey=6) returned 0 [0070.359] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0070.359] InvalidateRect (hWnd=0xa01fa, lpRect=0x43cfb0, bErase=0) returned 1 [0070.359] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x259fb60, cPoints=0x1 | out: lpPoints=0x259fb60) returned 39715228 [0070.359] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0070.359] InvalidateRect (hWnd=0xa01fa, lpRect=0x43cf00, bErase=0) returned 1 [0070.359] UpdateWindow (hWnd=0xa01fa) returned 1 [0070.359] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x43c518 | out: lpPaint=0x43c518) returned 0xa0100d0 [0070.360] SelectPalette (hdc=0xa0100d0, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0070.360] CreateCompatibleDC (hdc=0xa0100d0) returned 0x15010778 [0070.360] SelectObject (hdc=0x15010778, h=0x2905055a) returned 0x185000f [0070.360] GdipCreateFromHDC (hdc=0x15010778, graphics=0x43c320) returned 0x0 [0070.360] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0070.360] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0070.360] GdipCreateMatrix (matrix=0x43c450) returned 0x0 [0070.360] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4715f0) returned 0x0 [0070.361] GdipIsMatrixIdentity (matrix=0x1c4715f0, result=0x43c4b0) returned 0x0 [0070.361] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f8770 [0070.361] GdipGetMatrixElements (matrix=0x1c4715f0, matrixOut=0x1f2f8770) returned 0x0 [0070.361] LocalFree (hMem=0x1f2f8770) returned 0x0 [0070.361] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.361] GdipDeleteMatrix (matrix=0x1c4715f0) returned 0x0 [0070.361] GdipCreateRegion (region=0x43c450) returned 0x0 [0070.361] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0070.361] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43c480) returned 0x0 [0070.361] GdipSaveGraphics (graphics=0x1c46d570, state=0x43c550) returned 0x0 [0070.361] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd970dbd) returned 0x0 [0070.361] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.361] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0070.362] GdipGetDC (graphics=0x1c46d570, hdc=0x43b940) returned 0x0 [0070.362] GetCurrentObject (hdc=0x15010778, type=0x1) returned 0x1b00017 [0070.362] GetCurrentObject (hdc=0x15010778, type=0x2) returned 0x1900010 [0070.362] GetCurrentObject (hdc=0x15010778, type=0x7) returned 0x2905055a [0070.362] GetCurrentObject (hdc=0x15010778, type=0x6) returned 0x18a0048 [0070.363] SaveDC (hdc=0x15010778) returned 1 [0070.363] GetNearestColor (hdc=0x15010778, color=0xf0f0f0) returned 0xf0f0f0 [0070.363] GetNearestColor (hdc=0x15010778, color=0xa0a0a0) returned 0xa0a0a0 [0070.363] GetNearestColor (hdc=0x15010778, color=0x696969) returned 0x696969 [0070.363] GetNearestColor (hdc=0x15010778, color=0xa0a0a0) returned 0xa0a0a0 [0070.363] GetNearestColor (hdc=0x15010778, color=0x0) returned 0x0 [0070.363] GetNearestColor (hdc=0x15010778, color=0xffffff) returned 0xffffff [0070.364] GetNearestColor (hdc=0x15010778, color=0xe5e5e5) returned 0xe5e5e5 [0070.364] GetNearestColor (hdc=0x15010778, color=0xd8d8d8) returned 0xd8d8d8 [0070.364] GetNearestColor (hdc=0x15010778, color=0x0) returned 0x0 [0070.364] RestoreDC (hdc=0x15010778, nSavedDC=-1) returned 1 [0070.364] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.364] GdipReleaseDC (graphics=0x1c46d570, hdc=0x15010778) returned 0x0 [0070.365] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0070.365] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3040 [0070.365] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0070.365] CoTaskMemFree (pv=0x1f2f3040) [0070.365] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43c030) returned 0x0 [0070.365] GdipSetStringFormatAlign (format=0x1c475a50, align=0x1) returned 0x0 [0070.365] GdipSetStringFormatLineAlign (format=0x1c475a50, align=0x1) returned 0x0 [0070.365] GdipSetStringFormatHotkeyPrefix (format=0x1c475a50, hotkeyPrefix=2) returned 0x0 [0070.365] GdipGetStringFormatFlags (format=0x1c475a50, flags=0x43c060) returned 0x0 [0070.365] GdipGetStringFormatTrimming (format=0x1c475a50, trimming=0x43c060) returned 0x0 [0070.366] GdipGetStringFormatHotkeyPrefix (format=0x1c475a50, hotkeyPrefix=0x43c060) returned 0x0 [0070.366] GdipGetFontSize (font=0x1c475a50, size=0x43c060) returned 0x0 [0070.366] GdipGetFontStyle (font=0x1c475a50, style=0x43c060) returned 0x0 [0070.366] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.366] GdipDeleteStringFormat (format=0x1c475a50) returned 0x0 [0070.366] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0070.366] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2de0 [0070.366] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0070.367] CoTaskMemFree (pv=0x1f2f2de0) [0070.367] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43bcf0) returned 0x0 [0070.367] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43bd00) returned 0x0 [0070.367] GdipSetStringFormatFlags (format=0x1c475f20, flags=0) returned 0x0 [0070.367] GdipSetStringFormatTrimming (format=0x1c475f20, trimming=0x1) returned 0x0 [0070.367] GdipSetStringFormatHotkeyPrefix (format=0x1c475f20, hotkeyPrefix=2) returned 0x0 [0070.367] GdipSetStringFormatAlign (format=0x1c475f20, align=0x1) returned 0x0 [0070.367] GdipSetStringFormatLineAlign (format=0x1c475f20, align=0x1) returned 0x0 [0070.367] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43bc18, stringFormat=0x1c475f20, boundingBox=0x43bc08, codepointsFitted=0x43bc04, linesFilled=0x43bc00) returned 0x0 [0070.367] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.367] GdipDeleteStringFormat (format=0x1c475f20) returned 0x0 [0070.367] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.367] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0070.368] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0070.368] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2ec0 [0070.368] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0070.368] CoTaskMemFree (pv=0x1f2f2ec0) [0070.368] GdipCreateRegion (region=0x43bc60) returned 0x0 [0070.369] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0070.369] GdipCreateMatrix (matrix=0x43bc60) returned 0x0 [0070.369] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4713f0) returned 0x0 [0070.369] GdipIsMatrixIdentity (matrix=0x1c4713f0, result=0x43bcc0) returned 0x0 [0070.369] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f7df0 [0070.369] GdipGetMatrixElements (matrix=0x1c4713f0, matrixOut=0x1f2f7df0) returned 0x0 [0070.369] LocalFree (hMem=0x1f2f7df0) returned 0x0 [0070.369] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f8630 [0070.369] GdipGetMatrixElements (matrix=0x1c4713f0, matrixOut=0x1f2f8630) returned 0x0 [0070.369] LocalFree (hMem=0x1f2f8630) returned 0x0 [0070.369] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.369] GdipDeleteMatrix (matrix=0x1c4713f0) returned 0x0 [0070.369] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43bd10) returned 0x0 [0070.369] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43bcd0) returned 0x0 [0070.369] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43bcd0) returned 0x0 [0070.369] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.370] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0070.370] GdipGetDC (graphics=0x1c46d570, hdc=0x43bd40) returned 0x0 [0070.370] GetCurrentObject (hdc=0x15010778, type=0x1) returned 0x1b00017 [0070.370] GetCurrentObject (hdc=0x15010778, type=0x2) returned 0x1900010 [0070.370] GetCurrentObject (hdc=0x15010778, type=0x7) returned 0x2905055a [0070.370] GetCurrentObject (hdc=0x15010778, type=0x6) returned 0x18a0048 [0070.370] SaveDC (hdc=0x15010778) returned 1 [0070.370] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4d0406cc [0070.370] GetClipRgn (hdc=0x15010778, hrgn=0x4d0406cc) returned 0 [0070.370] SelectClipRgn (hdc=0x15010778, hrgn=0x470405d8) returned 2 [0070.370] DeleteObject (ho=0x4d0406cc) returned 1 [0070.370] DeleteObject (ho=0x470405d8) returned 1 [0070.370] OffsetViewportOrgEx (in: hdc=0x15010778, x=0, y=0, lppt=0x25a07e0 | out: lppt=0x25a07e0) returned 1 [0070.370] GetNearestColor (hdc=0x15010778, color=0xf0f0f0) returned 0xf0f0f0 [0070.371] CreateSolidBrush (color=0xf0f0f0) returned 0x1510075d [0070.371] FillRect (hDC=0x15010778, lprc=0x43bd10, hbr=0x1510075d) returned 1 [0070.371] DeleteObject (ho=0x1510075d) returned 1 [0070.371] RestoreDC (hdc=0x15010778, nSavedDC=-1) returned 1 [0070.371] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.371] GdipReleaseDC (graphics=0x1c46d570, hdc=0x15010778) returned 0x0 [0070.371] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0070.372] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2e00 [0070.372] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0070.372] CoTaskMemFree (pv=0x1f2f2e00) [0070.372] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43bd90) returned 0x0 [0070.372] GdipSetStringFormatAlign (format=0x1c476770, align=0x1) returned 0x0 [0070.372] GdipSetStringFormatLineAlign (format=0x1c476770, align=0x1) returned 0x0 [0070.372] GdipSetStringFormatHotkeyPrefix (format=0x1c476770, hotkeyPrefix=2) returned 0x0 [0070.372] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x43be00) returned 0x0 [0070.372] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43bd10, stringFormat=0x1c476770, brush=0x1c46cce0) returned 0x0 [0070.373] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.373] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0070.373] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.373] GdipDeleteStringFormat (format=0x1c476770) returned 0x0 [0070.373] GetFocus () returned 0xa01fa [0070.373] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0070.373] CoTaskMemAlloc (cb=0x13) returned 0x1f2f32e0 [0070.374] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0070.374] CoTaskMemFree (pv=0x1f2f32e0) [0070.374] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x43c0f0) returned 0x0 [0070.374] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0070.374] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.374] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0070.374] GdipCreateRegion (region=0x43bbc0) returned 0x0 [0070.374] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0070.374] GdipCreateMatrix (matrix=0x43bbc0) returned 0x0 [0070.374] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4714b0) returned 0x0 [0070.374] GdipIsMatrixIdentity (matrix=0x1c4714b0, result=0x43bc20) returned 0x0 [0070.374] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f7bf0 [0070.374] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f2f7bf0) returned 0x0 [0070.375] LocalFree (hMem=0x1f2f7bf0) returned 0x0 [0070.375] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f7cf0 [0070.375] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f2f7cf0) returned 0x0 [0070.375] LocalFree (hMem=0x1f2f7cf0) returned 0x0 [0070.375] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.375] GdipDeleteMatrix (matrix=0x1c4714b0) returned 0x0 [0070.375] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43bc70) returned 0x0 [0070.375] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43bc30) returned 0x0 [0070.375] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43bc30) returned 0x0 [0070.375] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.375] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0070.375] GdipGetDC (graphics=0x1c46d570, hdc=0x43bca0) returned 0x0 [0070.375] GetCurrentObject (hdc=0x15010778, type=0x1) returned 0x1b00017 [0070.375] GetCurrentObject (hdc=0x15010778, type=0x2) returned 0x1900010 [0070.375] GetCurrentObject (hdc=0x15010778, type=0x7) returned 0x2905055a [0070.375] GetCurrentObject (hdc=0x15010778, type=0x6) returned 0x18a0048 [0070.376] SaveDC (hdc=0x15010778) returned 1 [0070.376] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x480405d8 [0070.376] GetClipRgn (hdc=0x15010778, hrgn=0x480405d8) returned 0 [0070.376] SelectClipRgn (hdc=0x15010778, hrgn=0x4e0406cc) returned 2 [0070.376] DeleteObject (ho=0x480405d8) returned 1 [0070.376] DeleteObject (ho=0x4e0406cc) returned 1 [0070.376] OffsetViewportOrgEx (in: hdc=0x15010778, x=0, y=0, lppt=0x25a0d80 | out: lppt=0x25a0d80) returned 1 [0070.376] GetROP2 (hdc=0x15010778) returned 13 [0070.376] GetBkMode (hdc=0x15010778) returned 2 [0070.376] SetBkMode (hdc=0x15010778, mode=1) returned 2 [0070.376] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x16300762 [0070.376] SelectObject (hdc=0x15010778, h=0x16300762) returned 0x1b00017 [0070.376] MoveToEx (in: hdc=0x15010778, x=123, y=1, lppt=0x25a0de8 | out: lppt=0x25a0de8) returned 1 [0070.376] LineTo (hdc=0x15010778, x=1, y=1) returned 1 [0070.377] SetBkMode (hdc=0x15010778, mode=2) returned 1 [0070.377] MoveToEx (in: hdc=0x15010778, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0070.377] GetROP2 (hdc=0x15010778) returned 13 [0070.377] GetBkMode (hdc=0x15010778) returned 2 [0070.377] SetBkMode (hdc=0x15010778, mode=1) returned 2 [0070.377] SelectObject (hdc=0x15010778, h=0x16300762) returned 0x16300762 [0070.377] MoveToEx (in: hdc=0x15010778, x=1, y=1, lppt=0x25a0e00 | out: lppt=0x25a0e00) returned 1 [0070.377] LineTo (hdc=0x15010778, x=1, y=34) returned 1 [0070.377] SetBkMode (hdc=0x15010778, mode=2) returned 1 [0070.377] MoveToEx (in: hdc=0x15010778, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0070.377] SelectObject (hdc=0x15010778, h=0x1b00017) returned 0x16300762 [0070.377] DeleteObject (ho=0x16300762) returned 1 [0070.377] GetROP2 (hdc=0x15010778) returned 13 [0070.377] GetBkMode (hdc=0x15010778) returned 2 [0070.377] SetBkMode (hdc=0x15010778, mode=1) returned 2 [0070.377] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1c30072f [0070.383] SelectObject (hdc=0x15010778, h=0x1c30072f) returned 0x1b00017 [0070.383] MoveToEx (in: hdc=0x15010778, x=1, y=34, lppt=0x25a0e68 | out: lppt=0x25a0e68) returned 1 [0070.384] LineTo (hdc=0x15010778, x=123, y=34) returned 1 [0070.384] SetBkMode (hdc=0x15010778, mode=2) returned 1 [0070.384] MoveToEx (in: hdc=0x15010778, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0070.384] GetROP2 (hdc=0x15010778) returned 13 [0070.384] GetBkMode (hdc=0x15010778) returned 2 [0070.384] SetBkMode (hdc=0x15010778, mode=1) returned 2 [0070.384] SelectObject (hdc=0x15010778, h=0x1c30072f) returned 0x1c30072f [0070.384] MoveToEx (in: hdc=0x15010778, x=123, y=34, lppt=0x25a0e80 | out: lppt=0x25a0e80) returned 1 [0070.384] LineTo (hdc=0x15010778, x=123, y=0) returned 1 [0070.384] SetBkMode (hdc=0x15010778, mode=2) returned 1 [0070.384] MoveToEx (in: hdc=0x15010778, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0070.384] SelectObject (hdc=0x15010778, h=0x1b00017) returned 0x1c30072f [0070.384] DeleteObject (ho=0x1c30072f) returned 1 [0070.384] GetROP2 (hdc=0x15010778) returned 13 [0070.384] GetBkMode (hdc=0x15010778) returned 2 [0070.384] SetBkMode (hdc=0x15010778, mode=1) returned 2 [0070.384] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x17300762 [0070.385] SelectObject (hdc=0x15010778, h=0x17300762) returned 0x1b00017 [0070.385] MoveToEx (in: hdc=0x15010778, x=122, y=2, lppt=0x25a0ee8 | out: lppt=0x25a0ee8) returned 1 [0070.385] LineTo (hdc=0x15010778, x=2, y=2) returned 1 [0070.385] SetBkMode (hdc=0x15010778, mode=2) returned 1 [0070.385] MoveToEx (in: hdc=0x15010778, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0070.385] GetROP2 (hdc=0x15010778) returned 13 [0070.385] GetBkMode (hdc=0x15010778) returned 2 [0070.385] SetBkMode (hdc=0x15010778, mode=1) returned 2 [0070.385] SelectObject (hdc=0x15010778, h=0x17300762) returned 0x17300762 [0070.385] MoveToEx (in: hdc=0x15010778, x=2, y=2, lppt=0x25a0f00 | out: lppt=0x25a0f00) returned 1 [0070.385] LineTo (hdc=0x15010778, x=2, y=33) returned 1 [0070.385] SetBkMode (hdc=0x15010778, mode=2) returned 1 [0070.385] MoveToEx (in: hdc=0x15010778, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0070.385] SelectObject (hdc=0x15010778, h=0x1b00017) returned 0x17300762 [0070.385] DeleteObject (ho=0x17300762) returned 1 [0070.385] GetROP2 (hdc=0x15010778) returned 13 [0070.385] GetBkMode (hdc=0x15010778) returned 2 [0070.385] SetBkMode (hdc=0x15010778, mode=1) returned 2 [0070.386] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x1d30072f [0070.386] SelectObject (hdc=0x15010778, h=0x1d30072f) returned 0x1b00017 [0070.386] MoveToEx (in: hdc=0x15010778, x=2, y=33, lppt=0x25a0f68 | out: lppt=0x25a0f68) returned 1 [0070.386] LineTo (hdc=0x15010778, x=122, y=33) returned 1 [0070.386] SetBkMode (hdc=0x15010778, mode=2) returned 1 [0070.386] MoveToEx (in: hdc=0x15010778, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0070.386] GetROP2 (hdc=0x15010778) returned 13 [0070.386] GetBkMode (hdc=0x15010778) returned 2 [0070.386] SetBkMode (hdc=0x15010778, mode=1) returned 2 [0070.386] SelectObject (hdc=0x15010778, h=0x1d30072f) returned 0x1d30072f [0070.386] MoveToEx (in: hdc=0x15010778, x=122, y=33, lppt=0x25a0f80 | out: lppt=0x25a0f80) returned 1 [0070.386] LineTo (hdc=0x15010778, x=122, y=1) returned 1 [0070.386] SetBkMode (hdc=0x15010778, mode=2) returned 1 [0070.386] MoveToEx (in: hdc=0x15010778, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0070.386] SelectObject (hdc=0x15010778, h=0x1b00017) returned 0x1d30072f [0070.386] DeleteObject (ho=0x1d30072f) returned 1 [0070.386] RestoreDC (hdc=0x15010778, nSavedDC=-1) returned 1 [0070.386] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.387] GdipReleaseDC (graphics=0x1c46d570, hdc=0x15010778) returned 0x0 [0070.387] GdipGetDC (graphics=0x1c46d570, hdc=0x43c420) returned 0x0 [0070.387] BitBlt (hdc=0xa0100d0, x=0, y=0, cx=125, cy=36, hdcSrc=0x15010778, x1=0, y1=0, rop=0xcc0020) returned 1 [0070.388] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.388] GdipReleaseDC (graphics=0x1c46d570, hdc=0x15010778) returned 0x0 [0070.388] SelectPalette (hdc=0xa0100d0, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0070.388] SelectObject (hdc=0x15010778, h=0x185000f) returned 0x2905055a [0070.388] DeleteDC (hdc=0x15010778) returned 1 [0070.388] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0070.388] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0070.388] EndPaint (hWnd=0xa01fa, lpPaint=0x43c528) returned 1 [0070.388] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25a0fd8, cPoints=0x1 | out: lpPoints=0x25a0fd8) returned 39715228 [0070.388] WindowFromPoint (Point=0x266000001cd) returned 0xa01fa [0070.388] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26601cd) returned 0x1 [0070.388] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0070.388] NotifyWinEvent (event=0x800c, hwnd=0xa01fa, idObject=-4, idChild=0) [0070.389] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0xfffffffffffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0070.389] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43ce00) returned 0x0 [0070.389] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43ce00) returned 0x0 [0070.469] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x5f84c0 [0070.469] RtlMoveMemory (in: Destination=0x5f84c0, Source=0x2594d08, Length=0x70 | out: Destination=0x5f84c0) [0070.469] ShellExecuteExW (in: pExecInfo=0x25a1af8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25a1af8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0070.586] GetKeyState (nVirtKey=1) returned 1 [0070.586] GetKeyState (nVirtKey=2) returned 0 [0070.587] GetKeyState (nVirtKey=4) returned 0 [0070.587] GetKeyState (nVirtKey=5) returned 0 [0070.587] GetKeyState (nVirtKey=6) returned 0 [0073.334] GetKeyState (nVirtKey=1) returned 1 [0073.334] GetKeyState (nVirtKey=2) returned 0 [0073.334] GetKeyState (nVirtKey=4) returned 0 [0073.334] GetKeyState (nVirtKey=5) returned 0 [0073.334] GetKeyState (nVirtKey=6) returned 0 [0073.399] GetKeyState (nVirtKey=1) returned -128 [0073.399] GetKeyState (nVirtKey=2) returned 0 [0073.399] GetKeyState (nVirtKey=4) returned 0 [0073.399] GetKeyState (nVirtKey=5) returned 0 [0073.399] GetKeyState (nVirtKey=6) returned 0 [0073.399] IsWindowVisible (hWnd=0xa01fa) returned 1 [0073.399] IsWindowEnabled (hWnd=0xa01fa) returned 1 [0073.399] SetFocus (hWnd=0xa01fa) returned 0xa01fa [0073.399] GetFocus () returned 0xa01fa [0073.399] GetFocus () returned 0xa01fa [0073.399] GetFocus () returned 0xa01fa [0073.400] GetKeyState (nVirtKey=1) returned -128 [0073.400] GetKeyState (nVirtKey=2) returned 0 [0073.400] GetKeyState (nVirtKey=4) returned 0 [0073.400] GetKeyState (nVirtKey=5) returned 0 [0073.400] GetKeyState (nVirtKey=6) returned 0 [0073.400] GetCapture () returned 0xa01fa [0073.400] GetKeyState (nVirtKey=1) returned -128 [0073.400] GetKeyState (nVirtKey=2) returned 0 [0073.400] GetKeyState (nVirtKey=4) returned 0 [0073.400] GetKeyState (nVirtKey=5) returned 0 [0073.400] GetKeyState (nVirtKey=6) returned 0 [0073.400] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0073.400] InvalidateRect (hWnd=0xa01fa, lpRect=0x43c330, bErase=0) returned 1 [0073.400] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25a1c48, cPoints=0x1 | out: lpPoints=0x25a1c48) returned 39715228 [0073.400] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0073.400] InvalidateRect (hWnd=0xa01fa, lpRect=0x43c280, bErase=0) returned 1 [0073.400] UpdateWindow (hWnd=0xa01fa) returned 1 [0073.400] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x43b898 | out: lpPaint=0x43b898) returned 0x501071f [0073.400] SelectPalette (hdc=0x501071f, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0073.400] CreateCompatibleDC (hdc=0x501071f) returned 0x9010784 [0073.400] SelectObject (hdc=0x9010784, h=0x2905055a) returned 0x185000f [0073.401] GdipCreateFromHDC (hdc=0x9010784, graphics=0x43b6a0) returned 0x0 [0073.401] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0073.401] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0073.401] GdipCreateMatrix (matrix=0x43b7d0) returned 0x0 [0073.401] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471630) returned 0x0 [0073.401] GdipIsMatrixIdentity (matrix=0x1c471630, result=0x43b830) returned 0x0 [0073.401] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f7cf0 [0073.401] GdipGetMatrixElements (matrix=0x1c471630, matrixOut=0x1f2f7cf0) returned 0x0 [0073.401] LocalFree (hMem=0x1f2f7cf0) returned 0x0 [0073.401] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.401] GdipDeleteMatrix (matrix=0x1c471630) returned 0x0 [0073.401] GdipCreateRegion (region=0x43b7d0) returned 0x0 [0073.401] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0073.401] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43b800) returned 0x0 [0073.401] GdipSaveGraphics (graphics=0x1c46d570, state=0x43b8d0) returned 0x0 [0073.401] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd940dbd) returned 0x0 [0073.401] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.401] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0073.402] GdipGetDC (graphics=0x1c46d570, hdc=0x43acc0) returned 0x0 [0073.402] GetCurrentObject (hdc=0x9010784, type=0x1) returned 0x1b00017 [0073.402] GetCurrentObject (hdc=0x9010784, type=0x2) returned 0x1900010 [0073.403] GetCurrentObject (hdc=0x9010784, type=0x7) returned 0x2905055a [0073.403] GetCurrentObject (hdc=0x9010784, type=0x6) returned 0x18a0048 [0073.403] SaveDC (hdc=0x9010784) returned 1 [0073.403] GetNearestColor (hdc=0x9010784, color=0xf0f0f0) returned 0xf0f0f0 [0073.403] GetNearestColor (hdc=0x9010784, color=0xa0a0a0) returned 0xa0a0a0 [0073.403] GetNearestColor (hdc=0x9010784, color=0x696969) returned 0x696969 [0073.403] GetNearestColor (hdc=0x9010784, color=0xa0a0a0) returned 0xa0a0a0 [0073.403] GetNearestColor (hdc=0x9010784, color=0x0) returned 0x0 [0073.403] GetNearestColor (hdc=0x9010784, color=0xffffff) returned 0xffffff [0073.403] GetNearestColor (hdc=0x9010784, color=0xe5e5e5) returned 0xe5e5e5 [0073.403] GetNearestColor (hdc=0x9010784, color=0xd8d8d8) returned 0xd8d8d8 [0073.403] GetNearestColor (hdc=0x9010784, color=0x0) returned 0x0 [0073.404] RestoreDC (hdc=0x9010784, nSavedDC=-1) returned 1 [0073.404] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.404] GdipReleaseDC (graphics=0x1c46d570, hdc=0x9010784) returned 0x0 [0073.404] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0073.404] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2dc0 [0073.404] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0073.404] CoTaskMemFree (pv=0x1f2f2dc0) [0073.404] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43b3b0) returned 0x0 [0073.404] GdipSetStringFormatAlign (format=0x1c476770, align=0x1) returned 0x0 [0073.404] GdipSetStringFormatLineAlign (format=0x1c476770, align=0x1) returned 0x0 [0073.404] GdipSetStringFormatHotkeyPrefix (format=0x1c476770, hotkeyPrefix=2) returned 0x0 [0073.404] GdipGetStringFormatFlags (format=0x1c476770, flags=0x43b3e0) returned 0x0 [0073.405] GdipGetStringFormatTrimming (format=0x1c476770, trimming=0x43b3e0) returned 0x0 [0073.405] GdipGetStringFormatHotkeyPrefix (format=0x1c476770, hotkeyPrefix=0x43b3e0) returned 0x0 [0073.405] GdipGetFontSize (font=0x1c476770, size=0x43b3e0) returned 0x0 [0073.405] GdipGetFontStyle (font=0x1c476770, style=0x43b3e0) returned 0x0 [0073.405] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.405] GdipDeleteStringFormat (format=0x1c476770) returned 0x0 [0073.405] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0073.405] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2dc0 [0073.405] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0073.405] CoTaskMemFree (pv=0x1f2f2dc0) [0073.405] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43b070) returned 0x0 [0073.405] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43b080) returned 0x0 [0073.406] GdipSetStringFormatFlags (format=0x1c476310, flags=0) returned 0x0 [0073.406] GdipSetStringFormatTrimming (format=0x1c476310, trimming=0x1) returned 0x0 [0073.406] GdipSetStringFormatHotkeyPrefix (format=0x1c476310, hotkeyPrefix=2) returned 0x0 [0073.406] GdipSetStringFormatAlign (format=0x1c476310, align=0x1) returned 0x0 [0073.406] GdipSetStringFormatLineAlign (format=0x1c476310, align=0x1) returned 0x0 [0073.406] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43af98, stringFormat=0x1c476310, boundingBox=0x43af88, codepointsFitted=0x43af84, linesFilled=0x43af80) returned 0x0 [0073.406] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.406] GdipDeleteStringFormat (format=0x1c476310) returned 0x0 [0073.406] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.406] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0073.406] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0073.406] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3240 [0073.406] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0073.406] CoTaskMemFree (pv=0x1f2f3240) [0073.407] GdipCreateRegion (region=0x43afe0) returned 0x0 [0073.407] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0073.407] GdipCreateMatrix (matrix=0x43afe0) returned 0x0 [0073.407] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471730) returned 0x0 [0073.407] GdipIsMatrixIdentity (matrix=0x1c471730, result=0x43b040) returned 0x0 [0073.407] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f82f0 [0073.407] GdipGetMatrixElements (matrix=0x1c471730, matrixOut=0x1f2f82f0) returned 0x0 [0073.407] LocalFree (hMem=0x1f2f82f0) returned 0x0 [0073.407] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f82f0 [0073.407] GdipGetMatrixElements (matrix=0x1c471730, matrixOut=0x1f2f82f0) returned 0x0 [0073.407] LocalFree (hMem=0x1f2f82f0) returned 0x0 [0073.407] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.407] GdipDeleteMatrix (matrix=0x1c471730) returned 0x0 [0073.407] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43b090) returned 0x0 [0073.407] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43b050) returned 0x0 [0073.407] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43b050) returned 0x0 [0073.408] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.408] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0073.408] GdipGetDC (graphics=0x1c46d570, hdc=0x43b0c0) returned 0x0 [0073.408] GetCurrentObject (hdc=0x9010784, type=0x1) returned 0x1b00017 [0073.408] GetCurrentObject (hdc=0x9010784, type=0x2) returned 0x1900010 [0073.408] GetCurrentObject (hdc=0x9010784, type=0x7) returned 0x2905055a [0073.408] GetCurrentObject (hdc=0x9010784, type=0x6) returned 0x18a0048 [0073.408] SaveDC (hdc=0x9010784) returned 1 [0073.408] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4f0406cc [0073.408] GetClipRgn (hdc=0x9010784, hrgn=0x4f0406cc) returned 0 [0073.408] SelectClipRgn (hdc=0x9010784, hrgn=0x490405d8) returned 2 [0073.408] DeleteObject (ho=0x4f0406cc) returned 1 [0073.408] DeleteObject (ho=0x490405d8) returned 1 [0073.408] OffsetViewportOrgEx (in: hdc=0x9010784, x=0, y=0, lppt=0x25a28c8 | out: lppt=0x25a28c8) returned 1 [0073.408] GetNearestColor (hdc=0x9010784, color=0xf0f0f0) returned 0xf0f0f0 [0073.409] CreateSolidBrush (color=0xf0f0f0) returned 0x1610075d [0073.409] FillRect (hDC=0x9010784, lprc=0x43b090, hbr=0x1610075d) returned 1 [0073.409] DeleteObject (ho=0x1610075d) returned 1 [0073.409] RestoreDC (hdc=0x9010784, nSavedDC=-1) returned 1 [0073.409] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.409] GdipReleaseDC (graphics=0x1c46d570, hdc=0x9010784) returned 0x0 [0073.409] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0073.409] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2fa0 [0073.410] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0073.410] CoTaskMemFree (pv=0x1f2f2fa0) [0073.410] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43b110) returned 0x0 [0073.410] GdipSetStringFormatAlign (format=0x1c4767e0, align=0x1) returned 0x0 [0073.410] GdipSetStringFormatLineAlign (format=0x1c4767e0, align=0x1) returned 0x0 [0073.410] GdipSetStringFormatHotkeyPrefix (format=0x1c4767e0, hotkeyPrefix=2) returned 0x0 [0073.410] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x43b180) returned 0x0 [0073.410] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43b090, stringFormat=0x1c4767e0, brush=0x1c46cce0) returned 0x0 [0073.410] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.410] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0073.410] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.410] GdipDeleteStringFormat (format=0x1c4767e0) returned 0x0 [0073.410] GetFocus () returned 0xa01fa [0073.411] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0073.411] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3300 [0073.411] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0073.411] CoTaskMemFree (pv=0x1f2f3300) [0073.411] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x43b470) returned 0x0 [0073.411] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0073.411] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.411] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0073.411] GdipCreateRegion (region=0x43af40) returned 0x0 [0073.411] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0073.411] GdipCreateMatrix (matrix=0x43af40) returned 0x0 [0073.411] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4710b0) returned 0x0 [0073.411] GdipIsMatrixIdentity (matrix=0x1c4710b0, result=0x43afa0) returned 0x0 [0073.412] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f8630 [0073.412] GdipGetMatrixElements (matrix=0x1c4710b0, matrixOut=0x1f2f8630) returned 0x0 [0073.412] LocalFree (hMem=0x1f2f8630) returned 0x0 [0073.412] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f80b0 [0073.412] GdipGetMatrixElements (matrix=0x1c4710b0, matrixOut=0x1f2f80b0) returned 0x0 [0073.412] LocalFree (hMem=0x1f2f80b0) returned 0x0 [0073.412] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.412] GdipDeleteMatrix (matrix=0x1c4710b0) returned 0x0 [0073.412] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43aff0) returned 0x0 [0073.412] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43afb0) returned 0x0 [0073.412] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43afb0) returned 0x0 [0073.412] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.412] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0073.412] GdipGetDC (graphics=0x1c46d570, hdc=0x43b020) returned 0x0 [0073.412] GetCurrentObject (hdc=0x9010784, type=0x1) returned 0x1b00017 [0073.412] GetCurrentObject (hdc=0x9010784, type=0x2) returned 0x1900010 [0073.412] GetCurrentObject (hdc=0x9010784, type=0x7) returned 0x2905055a [0073.412] GetCurrentObject (hdc=0x9010784, type=0x6) returned 0x18a0048 [0073.412] SaveDC (hdc=0x9010784) returned 1 [0073.413] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4a0405d8 [0073.413] GetClipRgn (hdc=0x9010784, hrgn=0x4a0405d8) returned 0 [0073.413] SelectClipRgn (hdc=0x9010784, hrgn=0x500406cc) returned 2 [0073.413] DeleteObject (ho=0x4a0405d8) returned 1 [0073.413] DeleteObject (ho=0x500406cc) returned 1 [0073.413] OffsetViewportOrgEx (in: hdc=0x9010784, x=0, y=0, lppt=0x25a2e68 | out: lppt=0x25a2e68) returned 1 [0073.413] GetROP2 (hdc=0x9010784) returned 13 [0073.413] GetBkMode (hdc=0x9010784) returned 2 [0073.413] SetBkMode (hdc=0x9010784, mode=1) returned 2 [0073.413] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x930075a [0073.413] SelectObject (hdc=0x9010784, h=0x930075a) returned 0x1b00017 [0073.413] MoveToEx (in: hdc=0x9010784, x=123, y=1, lppt=0x25a2ed0 | out: lppt=0x25a2ed0) returned 1 [0073.413] LineTo (hdc=0x9010784, x=1, y=1) returned 1 [0073.413] SetBkMode (hdc=0x9010784, mode=2) returned 1 [0073.413] MoveToEx (in: hdc=0x9010784, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0073.413] GetROP2 (hdc=0x9010784) returned 13 [0073.413] GetBkMode (hdc=0x9010784) returned 2 [0073.413] SetBkMode (hdc=0x9010784, mode=1) returned 2 [0073.413] SelectObject (hdc=0x9010784, h=0x930075a) returned 0x930075a [0073.413] MoveToEx (in: hdc=0x9010784, x=1, y=1, lppt=0x25a2ee8 | out: lppt=0x25a2ee8) returned 1 [0073.414] LineTo (hdc=0x9010784, x=1, y=34) returned 1 [0073.414] SetBkMode (hdc=0x9010784, mode=2) returned 1 [0073.414] MoveToEx (in: hdc=0x9010784, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0073.414] SelectObject (hdc=0x9010784, h=0x1b00017) returned 0x930075a [0073.414] DeleteObject (ho=0x930075a) returned 1 [0073.414] GetROP2 (hdc=0x9010784) returned 13 [0073.414] GetBkMode (hdc=0x9010784) returned 2 [0073.414] SetBkMode (hdc=0x9010784, mode=1) returned 2 [0073.414] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xd30075c [0073.414] SelectObject (hdc=0x9010784, h=0xd30075c) returned 0x1b00017 [0073.414] MoveToEx (in: hdc=0x9010784, x=1, y=34, lppt=0x25a2f50 | out: lppt=0x25a2f50) returned 1 [0073.414] LineTo (hdc=0x9010784, x=123, y=34) returned 1 [0073.414] SetBkMode (hdc=0x9010784, mode=2) returned 1 [0073.414] MoveToEx (in: hdc=0x9010784, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0073.414] GetROP2 (hdc=0x9010784) returned 13 [0073.414] GetBkMode (hdc=0x9010784) returned 2 [0073.414] SetBkMode (hdc=0x9010784, mode=1) returned 2 [0073.414] SelectObject (hdc=0x9010784, h=0xd30075c) returned 0xd30075c [0073.414] MoveToEx (in: hdc=0x9010784, x=123, y=34, lppt=0x25a2f68 | out: lppt=0x25a2f68) returned 1 [0073.414] LineTo (hdc=0x9010784, x=123, y=0) returned 1 [0073.414] SetBkMode (hdc=0x9010784, mode=2) returned 1 [0073.414] MoveToEx (in: hdc=0x9010784, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0073.414] SelectObject (hdc=0x9010784, h=0x1b00017) returned 0xd30075c [0073.415] DeleteObject (ho=0xd30075c) returned 1 [0073.415] GetROP2 (hdc=0x9010784) returned 13 [0073.415] GetBkMode (hdc=0x9010784) returned 2 [0073.415] SetBkMode (hdc=0x9010784, mode=1) returned 2 [0073.415] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xa30075a [0073.415] SelectObject (hdc=0x9010784, h=0xa30075a) returned 0x1b00017 [0073.415] MoveToEx (in: hdc=0x9010784, x=122, y=2, lppt=0x25a2fd0 | out: lppt=0x25a2fd0) returned 1 [0073.415] LineTo (hdc=0x9010784, x=2, y=2) returned 1 [0073.415] SetBkMode (hdc=0x9010784, mode=2) returned 1 [0073.415] MoveToEx (in: hdc=0x9010784, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0073.415] GetROP2 (hdc=0x9010784) returned 13 [0073.415] GetBkMode (hdc=0x9010784) returned 2 [0073.415] SetBkMode (hdc=0x9010784, mode=1) returned 2 [0073.415] SelectObject (hdc=0x9010784, h=0xa30075a) returned 0xa30075a [0073.415] MoveToEx (in: hdc=0x9010784, x=2, y=2, lppt=0x25a2fe8 | out: lppt=0x25a2fe8) returned 1 [0073.415] LineTo (hdc=0x9010784, x=2, y=33) returned 1 [0073.415] SetBkMode (hdc=0x9010784, mode=2) returned 1 [0073.415] MoveToEx (in: hdc=0x9010784, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0073.415] SelectObject (hdc=0x9010784, h=0x1b00017) returned 0xa30075a [0073.415] DeleteObject (ho=0xa30075a) returned 1 [0073.415] GetROP2 (hdc=0x9010784) returned 13 [0073.416] GetBkMode (hdc=0x9010784) returned 2 [0073.416] SetBkMode (hdc=0x9010784, mode=1) returned 2 [0073.416] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xe30075c [0073.416] SelectObject (hdc=0x9010784, h=0xe30075c) returned 0x1b00017 [0073.416] MoveToEx (in: hdc=0x9010784, x=2, y=33, lppt=0x25a3050 | out: lppt=0x25a3050) returned 1 [0073.416] LineTo (hdc=0x9010784, x=122, y=33) returned 1 [0073.416] SetBkMode (hdc=0x9010784, mode=2) returned 1 [0073.416] MoveToEx (in: hdc=0x9010784, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0073.416] GetROP2 (hdc=0x9010784) returned 13 [0073.416] GetBkMode (hdc=0x9010784) returned 2 [0073.416] SetBkMode (hdc=0x9010784, mode=1) returned 2 [0073.416] SelectObject (hdc=0x9010784, h=0xe30075c) returned 0xe30075c [0073.416] MoveToEx (in: hdc=0x9010784, x=122, y=33, lppt=0x25a3068 | out: lppt=0x25a3068) returned 1 [0073.416] LineTo (hdc=0x9010784, x=122, y=1) returned 1 [0073.416] SetBkMode (hdc=0x9010784, mode=2) returned 1 [0073.416] MoveToEx (in: hdc=0x9010784, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0073.416] SelectObject (hdc=0x9010784, h=0x1b00017) returned 0xe30075c [0073.416] DeleteObject (ho=0xe30075c) returned 1 [0073.416] RestoreDC (hdc=0x9010784, nSavedDC=-1) returned 1 [0073.416] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.416] GdipReleaseDC (graphics=0x1c46d570, hdc=0x9010784) returned 0x0 [0073.416] GdipGetDC (graphics=0x1c46d570, hdc=0x43b7a0) returned 0x0 [0073.417] BitBlt (hdc=0x501071f, x=0, y=0, cx=125, cy=36, hdcSrc=0x9010784, x1=0, y1=0, rop=0xcc0020) returned 1 [0073.417] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.417] GdipReleaseDC (graphics=0x1c46d570, hdc=0x9010784) returned 0x0 [0073.418] SelectPalette (hdc=0x501071f, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0073.418] SelectObject (hdc=0x9010784, h=0x185000f) returned 0x2905055a [0073.418] DeleteDC (hdc=0x9010784) returned 1 [0073.418] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0073.418] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0073.418] EndPaint (hWnd=0xa01fa, lpPaint=0x43b8a8) returned 1 [0073.418] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25a30c0, cPoints=0x1 | out: lpPoints=0x25a30c0) returned 39715228 [0073.418] WindowFromPoint (Point=0x26e000001d9) returned 0xa01fa [0073.418] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26e01d9) returned 0x1 [0073.418] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0073.418] NotifyWinEvent (event=0x800c, hwnd=0xa01fa, idObject=-4, idChild=0) [0073.418] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0xfffffffffffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0073.418] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43c180) returned 0x0 [0073.418] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43c180) returned 0x0 [0073.429] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x5f88c0 [0073.429] RtlMoveMemory (in: Destination=0x5f88c0, Source=0x2594d08, Length=0x70 | out: Destination=0x5f88c0) [0073.429] ShellExecuteExW (in: pExecInfo=0x25a3d40*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25a3d40*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0076.381] GetKeyState (nVirtKey=1) returned 0 [0076.381] GetKeyState (nVirtKey=2) returned 0 [0076.381] GetKeyState (nVirtKey=4) returned 0 [0076.381] GetKeyState (nVirtKey=5) returned 0 [0076.381] GetKeyState (nVirtKey=6) returned 0 [0076.499] GetKeyState (nVirtKey=1) returned -127 [0076.499] GetKeyState (nVirtKey=2) returned 0 [0076.499] GetKeyState (nVirtKey=4) returned 0 [0076.499] GetKeyState (nVirtKey=5) returned 0 [0076.499] GetKeyState (nVirtKey=6) returned 0 [0076.499] IsWindowVisible (hWnd=0xa01fa) returned 1 [0076.499] IsWindowEnabled (hWnd=0xa01fa) returned 1 [0076.499] SetFocus (hWnd=0xa01fa) returned 0xa01fa [0076.499] GetFocus () returned 0xa01fa [0076.499] GetFocus () returned 0xa01fa [0076.499] GetFocus () returned 0xa01fa [0076.499] GetKeyState (nVirtKey=1) returned -127 [0076.499] GetKeyState (nVirtKey=2) returned 0 [0076.499] GetKeyState (nVirtKey=4) returned 0 [0076.499] GetKeyState (nVirtKey=5) returned 0 [0076.499] GetKeyState (nVirtKey=6) returned 0 [0076.499] GetCapture () returned 0xa01fa [0076.499] GetKeyState (nVirtKey=1) returned -127 [0076.499] GetKeyState (nVirtKey=2) returned 0 [0076.499] GetKeyState (nVirtKey=4) returned 0 [0076.499] GetKeyState (nVirtKey=5) returned 0 [0076.499] GetKeyState (nVirtKey=6) returned 0 [0076.499] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0076.499] InvalidateRect (hWnd=0xa01fa, lpRect=0x43b6b0, bErase=0) returned 1 [0076.499] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25a3e68, cPoints=0x1 | out: lpPoints=0x25a3e68) returned 39715228 [0076.500] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0076.500] InvalidateRect (hWnd=0xa01fa, lpRect=0x43b600, bErase=0) returned 1 [0076.500] UpdateWindow (hWnd=0xa01fa) returned 1 [0076.500] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x43ac18 | out: lpPaint=0x43ac18) returned 0x10105c2 [0076.500] SelectPalette (hdc=0x10105c2, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0076.500] CreateCompatibleDC (hdc=0x10105c2) returned 0x23010789 [0076.500] SelectObject (hdc=0x23010789, h=0x2905055a) returned 0x185000f [0076.500] GdipCreateFromHDC (hdc=0x23010789, graphics=0x43aa20) returned 0x0 [0076.500] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0076.500] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0076.502] GdipCreateMatrix (matrix=0x43ab50) returned 0x0 [0076.502] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4711f0) returned 0x0 [0076.502] GdipIsMatrixIdentity (matrix=0x1c4711f0, result=0x43abb0) returned 0x0 [0076.502] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f7a30 [0076.502] GdipGetMatrixElements (matrix=0x1c4711f0, matrixOut=0x1f2f7a30) returned 0x0 [0076.502] LocalFree (hMem=0x1f2f7a30) returned 0x0 [0076.502] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.502] GdipDeleteMatrix (matrix=0x1c4711f0) returned 0x0 [0076.502] GdipCreateRegion (region=0x43ab50) returned 0x0 [0076.502] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0076.502] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43ab80) returned 0x0 [0076.502] GdipSaveGraphics (graphics=0x1c46d570, state=0x43ac50) returned 0x0 [0076.502] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd910dbd) returned 0x0 [0076.502] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.502] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0076.503] GdipGetDC (graphics=0x1c46d570, hdc=0x43a040) returned 0x0 [0076.503] GetCurrentObject (hdc=0x23010789, type=0x1) returned 0x1b00017 [0076.503] GetCurrentObject (hdc=0x23010789, type=0x2) returned 0x1900010 [0076.503] GetCurrentObject (hdc=0x23010789, type=0x7) returned 0x2905055a [0076.503] GetCurrentObject (hdc=0x23010789, type=0x6) returned 0x18a0048 [0076.503] SaveDC (hdc=0x23010789) returned 1 [0076.503] GetNearestColor (hdc=0x23010789, color=0xf0f0f0) returned 0xf0f0f0 [0076.503] GetNearestColor (hdc=0x23010789, color=0xa0a0a0) returned 0xa0a0a0 [0076.503] GetNearestColor (hdc=0x23010789, color=0x696969) returned 0x696969 [0076.503] GetNearestColor (hdc=0x23010789, color=0xa0a0a0) returned 0xa0a0a0 [0076.503] GetNearestColor (hdc=0x23010789, color=0x0) returned 0x0 [0076.504] GetNearestColor (hdc=0x23010789, color=0xffffff) returned 0xffffff [0076.504] GetNearestColor (hdc=0x23010789, color=0xe5e5e5) returned 0xe5e5e5 [0076.504] GetNearestColor (hdc=0x23010789, color=0xd8d8d8) returned 0xd8d8d8 [0076.504] GetNearestColor (hdc=0x23010789, color=0x0) returned 0x0 [0076.504] RestoreDC (hdc=0x23010789, nSavedDC=-1) returned 1 [0076.504] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.504] GdipReleaseDC (graphics=0x1c46d570, hdc=0x23010789) returned 0x0 [0076.504] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0076.505] CoTaskMemAlloc (cb=0x13) returned 0x1f2f26e0 [0076.505] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0076.505] CoTaskMemFree (pv=0x1f2f26e0) [0076.505] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43a730) returned 0x0 [0076.505] GdipSetStringFormatAlign (format=0x1c475c10, align=0x1) returned 0x0 [0076.505] GdipSetStringFormatLineAlign (format=0x1c475c10, align=0x1) returned 0x0 [0076.505] GdipSetStringFormatHotkeyPrefix (format=0x1c475c10, hotkeyPrefix=2) returned 0x0 [0076.505] GdipGetStringFormatFlags (format=0x1c475c10, flags=0x43a760) returned 0x0 [0076.505] GdipGetStringFormatTrimming (format=0x1c475c10, trimming=0x43a760) returned 0x0 [0076.505] GdipGetStringFormatHotkeyPrefix (format=0x1c475c10, hotkeyPrefix=0x43a760) returned 0x0 [0076.505] GdipGetFontSize (font=0x1c475c10, size=0x43a760) returned 0x0 [0076.505] GdipGetFontStyle (font=0x1c475c10, style=0x43a760) returned 0x0 [0076.505] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.505] GdipDeleteStringFormat (format=0x1c475c10) returned 0x0 [0076.506] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0076.506] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2c60 [0076.506] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0076.506] CoTaskMemFree (pv=0x1f2f2c60) [0076.506] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43a3f0) returned 0x0 [0076.506] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43a400) returned 0x0 [0076.506] GdipSetStringFormatFlags (format=0x1c476150, flags=0) returned 0x0 [0076.506] GdipSetStringFormatTrimming (format=0x1c476150, trimming=0x1) returned 0x0 [0076.506] GdipSetStringFormatHotkeyPrefix (format=0x1c476150, hotkeyPrefix=2) returned 0x0 [0076.506] GdipSetStringFormatAlign (format=0x1c476150, align=0x1) returned 0x0 [0076.506] GdipSetStringFormatLineAlign (format=0x1c476150, align=0x1) returned 0x0 [0076.506] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43a318, stringFormat=0x1c476150, boundingBox=0x43a308, codepointsFitted=0x43a304, linesFilled=0x43a300) returned 0x0 [0076.506] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.506] GdipDeleteStringFormat (format=0x1c476150) returned 0x0 [0076.507] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.507] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0076.507] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0076.507] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2c60 [0076.507] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0076.507] CoTaskMemFree (pv=0x1f2f2c60) [0076.507] GdipCreateRegion (region=0x43a360) returned 0x0 [0076.507] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0076.507] GdipCreateMatrix (matrix=0x43a360) returned 0x0 [0076.507] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471430) returned 0x0 [0076.507] GdipIsMatrixIdentity (matrix=0x1c471430, result=0x43a3c0) returned 0x0 [0076.507] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f7df0 [0076.507] GdipGetMatrixElements (matrix=0x1c471430, matrixOut=0x1f2f7df0) returned 0x0 [0076.508] LocalFree (hMem=0x1f2f7df0) returned 0x0 [0076.508] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f7df0 [0076.508] GdipGetMatrixElements (matrix=0x1c471430, matrixOut=0x1f2f7df0) returned 0x0 [0076.508] LocalFree (hMem=0x1f2f7df0) returned 0x0 [0076.508] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.508] GdipDeleteMatrix (matrix=0x1c471430) returned 0x0 [0076.508] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43a410) returned 0x0 [0076.508] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43a3d0) returned 0x0 [0076.508] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43a3d0) returned 0x0 [0076.508] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.508] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0076.508] GdipGetDC (graphics=0x1c46d570, hdc=0x43a440) returned 0x0 [0076.508] GetCurrentObject (hdc=0x23010789, type=0x1) returned 0x1b00017 [0076.508] GetCurrentObject (hdc=0x23010789, type=0x2) returned 0x1900010 [0076.508] GetCurrentObject (hdc=0x23010789, type=0x7) returned 0x2905055a [0076.508] GetCurrentObject (hdc=0x23010789, type=0x6) returned 0x18a0048 [0076.508] SaveDC (hdc=0x23010789) returned 1 [0076.508] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x510406cc [0076.508] GetClipRgn (hdc=0x23010789, hrgn=0x510406cc) returned 0 [0076.508] SelectClipRgn (hdc=0x23010789, hrgn=0x4b0405d8) returned 2 [0076.508] DeleteObject (ho=0x510406cc) returned 1 [0076.509] DeleteObject (ho=0x4b0405d8) returned 1 [0076.509] OffsetViewportOrgEx (in: hdc=0x23010789, x=0, y=0, lppt=0x25a4ae8 | out: lppt=0x25a4ae8) returned 1 [0076.509] GetNearestColor (hdc=0x23010789, color=0xf0f0f0) returned 0xf0f0f0 [0076.509] CreateSolidBrush (color=0xf0f0f0) returned 0x1710075d [0076.509] FillRect (hDC=0x23010789, lprc=0x43a410, hbr=0x1710075d) returned 1 [0076.509] DeleteObject (ho=0x1710075d) returned 1 [0076.509] RestoreDC (hdc=0x23010789, nSavedDC=-1) returned 1 [0076.509] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.509] GdipReleaseDC (graphics=0x1c46d570, hdc=0x23010789) returned 0x0 [0076.509] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0076.509] CoTaskMemAlloc (cb=0x13) returned 0x1f2f25a0 [0076.509] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0076.510] CoTaskMemFree (pv=0x1f2f25a0) [0076.510] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43a490) returned 0x0 [0076.510] GdipSetStringFormatAlign (format=0x1c475d60, align=0x1) returned 0x0 [0076.510] GdipSetStringFormatLineAlign (format=0x1c475d60, align=0x1) returned 0x0 [0076.510] GdipSetStringFormatHotkeyPrefix (format=0x1c475d60, hotkeyPrefix=2) returned 0x0 [0076.510] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x43a500) returned 0x0 [0076.510] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43a410, stringFormat=0x1c475d60, brush=0x1c46cce0) returned 0x0 [0076.510] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.510] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0076.510] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.510] GdipDeleteStringFormat (format=0x1c475d60) returned 0x0 [0076.510] GetFocus () returned 0xa01fa [0076.510] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0076.510] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2700 [0076.511] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0076.511] CoTaskMemFree (pv=0x1f2f2700) [0076.511] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x43a7f0) returned 0x0 [0076.511] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0076.511] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.511] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0076.511] GdipCreateRegion (region=0x43a2c0) returned 0x0 [0076.511] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0076.511] GdipCreateMatrix (matrix=0x43a2c0) returned 0x0 [0076.511] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471530) returned 0x0 [0076.511] GdipIsMatrixIdentity (matrix=0x1c471530, result=0x43a320) returned 0x0 [0076.511] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f85b0 [0076.511] GdipGetMatrixElements (matrix=0x1c471530, matrixOut=0x1f2f85b0) returned 0x0 [0076.511] LocalFree (hMem=0x1f2f85b0) returned 0x0 [0076.511] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f7c30 [0076.511] GdipGetMatrixElements (matrix=0x1c471530, matrixOut=0x1f2f7c30) returned 0x0 [0076.511] LocalFree (hMem=0x1f2f7c30) returned 0x0 [0076.511] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.511] GdipDeleteMatrix (matrix=0x1c471530) returned 0x0 [0076.511] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43a370) returned 0x0 [0076.511] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43a330) returned 0x0 [0076.511] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43a330) returned 0x0 [0076.512] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.512] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0076.512] GdipGetDC (graphics=0x1c46d570, hdc=0x43a3a0) returned 0x0 [0076.512] GetCurrentObject (hdc=0x23010789, type=0x1) returned 0x1b00017 [0076.512] GetCurrentObject (hdc=0x23010789, type=0x2) returned 0x1900010 [0076.512] GetCurrentObject (hdc=0x23010789, type=0x7) returned 0x2905055a [0076.512] GetCurrentObject (hdc=0x23010789, type=0x6) returned 0x18a0048 [0076.512] SaveDC (hdc=0x23010789) returned 1 [0076.512] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4c0405d8 [0076.512] GetClipRgn (hdc=0x23010789, hrgn=0x4c0405d8) returned 0 [0076.512] SelectClipRgn (hdc=0x23010789, hrgn=0x520406cc) returned 2 [0076.512] DeleteObject (ho=0x4c0405d8) returned 1 [0076.512] DeleteObject (ho=0x520406cc) returned 1 [0076.512] OffsetViewportOrgEx (in: hdc=0x23010789, x=0, y=0, lppt=0x25a5088 | out: lppt=0x25a5088) returned 1 [0076.512] GetROP2 (hdc=0x23010789) returned 13 [0076.512] GetBkMode (hdc=0x23010789) returned 2 [0076.512] SetBkMode (hdc=0x23010789, mode=1) returned 2 [0076.512] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x330078e [0076.512] SelectObject (hdc=0x23010789, h=0x330078e) returned 0x1b00017 [0076.513] MoveToEx (in: hdc=0x23010789, x=123, y=1, lppt=0x25a50f0 | out: lppt=0x25a50f0) returned 1 [0076.513] LineTo (hdc=0x23010789, x=1, y=1) returned 1 [0076.513] SetBkMode (hdc=0x23010789, mode=2) returned 1 [0076.513] MoveToEx (in: hdc=0x23010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0076.513] GetROP2 (hdc=0x23010789) returned 13 [0076.513] GetBkMode (hdc=0x23010789) returned 2 [0076.513] SetBkMode (hdc=0x23010789, mode=1) returned 2 [0076.513] SelectObject (hdc=0x23010789, h=0x330078e) returned 0x330078e [0076.513] MoveToEx (in: hdc=0x23010789, x=1, y=1, lppt=0x25a5108 | out: lppt=0x25a5108) returned 1 [0076.513] LineTo (hdc=0x23010789, x=1, y=34) returned 1 [0076.513] SetBkMode (hdc=0x23010789, mode=2) returned 1 [0076.513] MoveToEx (in: hdc=0x23010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0076.513] SelectObject (hdc=0x23010789, h=0x1b00017) returned 0x330078e [0076.513] DeleteObject (ho=0x330078e) returned 1 [0076.513] GetROP2 (hdc=0x23010789) returned 13 [0076.513] GetBkMode (hdc=0x23010789) returned 2 [0076.513] SetBkMode (hdc=0x23010789, mode=1) returned 2 [0076.513] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x130078f [0076.513] SelectObject (hdc=0x23010789, h=0x130078f) returned 0x1b00017 [0076.513] MoveToEx (in: hdc=0x23010789, x=1, y=34, lppt=0x25a5170 | out: lppt=0x25a5170) returned 1 [0076.513] LineTo (hdc=0x23010789, x=123, y=34) returned 1 [0076.513] SetBkMode (hdc=0x23010789, mode=2) returned 1 [0076.513] MoveToEx (in: hdc=0x23010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0076.513] GetROP2 (hdc=0x23010789) returned 13 [0076.513] GetBkMode (hdc=0x23010789) returned 2 [0076.514] SetBkMode (hdc=0x23010789, mode=1) returned 2 [0076.514] SelectObject (hdc=0x23010789, h=0x130078f) returned 0x130078f [0076.514] MoveToEx (in: hdc=0x23010789, x=123, y=34, lppt=0x25a5188 | out: lppt=0x25a5188) returned 1 [0076.514] LineTo (hdc=0x23010789, x=123, y=0) returned 1 [0076.514] SetBkMode (hdc=0x23010789, mode=2) returned 1 [0076.514] MoveToEx (in: hdc=0x23010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0076.514] SelectObject (hdc=0x23010789, h=0x1b00017) returned 0x130078f [0076.514] DeleteObject (ho=0x130078f) returned 1 [0076.514] GetROP2 (hdc=0x23010789) returned 13 [0076.514] GetBkMode (hdc=0x23010789) returned 2 [0076.514] SetBkMode (hdc=0x23010789, mode=1) returned 2 [0076.514] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x430078e [0076.514] SelectObject (hdc=0x23010789, h=0x430078e) returned 0x1b00017 [0076.514] MoveToEx (in: hdc=0x23010789, x=122, y=2, lppt=0x25a51f0 | out: lppt=0x25a51f0) returned 1 [0076.514] LineTo (hdc=0x23010789, x=2, y=2) returned 1 [0076.514] SetBkMode (hdc=0x23010789, mode=2) returned 1 [0076.514] MoveToEx (in: hdc=0x23010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0076.514] GetROP2 (hdc=0x23010789) returned 13 [0076.514] GetBkMode (hdc=0x23010789) returned 2 [0076.514] SetBkMode (hdc=0x23010789, mode=1) returned 2 [0076.514] SelectObject (hdc=0x23010789, h=0x430078e) returned 0x430078e [0076.514] MoveToEx (in: hdc=0x23010789, x=2, y=2, lppt=0x25a5208 | out: lppt=0x25a5208) returned 1 [0076.514] LineTo (hdc=0x23010789, x=2, y=33) returned 1 [0076.514] SetBkMode (hdc=0x23010789, mode=2) returned 1 [0076.515] MoveToEx (in: hdc=0x23010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0076.515] SelectObject (hdc=0x23010789, h=0x1b00017) returned 0x430078e [0076.515] DeleteObject (ho=0x430078e) returned 1 [0076.515] GetROP2 (hdc=0x23010789) returned 13 [0076.515] GetBkMode (hdc=0x23010789) returned 2 [0076.515] SetBkMode (hdc=0x23010789, mode=1) returned 2 [0076.515] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x230078f [0076.515] SelectObject (hdc=0x23010789, h=0x230078f) returned 0x1b00017 [0076.515] MoveToEx (in: hdc=0x23010789, x=2, y=33, lppt=0x25a5270 | out: lppt=0x25a5270) returned 1 [0076.515] LineTo (hdc=0x23010789, x=122, y=33) returned 1 [0076.515] SetBkMode (hdc=0x23010789, mode=2) returned 1 [0076.515] MoveToEx (in: hdc=0x23010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0076.515] GetROP2 (hdc=0x23010789) returned 13 [0076.515] GetBkMode (hdc=0x23010789) returned 2 [0076.515] SetBkMode (hdc=0x23010789, mode=1) returned 2 [0076.515] SelectObject (hdc=0x23010789, h=0x230078f) returned 0x230078f [0076.515] MoveToEx (in: hdc=0x23010789, x=122, y=33, lppt=0x25a5288 | out: lppt=0x25a5288) returned 1 [0076.515] LineTo (hdc=0x23010789, x=122, y=1) returned 1 [0076.515] SetBkMode (hdc=0x23010789, mode=2) returned 1 [0076.515] MoveToEx (in: hdc=0x23010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0076.515] SelectObject (hdc=0x23010789, h=0x1b00017) returned 0x230078f [0076.515] DeleteObject (ho=0x230078f) returned 1 [0076.515] RestoreDC (hdc=0x23010789, nSavedDC=-1) returned 1 [0076.516] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.516] GdipReleaseDC (graphics=0x1c46d570, hdc=0x23010789) returned 0x0 [0076.516] GdipGetDC (graphics=0x1c46d570, hdc=0x43ab20) returned 0x0 [0076.516] BitBlt (hdc=0x10105c2, x=0, y=0, cx=125, cy=36, hdcSrc=0x23010789, x1=0, y1=0, rop=0xcc0020) returned 1 [0076.520] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.520] GdipReleaseDC (graphics=0x1c46d570, hdc=0x23010789) returned 0x0 [0076.520] SelectPalette (hdc=0x10105c2, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0076.520] SelectObject (hdc=0x23010789, h=0x185000f) returned 0x2905055a [0076.520] DeleteDC (hdc=0x23010789) returned 1 [0076.520] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0076.520] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0076.520] EndPaint (hWnd=0xa01fa, lpPaint=0x43ac28) returned 1 [0076.521] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25a52e0, cPoints=0x1 | out: lpPoints=0x25a52e0) returned 39715228 [0076.521] WindowFromPoint (Point=0x26c000001e5) returned 0xa01fa [0076.521] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26c01e5) returned 0x1 [0076.521] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0076.521] NotifyWinEvent (event=0x800c, hwnd=0xa01fa, idObject=-4, idChild=0) [0076.521] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0xfffffffffffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0076.521] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43b500) returned 0x0 [0076.521] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43b500) returned 0x0 [0076.535] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x5f9540 [0076.535] RtlMoveMemory (in: Destination=0x5f9540, Source=0x2594d08, Length=0x70 | out: Destination=0x5f9540) [0076.535] ShellExecuteExW (in: pExecInfo=0x25a6120*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25a6120*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0078.342] GetKeyState (nVirtKey=1) returned 1 [0078.342] GetKeyState (nVirtKey=2) returned 0 [0078.342] GetKeyState (nVirtKey=4) returned 0 [0078.342] GetKeyState (nVirtKey=5) returned 0 [0078.342] GetKeyState (nVirtKey=6) returned 0 [0079.404] GetKeyState (nVirtKey=1) returned 1 [0079.404] GetKeyState (nVirtKey=2) returned 0 [0079.404] GetKeyState (nVirtKey=4) returned 0 [0079.404] GetKeyState (nVirtKey=5) returned 0 [0079.404] GetKeyState (nVirtKey=6) returned 0 [0079.486] GetKeyState (nVirtKey=1) returned -128 [0079.486] GetKeyState (nVirtKey=2) returned 0 [0079.486] GetKeyState (nVirtKey=4) returned 0 [0079.486] GetKeyState (nVirtKey=5) returned 0 [0079.486] GetKeyState (nVirtKey=6) returned 0 [0079.486] IsWindowVisible (hWnd=0xa01fa) returned 1 [0079.486] IsWindowEnabled (hWnd=0xa01fa) returned 1 [0079.486] SetFocus (hWnd=0xa01fa) returned 0xa01fa [0079.486] GetFocus () returned 0xa01fa [0079.487] GetFocus () returned 0xa01fa [0079.487] GetFocus () returned 0xa01fa [0079.487] GetKeyState (nVirtKey=1) returned -128 [0079.487] GetKeyState (nVirtKey=2) returned 0 [0079.487] GetKeyState (nVirtKey=4) returned 0 [0079.487] GetKeyState (nVirtKey=5) returned 0 [0079.487] GetKeyState (nVirtKey=6) returned 0 [0079.487] GetCapture () returned 0xa01fa [0079.487] GetKeyState (nVirtKey=1) returned -128 [0079.487] GetKeyState (nVirtKey=2) returned 0 [0079.487] GetKeyState (nVirtKey=4) returned 0 [0079.487] GetKeyState (nVirtKey=5) returned 0 [0079.487] GetKeyState (nVirtKey=6) returned 0 [0079.487] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0079.487] InvalidateRect (hWnd=0xa01fa, lpRect=0x43aa30, bErase=0) returned 1 [0079.487] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25a6270, cPoints=0x1 | out: lpPoints=0x25a6270) returned 39715228 [0079.487] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0079.487] InvalidateRect (hWnd=0xa01fa, lpRect=0x43a980, bErase=0) returned 1 [0079.487] UpdateWindow (hWnd=0xa01fa) returned 1 [0079.487] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x439f98 | out: lpPaint=0x439f98) returned 0x501071f [0079.487] SelectPalette (hdc=0x501071f, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0079.487] CreateCompatibleDC (hdc=0x501071f) returned 0x35010794 [0079.488] SelectObject (hdc=0x35010794, h=0x2905055a) returned 0x185000f [0079.488] GdipCreateFromHDC (hdc=0x35010794, graphics=0x439da0) returned 0x0 [0079.488] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0079.488] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0079.488] GdipCreateMatrix (matrix=0x439ed0) returned 0x0 [0079.488] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4713b0) returned 0x0 [0079.488] GdipIsMatrixIdentity (matrix=0x1c4713b0, result=0x439f30) returned 0x0 [0079.488] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f83f0 [0079.488] GdipGetMatrixElements (matrix=0x1c4713b0, matrixOut=0x1f2f83f0) returned 0x0 [0079.488] LocalFree (hMem=0x1f2f83f0) returned 0x0 [0079.488] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.488] GdipDeleteMatrix (matrix=0x1c4713b0) returned 0x0 [0079.488] GdipCreateRegion (region=0x439ed0) returned 0x0 [0079.488] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0079.488] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x439f00) returned 0x0 [0079.488] GdipSaveGraphics (graphics=0x1c46d570, state=0x439fd0) returned 0x0 [0079.488] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd8e0dbd) returned 0x0 [0079.488] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.489] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0079.489] GdipGetDC (graphics=0x1c46d570, hdc=0x4393c0) returned 0x0 [0079.489] GetCurrentObject (hdc=0x35010794, type=0x1) returned 0x1b00017 [0079.489] GetCurrentObject (hdc=0x35010794, type=0x2) returned 0x1900010 [0079.489] GetCurrentObject (hdc=0x35010794, type=0x7) returned 0x2905055a [0079.489] GetCurrentObject (hdc=0x35010794, type=0x6) returned 0x18a0048 [0079.489] SaveDC (hdc=0x35010794) returned 1 [0079.489] GetNearestColor (hdc=0x35010794, color=0xf0f0f0) returned 0xf0f0f0 [0079.489] GetNearestColor (hdc=0x35010794, color=0xa0a0a0) returned 0xa0a0a0 [0079.489] GetNearestColor (hdc=0x35010794, color=0x696969) returned 0x696969 [0079.489] GetNearestColor (hdc=0x35010794, color=0xa0a0a0) returned 0xa0a0a0 [0079.489] GetNearestColor (hdc=0x35010794, color=0x0) returned 0x0 [0079.489] GetNearestColor (hdc=0x35010794, color=0xffffff) returned 0xffffff [0079.489] GetNearestColor (hdc=0x35010794, color=0xe5e5e5) returned 0xe5e5e5 [0079.489] GetNearestColor (hdc=0x35010794, color=0xd8d8d8) returned 0xd8d8d8 [0079.490] GetNearestColor (hdc=0x35010794, color=0x0) returned 0x0 [0079.490] RestoreDC (hdc=0x35010794, nSavedDC=-1) returned 1 [0079.490] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.490] GdipReleaseDC (graphics=0x1c46d570, hdc=0x35010794) returned 0x0 [0079.490] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0079.490] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2f80 [0079.491] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0079.491] CoTaskMemFree (pv=0x1f2f2f80) [0079.491] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x439ab0) returned 0x0 [0079.491] GdipSetStringFormatAlign (format=0x1c475d60, align=0x1) returned 0x0 [0079.491] GdipSetStringFormatLineAlign (format=0x1c475d60, align=0x1) returned 0x0 [0079.491] GdipSetStringFormatHotkeyPrefix (format=0x1c475d60, hotkeyPrefix=2) returned 0x0 [0079.491] GdipGetStringFormatFlags (format=0x1c475d60, flags=0x439ae0) returned 0x0 [0079.491] GdipGetStringFormatTrimming (format=0x1c475d60, trimming=0x439ae0) returned 0x0 [0079.491] GdipGetStringFormatHotkeyPrefix (format=0x1c475d60, hotkeyPrefix=0x439ae0) returned 0x0 [0079.491] GdipGetFontSize (font=0x1c475d60, size=0x439ae0) returned 0x0 [0079.491] GdipGetFontStyle (font=0x1c475d60, style=0x439ae0) returned 0x0 [0079.491] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.491] GdipDeleteStringFormat (format=0x1c475d60) returned 0x0 [0079.491] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0079.491] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3360 [0079.491] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0079.492] CoTaskMemFree (pv=0x1f2f3360) [0079.492] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x439770) returned 0x0 [0079.492] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x439780) returned 0x0 [0079.492] GdipSetStringFormatFlags (format=0x1c476540, flags=0) returned 0x0 [0079.492] GdipSetStringFormatTrimming (format=0x1c476540, trimming=0x1) returned 0x0 [0079.492] GdipSetStringFormatHotkeyPrefix (format=0x1c476540, hotkeyPrefix=2) returned 0x0 [0079.492] GdipSetStringFormatAlign (format=0x1c476540, align=0x1) returned 0x0 [0079.492] GdipSetStringFormatLineAlign (format=0x1c476540, align=0x1) returned 0x0 [0079.492] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x439698, stringFormat=0x1c476540, boundingBox=0x439688, codepointsFitted=0x439684, linesFilled=0x439680) returned 0x0 [0079.492] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.492] GdipDeleteStringFormat (format=0x1c476540) returned 0x0 [0079.492] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.492] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0079.492] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0079.492] CoTaskMemAlloc (cb=0x13) returned 0x1f2f32c0 [0079.493] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0079.493] CoTaskMemFree (pv=0x1f2f32c0) [0079.493] GdipCreateRegion (region=0x4396e0) returned 0x0 [0079.493] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0079.493] GdipCreateMatrix (matrix=0x4396e0) returned 0x0 [0079.493] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471630) returned 0x0 [0079.493] GdipIsMatrixIdentity (matrix=0x1c471630, result=0x439740) returned 0x0 [0079.493] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f83f0 [0079.493] GdipGetMatrixElements (matrix=0x1c471630, matrixOut=0x1f2f83f0) returned 0x0 [0079.493] LocalFree (hMem=0x1f2f83f0) returned 0x0 [0079.493] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f7d70 [0079.493] GdipGetMatrixElements (matrix=0x1c471630, matrixOut=0x1f2f7d70) returned 0x0 [0079.493] LocalFree (hMem=0x1f2f7d70) returned 0x0 [0079.493] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.493] GdipDeleteMatrix (matrix=0x1c471630) returned 0x0 [0079.493] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x439790) returned 0x0 [0079.493] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x439750) returned 0x0 [0079.493] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x439750) returned 0x0 [0079.493] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.493] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0079.494] GdipGetDC (graphics=0x1c46d570, hdc=0x4397c0) returned 0x0 [0079.494] GetCurrentObject (hdc=0x35010794, type=0x1) returned 0x1b00017 [0079.494] GetCurrentObject (hdc=0x35010794, type=0x2) returned 0x1900010 [0079.494] GetCurrentObject (hdc=0x35010794, type=0x7) returned 0x2905055a [0079.494] GetCurrentObject (hdc=0x35010794, type=0x6) returned 0x18a0048 [0079.494] SaveDC (hdc=0x35010794) returned 1 [0079.494] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x530406cc [0079.494] GetClipRgn (hdc=0x35010794, hrgn=0x530406cc) returned 0 [0079.494] SelectClipRgn (hdc=0x35010794, hrgn=0x4d0405d8) returned 2 [0079.494] DeleteObject (ho=0x530406cc) returned 1 [0079.494] DeleteObject (ho=0x4d0405d8) returned 1 [0079.494] OffsetViewportOrgEx (in: hdc=0x35010794, x=0, y=0, lppt=0x25a6ef0 | out: lppt=0x25a6ef0) returned 1 [0079.494] GetNearestColor (hdc=0x35010794, color=0xf0f0f0) returned 0xf0f0f0 [0079.494] CreateSolidBrush (color=0xf0f0f0) returned 0x1810075d [0079.494] FillRect (hDC=0x35010794, lprc=0x439790, hbr=0x1810075d) returned 1 [0079.494] DeleteObject (ho=0x1810075d) returned 1 [0079.494] RestoreDC (hdc=0x35010794, nSavedDC=-1) returned 1 [0079.495] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.495] GdipReleaseDC (graphics=0x1c46d570, hdc=0x35010794) returned 0x0 [0079.495] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0079.495] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3160 [0079.495] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0079.495] CoTaskMemFree (pv=0x1f2f3160) [0079.495] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x439810) returned 0x0 [0079.495] GdipSetStringFormatAlign (format=0x1c475a50, align=0x1) returned 0x0 [0079.495] GdipSetStringFormatLineAlign (format=0x1c475a50, align=0x1) returned 0x0 [0079.495] GdipSetStringFormatHotkeyPrefix (format=0x1c475a50, hotkeyPrefix=2) returned 0x0 [0079.495] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x439880) returned 0x0 [0079.496] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x439790, stringFormat=0x1c475a50, brush=0x1c46cce0) returned 0x0 [0079.496] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.496] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0079.496] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.496] GdipDeleteStringFormat (format=0x1c475a50) returned 0x0 [0079.496] GetFocus () returned 0xa01fa [0079.496] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0079.496] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3400 [0079.496] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0079.496] CoTaskMemFree (pv=0x1f2f3400) [0079.496] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x439b70) returned 0x0 [0079.496] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0079.496] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.497] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0079.497] GdipCreateRegion (region=0x439640) returned 0x0 [0079.497] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0079.497] GdipCreateMatrix (matrix=0x439640) returned 0x0 [0079.497] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4714f0) returned 0x0 [0079.497] GdipIsMatrixIdentity (matrix=0x1c4714f0, result=0x4396a0) returned 0x0 [0079.497] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f88b0 [0079.497] GdipGetMatrixElements (matrix=0x1c4714f0, matrixOut=0x1f2f88b0) returned 0x0 [0079.497] LocalFree (hMem=0x1f2f88b0) returned 0x0 [0079.497] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f88b0 [0079.497] GdipGetMatrixElements (matrix=0x1c4714f0, matrixOut=0x1f2f88b0) returned 0x0 [0079.497] LocalFree (hMem=0x1f2f88b0) returned 0x0 [0079.497] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.497] GdipDeleteMatrix (matrix=0x1c4714f0) returned 0x0 [0079.497] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x4396f0) returned 0x0 [0079.497] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x4396b0) returned 0x0 [0079.497] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x4396b0) returned 0x0 [0079.497] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.497] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0079.497] GdipGetDC (graphics=0x1c46d570, hdc=0x439720) returned 0x0 [0079.497] GetCurrentObject (hdc=0x35010794, type=0x1) returned 0x1b00017 [0079.497] GetCurrentObject (hdc=0x35010794, type=0x2) returned 0x1900010 [0079.497] GetCurrentObject (hdc=0x35010794, type=0x7) returned 0x2905055a [0079.498] GetCurrentObject (hdc=0x35010794, type=0x6) returned 0x18a0048 [0079.498] SaveDC (hdc=0x35010794) returned 1 [0079.498] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4e0405d8 [0079.498] GetClipRgn (hdc=0x35010794, hrgn=0x4e0405d8) returned 0 [0079.498] SelectClipRgn (hdc=0x35010794, hrgn=0x540406cc) returned 2 [0079.498] DeleteObject (ho=0x4e0405d8) returned 1 [0079.498] DeleteObject (ho=0x540406cc) returned 1 [0079.498] OffsetViewportOrgEx (in: hdc=0x35010794, x=0, y=0, lppt=0x25a7490 | out: lppt=0x25a7490) returned 1 [0079.498] GetROP2 (hdc=0x35010794) returned 13 [0079.498] GetBkMode (hdc=0x35010794) returned 2 [0079.498] SetBkMode (hdc=0x35010794, mode=1) returned 2 [0079.498] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x3c300796 [0079.498] SelectObject (hdc=0x35010794, h=0x3c300796) returned 0x1b00017 [0079.498] MoveToEx (in: hdc=0x35010794, x=123, y=1, lppt=0x25a74f8 | out: lppt=0x25a74f8) returned 1 [0079.498] LineTo (hdc=0x35010794, x=1, y=1) returned 1 [0079.498] SetBkMode (hdc=0x35010794, mode=2) returned 1 [0079.498] MoveToEx (in: hdc=0x35010794, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0079.498] GetROP2 (hdc=0x35010794) returned 13 [0079.499] GetBkMode (hdc=0x35010794) returned 2 [0079.499] SetBkMode (hdc=0x35010794, mode=1) returned 2 [0079.499] SelectObject (hdc=0x35010794, h=0x3c300796) returned 0x3c300796 [0079.499] MoveToEx (in: hdc=0x35010794, x=1, y=1, lppt=0x25a7510 | out: lppt=0x25a7510) returned 1 [0079.499] LineTo (hdc=0x35010794, x=1, y=34) returned 1 [0079.499] SetBkMode (hdc=0x35010794, mode=2) returned 1 [0079.499] MoveToEx (in: hdc=0x35010794, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0079.499] SelectObject (hdc=0x35010794, h=0x1b00017) returned 0x3c300796 [0079.499] DeleteObject (ho=0x3c300796) returned 1 [0079.499] GetROP2 (hdc=0x35010794) returned 13 [0079.499] GetBkMode (hdc=0x35010794) returned 2 [0079.499] SetBkMode (hdc=0x35010794, mode=1) returned 2 [0079.499] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x230079a [0079.499] SelectObject (hdc=0x35010794, h=0x230079a) returned 0x1b00017 [0079.499] MoveToEx (in: hdc=0x35010794, x=1, y=34, lppt=0x25a7578 | out: lppt=0x25a7578) returned 1 [0079.499] LineTo (hdc=0x35010794, x=123, y=34) returned 1 [0079.499] SetBkMode (hdc=0x35010794, mode=2) returned 1 [0079.499] MoveToEx (in: hdc=0x35010794, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0079.499] GetROP2 (hdc=0x35010794) returned 13 [0079.499] GetBkMode (hdc=0x35010794) returned 2 [0079.499] SetBkMode (hdc=0x35010794, mode=1) returned 2 [0079.499] SelectObject (hdc=0x35010794, h=0x230079a) returned 0x230079a [0079.499] MoveToEx (in: hdc=0x35010794, x=123, y=34, lppt=0x25a7590 | out: lppt=0x25a7590) returned 1 [0079.499] LineTo (hdc=0x35010794, x=123, y=0) returned 1 [0079.500] SetBkMode (hdc=0x35010794, mode=2) returned 1 [0079.500] MoveToEx (in: hdc=0x35010794, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0079.500] SelectObject (hdc=0x35010794, h=0x1b00017) returned 0x230079a [0079.500] DeleteObject (ho=0x230079a) returned 1 [0079.500] GetROP2 (hdc=0x35010794) returned 13 [0079.500] GetBkMode (hdc=0x35010794) returned 2 [0079.500] SetBkMode (hdc=0x35010794, mode=1) returned 2 [0079.500] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x3d300796 [0079.500] SelectObject (hdc=0x35010794, h=0x3d300796) returned 0x1b00017 [0079.500] MoveToEx (in: hdc=0x35010794, x=122, y=2, lppt=0x25a75f8 | out: lppt=0x25a75f8) returned 1 [0079.500] LineTo (hdc=0x35010794, x=2, y=2) returned 1 [0079.500] SetBkMode (hdc=0x35010794, mode=2) returned 1 [0079.500] MoveToEx (in: hdc=0x35010794, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0079.500] GetROP2 (hdc=0x35010794) returned 13 [0079.500] GetBkMode (hdc=0x35010794) returned 2 [0079.500] SetBkMode (hdc=0x35010794, mode=1) returned 2 [0079.502] SelectObject (hdc=0x35010794, h=0x3d300796) returned 0x3d300796 [0079.502] MoveToEx (in: hdc=0x35010794, x=2, y=2, lppt=0x25a7610 | out: lppt=0x25a7610) returned 1 [0079.502] LineTo (hdc=0x35010794, x=2, y=33) returned 1 [0079.503] SetBkMode (hdc=0x35010794, mode=2) returned 1 [0079.503] MoveToEx (in: hdc=0x35010794, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0079.503] SelectObject (hdc=0x35010794, h=0x1b00017) returned 0x3d300796 [0079.503] DeleteObject (ho=0x3d300796) returned 1 [0079.503] GetROP2 (hdc=0x35010794) returned 13 [0079.503] GetBkMode (hdc=0x35010794) returned 2 [0079.503] SetBkMode (hdc=0x35010794, mode=1) returned 2 [0079.503] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x330079a [0079.503] SelectObject (hdc=0x35010794, h=0x330079a) returned 0x1b00017 [0079.503] MoveToEx (in: hdc=0x35010794, x=2, y=33, lppt=0x25a7678 | out: lppt=0x25a7678) returned 1 [0079.503] LineTo (hdc=0x35010794, x=122, y=33) returned 1 [0079.503] SetBkMode (hdc=0x35010794, mode=2) returned 1 [0079.503] MoveToEx (in: hdc=0x35010794, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0079.503] GetROP2 (hdc=0x35010794) returned 13 [0079.503] GetBkMode (hdc=0x35010794) returned 2 [0079.503] SetBkMode (hdc=0x35010794, mode=1) returned 2 [0079.503] SelectObject (hdc=0x35010794, h=0x330079a) returned 0x330079a [0079.503] MoveToEx (in: hdc=0x35010794, x=122, y=33, lppt=0x25a7690 | out: lppt=0x25a7690) returned 1 [0079.503] LineTo (hdc=0x35010794, x=122, y=1) returned 1 [0079.503] SetBkMode (hdc=0x35010794, mode=2) returned 1 [0079.503] MoveToEx (in: hdc=0x35010794, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0079.503] SelectObject (hdc=0x35010794, h=0x1b00017) returned 0x330079a [0079.503] DeleteObject (ho=0x330079a) returned 1 [0079.503] RestoreDC (hdc=0x35010794, nSavedDC=-1) returned 1 [0079.504] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.504] GdipReleaseDC (graphics=0x1c46d570, hdc=0x35010794) returned 0x0 [0079.504] GdipGetDC (graphics=0x1c46d570, hdc=0x439ea0) returned 0x0 [0079.504] BitBlt (hdc=0x501071f, x=0, y=0, cx=125, cy=36, hdcSrc=0x35010794, x1=0, y1=0, rop=0xcc0020) returned 1 [0079.504] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.504] GdipReleaseDC (graphics=0x1c46d570, hdc=0x35010794) returned 0x0 [0079.504] SelectPalette (hdc=0x501071f, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0079.504] SelectObject (hdc=0x35010794, h=0x185000f) returned 0x2905055a [0079.504] DeleteDC (hdc=0x35010794) returned 1 [0079.504] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0079.504] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0079.505] EndPaint (hWnd=0xa01fa, lpPaint=0x439fa8) returned 1 [0079.505] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25a76e8, cPoints=0x1 | out: lpPoints=0x25a76e8) returned 39715228 [0079.505] WindowFromPoint (Point=0x269000001e7) returned 0xa01fa [0079.505] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26901e7) returned 0x1 [0079.505] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0079.505] NotifyWinEvent (event=0x800c, hwnd=0xa01fa, idObject=-4, idChild=0) [0079.505] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0xfffffffffffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0079.505] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43a880) returned 0x0 [0079.505] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43a880) returned 0x0 [0079.518] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x5f86c0 [0079.518] RtlMoveMemory (in: Destination=0x5f86c0, Source=0x2594d08, Length=0x70 | out: Destination=0x5f86c0) [0079.518] ShellExecuteExW (in: pExecInfo=0x25a86e8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25a86e8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0082.517] GetKeyState (nVirtKey=1) returned 0 [0082.517] GetKeyState (nVirtKey=2) returned 0 [0082.517] GetKeyState (nVirtKey=4) returned 0 [0082.517] GetKeyState (nVirtKey=5) returned 0 [0082.517] GetKeyState (nVirtKey=6) returned 0 [0082.613] GetKeyState (nVirtKey=1) returned -127 [0082.613] GetKeyState (nVirtKey=2) returned 0 [0082.613] GetKeyState (nVirtKey=4) returned 0 [0082.613] GetKeyState (nVirtKey=5) returned 0 [0082.613] GetKeyState (nVirtKey=6) returned 0 [0082.613] IsWindowVisible (hWnd=0xa01fa) returned 1 [0082.613] IsWindowEnabled (hWnd=0xa01fa) returned 1 [0082.613] SetFocus (hWnd=0xa01fa) returned 0xa01fa [0082.613] GetFocus () returned 0xa01fa [0082.613] GetFocus () returned 0xa01fa [0082.613] GetFocus () returned 0xa01fa [0082.613] GetKeyState (nVirtKey=1) returned -127 [0082.613] GetKeyState (nVirtKey=2) returned 0 [0082.614] GetKeyState (nVirtKey=4) returned 0 [0082.614] GetKeyState (nVirtKey=5) returned 0 [0082.614] GetKeyState (nVirtKey=6) returned 0 [0082.614] GetCapture () returned 0xa01fa [0082.614] GetKeyState (nVirtKey=1) returned -127 [0082.614] GetKeyState (nVirtKey=2) returned 0 [0082.614] GetKeyState (nVirtKey=4) returned 0 [0082.614] GetKeyState (nVirtKey=5) returned 0 [0082.614] GetKeyState (nVirtKey=6) returned 0 [0082.614] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0082.614] InvalidateRect (hWnd=0xa01fa, lpRect=0x439db0, bErase=0) returned 1 [0082.614] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25a8810, cPoints=0x1 | out: lpPoints=0x25a8810) returned 39715228 [0082.614] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0082.614] InvalidateRect (hWnd=0xa01fa, lpRect=0x439d00, bErase=0) returned 1 [0082.614] UpdateWindow (hWnd=0xa01fa) returned 1 [0082.614] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x439318 | out: lpPaint=0x439318) returned 0xa0100d0 [0082.614] SelectPalette (hdc=0xa0100d0, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0082.615] CreateCompatibleDC (hdc=0xa0100d0) returned 0x2b01079b [0082.615] SelectObject (hdc=0x2b01079b, h=0x2905055a) returned 0x185000f [0082.615] GdipCreateFromHDC (hdc=0x2b01079b, graphics=0x439120) returned 0x0 [0082.639] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0082.639] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0082.639] GdipCreateMatrix (matrix=0x439250) returned 0x0 [0082.639] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4714b0) returned 0x0 [0082.639] GdipIsMatrixIdentity (matrix=0x1c4714b0, result=0x4392b0) returned 0x0 [0082.639] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f7d30 [0082.639] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f2f7d30) returned 0x0 [0082.640] LocalFree (hMem=0x1f2f7d30) returned 0x0 [0082.640] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.640] GdipDeleteMatrix (matrix=0x1c4714b0) returned 0x0 [0082.640] GdipCreateRegion (region=0x439250) returned 0x0 [0082.640] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0082.640] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x439280) returned 0x0 [0082.640] GdipSaveGraphics (graphics=0x1c46d570, state=0x439350) returned 0x0 [0082.640] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd8b0dbd) returned 0x0 [0082.640] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.640] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0082.640] GdipGetDC (graphics=0x1c46d570, hdc=0x438740) returned 0x0 [0082.640] GetCurrentObject (hdc=0x2b01079b, type=0x1) returned 0x1b00017 [0082.640] GetCurrentObject (hdc=0x2b01079b, type=0x2) returned 0x1900010 [0082.640] GetCurrentObject (hdc=0x2b01079b, type=0x7) returned 0x2905055a [0082.640] GetCurrentObject (hdc=0x2b01079b, type=0x6) returned 0x18a0048 [0082.652] SaveDC (hdc=0x2b01079b) returned 1 [0082.652] GetNearestColor (hdc=0x2b01079b, color=0xf0f0f0) returned 0xf0f0f0 [0082.652] GetNearestColor (hdc=0x2b01079b, color=0xa0a0a0) returned 0xa0a0a0 [0082.652] GetNearestColor (hdc=0x2b01079b, color=0x696969) returned 0x696969 [0082.652] GetNearestColor (hdc=0x2b01079b, color=0xa0a0a0) returned 0xa0a0a0 [0082.652] GetNearestColor (hdc=0x2b01079b, color=0x0) returned 0x0 [0082.653] GetNearestColor (hdc=0x2b01079b, color=0xffffff) returned 0xffffff [0082.653] GetNearestColor (hdc=0x2b01079b, color=0xe5e5e5) returned 0xe5e5e5 [0082.653] GetNearestColor (hdc=0x2b01079b, color=0xd8d8d8) returned 0xd8d8d8 [0082.653] GetNearestColor (hdc=0x2b01079b, color=0x0) returned 0x0 [0082.653] RestoreDC (hdc=0x2b01079b, nSavedDC=-1) returned 1 [0082.653] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.653] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b01079b) returned 0x0 [0082.654] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0082.654] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2a80 [0082.654] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0082.654] CoTaskMemFree (pv=0x1f2f2a80) [0082.654] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x438e30) returned 0x0 [0082.654] GdipSetStringFormatAlign (format=0x1c476540, align=0x1) returned 0x0 [0082.654] GdipSetStringFormatLineAlign (format=0x1c476540, align=0x1) returned 0x0 [0082.655] GdipSetStringFormatHotkeyPrefix (format=0x1c476540, hotkeyPrefix=2) returned 0x0 [0082.655] GdipGetStringFormatFlags (format=0x1c476540, flags=0x438e60) returned 0x0 [0082.655] GdipGetStringFormatTrimming (format=0x1c476540, trimming=0x438e60) returned 0x0 [0082.655] GdipGetStringFormatHotkeyPrefix (format=0x1c476540, hotkeyPrefix=0x438e60) returned 0x0 [0082.655] GdipGetFontSize (font=0x1c476540, size=0x438e60) returned 0x0 [0082.655] GdipGetFontStyle (font=0x1c476540, style=0x438e60) returned 0x0 [0082.655] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.655] GdipDeleteStringFormat (format=0x1c476540) returned 0x0 [0082.655] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0082.655] CoTaskMemAlloc (cb=0x13) returned 0x1f2f24a0 [0082.656] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0082.656] CoTaskMemFree (pv=0x1f2f24a0) [0082.656] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x438af0) returned 0x0 [0082.656] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x438b00) returned 0x0 [0082.656] GdipSetStringFormatFlags (format=0x1c475f20, flags=0) returned 0x0 [0082.656] GdipSetStringFormatTrimming (format=0x1c475f20, trimming=0x1) returned 0x0 [0082.656] GdipSetStringFormatHotkeyPrefix (format=0x1c475f20, hotkeyPrefix=2) returned 0x0 [0082.656] GdipSetStringFormatAlign (format=0x1c475f20, align=0x1) returned 0x0 [0082.656] GdipSetStringFormatLineAlign (format=0x1c475f20, align=0x1) returned 0x0 [0082.657] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x438a18, stringFormat=0x1c475f20, boundingBox=0x438a08, codepointsFitted=0x438a04, linesFilled=0x438a00) returned 0x0 [0082.657] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.657] GdipDeleteStringFormat (format=0x1c475f20) returned 0x0 [0082.657] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.657] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0082.657] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0082.657] CoTaskMemAlloc (cb=0x13) returned 0x1f2f24a0 [0082.658] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0082.658] CoTaskMemFree (pv=0x1f2f24a0) [0082.658] GdipCreateRegion (region=0x438a60) returned 0x0 [0082.658] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0082.658] GdipCreateMatrix (matrix=0x438a60) returned 0x0 [0082.658] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4710f0) returned 0x0 [0082.658] GdipIsMatrixIdentity (matrix=0x1c4710f0, result=0x438ac0) returned 0x0 [0082.658] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f8930 [0082.658] GdipGetMatrixElements (matrix=0x1c4710f0, matrixOut=0x1f2f8930) returned 0x0 [0082.658] LocalFree (hMem=0x1f2f8930) returned 0x0 [0082.658] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f8030 [0082.658] GdipGetMatrixElements (matrix=0x1c4710f0, matrixOut=0x1f2f8030) returned 0x0 [0082.658] LocalFree (hMem=0x1f2f8030) returned 0x0 [0082.659] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.659] GdipDeleteMatrix (matrix=0x1c4710f0) returned 0x0 [0082.659] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x438b10) returned 0x0 [0082.659] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x438ad0) returned 0x0 [0082.659] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x438ad0) returned 0x0 [0082.659] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.659] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0082.659] GdipGetDC (graphics=0x1c46d570, hdc=0x438b40) returned 0x0 [0082.659] GetCurrentObject (hdc=0x2b01079b, type=0x1) returned 0x1b00017 [0082.659] GetCurrentObject (hdc=0x2b01079b, type=0x2) returned 0x1900010 [0082.659] GetCurrentObject (hdc=0x2b01079b, type=0x7) returned 0x2905055a [0082.659] GetCurrentObject (hdc=0x2b01079b, type=0x6) returned 0x18a0048 [0082.659] SaveDC (hdc=0x2b01079b) returned 1 [0082.659] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x550406cc [0082.659] GetClipRgn (hdc=0x2b01079b, hrgn=0x550406cc) returned 0 [0082.660] SelectClipRgn (hdc=0x2b01079b, hrgn=0x4f0405d8) returned 2 [0082.660] DeleteObject (ho=0x550406cc) returned 1 [0082.660] DeleteObject (ho=0x4f0405d8) returned 1 [0082.660] OffsetViewportOrgEx (in: hdc=0x2b01079b, x=0, y=0, lppt=0x25a9490 | out: lppt=0x25a9490) returned 1 [0082.660] GetNearestColor (hdc=0x2b01079b, color=0xf0f0f0) returned 0xf0f0f0 [0082.660] CreateSolidBrush (color=0xf0f0f0) returned 0x1910075d [0082.660] FillRect (hDC=0x2b01079b, lprc=0x438b10, hbr=0x1910075d) returned 1 [0082.660] DeleteObject (ho=0x1910075d) returned 1 [0082.660] RestoreDC (hdc=0x2b01079b, nSavedDC=-1) returned 1 [0082.660] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.660] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b01079b) returned 0x0 [0082.661] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0082.661] CoTaskMemAlloc (cb=0x13) returned 0x1f2f29c0 [0082.662] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0082.667] CoTaskMemFree (pv=0x1f2f29c0) [0082.667] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x438b90) returned 0x0 [0082.667] GdipSetStringFormatAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0082.667] GdipSetStringFormatLineAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0082.667] GdipSetStringFormatHotkeyPrefix (format=0x1c4762a0, hotkeyPrefix=2) returned 0x0 [0082.667] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x438c00) returned 0x0 [0082.667] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x438b10, stringFormat=0x1c4762a0, brush=0x1c46cce0) returned 0x0 [0082.667] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.667] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0082.667] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.667] GdipDeleteStringFormat (format=0x1c4762a0) returned 0x0 [0082.667] GetFocus () returned 0xa01fa [0082.668] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0082.668] CoTaskMemAlloc (cb=0x13) returned 0x1f2f24a0 [0082.668] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0082.668] CoTaskMemFree (pv=0x1f2f24a0) [0082.669] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x438ef0) returned 0x0 [0082.669] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0082.669] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.669] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0082.669] GdipCreateRegion (region=0x4389c0) returned 0x0 [0082.669] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0082.669] GdipCreateMatrix (matrix=0x4389c0) returned 0x0 [0082.669] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471270) returned 0x0 [0082.669] GdipIsMatrixIdentity (matrix=0x1c471270, result=0x438a20) returned 0x0 [0082.669] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f7a30 [0082.669] GdipGetMatrixElements (matrix=0x1c471270, matrixOut=0x1f2f7a30) returned 0x0 [0082.669] LocalFree (hMem=0x1f2f7a30) returned 0x0 [0082.669] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f7ab0 [0082.669] GdipGetMatrixElements (matrix=0x1c471270, matrixOut=0x1f2f7ab0) returned 0x0 [0082.669] LocalFree (hMem=0x1f2f7ab0) returned 0x0 [0082.669] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.670] GdipDeleteMatrix (matrix=0x1c471270) returned 0x0 [0082.670] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x438a70) returned 0x0 [0082.670] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x438a30) returned 0x0 [0082.670] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x438a30) returned 0x0 [0082.670] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.670] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0082.670] GdipGetDC (graphics=0x1c46d570, hdc=0x438aa0) returned 0x0 [0082.670] GetCurrentObject (hdc=0x2b01079b, type=0x1) returned 0x1b00017 [0082.670] GetCurrentObject (hdc=0x2b01079b, type=0x2) returned 0x1900010 [0082.670] GetCurrentObject (hdc=0x2b01079b, type=0x7) returned 0x2905055a [0082.670] GetCurrentObject (hdc=0x2b01079b, type=0x6) returned 0x18a0048 [0082.670] SaveDC (hdc=0x2b01079b) returned 1 [0082.670] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x500405d8 [0082.670] GetClipRgn (hdc=0x2b01079b, hrgn=0x500405d8) returned 0 [0082.671] SelectClipRgn (hdc=0x2b01079b, hrgn=0x560406cc) returned 2 [0082.671] DeleteObject (ho=0x500405d8) returned 1 [0082.671] DeleteObject (ho=0x560406cc) returned 1 [0082.671] OffsetViewportOrgEx (in: hdc=0x2b01079b, x=0, y=0, lppt=0x25a9a30 | out: lppt=0x25a9a30) returned 1 [0082.671] GetROP2 (hdc=0x2b01079b) returned 13 [0082.671] GetBkMode (hdc=0x2b01079b) returned 2 [0082.671] SetBkMode (hdc=0x2b01079b, mode=1) returned 2 [0082.671] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x2130079d [0082.671] SelectObject (hdc=0x2b01079b, h=0x2130079d) returned 0x1b00017 [0082.671] MoveToEx (in: hdc=0x2b01079b, x=123, y=1, lppt=0x25a9a98 | out: lppt=0x25a9a98) returned 1 [0082.671] LineTo (hdc=0x2b01079b, x=1, y=1) returned 1 [0082.671] SetBkMode (hdc=0x2b01079b, mode=2) returned 1 [0082.671] MoveToEx (in: hdc=0x2b01079b, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0082.671] GetROP2 (hdc=0x2b01079b) returned 13 [0082.671] GetBkMode (hdc=0x2b01079b) returned 2 [0082.671] SetBkMode (hdc=0x2b01079b, mode=1) returned 2 [0082.671] SelectObject (hdc=0x2b01079b, h=0x2130079d) returned 0x2130079d [0082.672] MoveToEx (in: hdc=0x2b01079b, x=1, y=1, lppt=0x25a9ab0 | out: lppt=0x25a9ab0) returned 1 [0082.672] LineTo (hdc=0x2b01079b, x=1, y=34) returned 1 [0082.672] SetBkMode (hdc=0x2b01079b, mode=2) returned 1 [0082.672] MoveToEx (in: hdc=0x2b01079b, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0082.672] SelectObject (hdc=0x2b01079b, h=0x1b00017) returned 0x2130079d [0082.672] DeleteObject (ho=0x2130079d) returned 1 [0082.672] GetROP2 (hdc=0x2b01079b) returned 13 [0082.672] GetBkMode (hdc=0x2b01079b) returned 2 [0082.672] SetBkMode (hdc=0x2b01079b, mode=1) returned 2 [0082.672] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x2130079e [0082.672] SelectObject (hdc=0x2b01079b, h=0x2130079e) returned 0x1b00017 [0082.672] MoveToEx (in: hdc=0x2b01079b, x=1, y=34, lppt=0x25a9b18 | out: lppt=0x25a9b18) returned 1 [0082.673] LineTo (hdc=0x2b01079b, x=123, y=34) returned 1 [0082.673] SetBkMode (hdc=0x2b01079b, mode=2) returned 1 [0082.673] MoveToEx (in: hdc=0x2b01079b, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0082.673] GetROP2 (hdc=0x2b01079b) returned 13 [0082.673] GetBkMode (hdc=0x2b01079b) returned 2 [0082.673] SetBkMode (hdc=0x2b01079b, mode=1) returned 2 [0082.673] SelectObject (hdc=0x2b01079b, h=0x2130079e) returned 0x2130079e [0082.673] MoveToEx (in: hdc=0x2b01079b, x=123, y=34, lppt=0x25a9b30 | out: lppt=0x25a9b30) returned 1 [0082.673] LineTo (hdc=0x2b01079b, x=123, y=0) returned 1 [0082.673] SetBkMode (hdc=0x2b01079b, mode=2) returned 1 [0082.673] MoveToEx (in: hdc=0x2b01079b, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0082.673] SelectObject (hdc=0x2b01079b, h=0x1b00017) returned 0x2130079e [0082.673] DeleteObject (ho=0x2130079e) returned 1 [0082.673] GetROP2 (hdc=0x2b01079b) returned 13 [0082.673] GetBkMode (hdc=0x2b01079b) returned 2 [0082.673] SetBkMode (hdc=0x2b01079b, mode=1) returned 2 [0082.673] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x2230079d [0082.673] SelectObject (hdc=0x2b01079b, h=0x2230079d) returned 0x1b00017 [0082.674] MoveToEx (in: hdc=0x2b01079b, x=122, y=2, lppt=0x25a9b98 | out: lppt=0x25a9b98) returned 1 [0082.674] LineTo (hdc=0x2b01079b, x=2, y=2) returned 1 [0082.674] SetBkMode (hdc=0x2b01079b, mode=2) returned 1 [0082.674] MoveToEx (in: hdc=0x2b01079b, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0082.674] GetROP2 (hdc=0x2b01079b) returned 13 [0082.674] GetBkMode (hdc=0x2b01079b) returned 2 [0082.674] SetBkMode (hdc=0x2b01079b, mode=1) returned 2 [0082.674] SelectObject (hdc=0x2b01079b, h=0x2230079d) returned 0x2230079d [0082.674] MoveToEx (in: hdc=0x2b01079b, x=2, y=2, lppt=0x25a9bb0 | out: lppt=0x25a9bb0) returned 1 [0082.674] LineTo (hdc=0x2b01079b, x=2, y=33) returned 1 [0082.674] SetBkMode (hdc=0x2b01079b, mode=2) returned 1 [0082.674] MoveToEx (in: hdc=0x2b01079b, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0082.674] SelectObject (hdc=0x2b01079b, h=0x1b00017) returned 0x2230079d [0082.674] DeleteObject (ho=0x2230079d) returned 1 [0082.674] GetROP2 (hdc=0x2b01079b) returned 13 [0082.674] GetBkMode (hdc=0x2b01079b) returned 2 [0082.674] SetBkMode (hdc=0x2b01079b, mode=1) returned 2 [0082.674] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x2230079e [0082.675] SelectObject (hdc=0x2b01079b, h=0x2230079e) returned 0x1b00017 [0082.675] MoveToEx (in: hdc=0x2b01079b, x=2, y=33, lppt=0x25a9c18 | out: lppt=0x25a9c18) returned 1 [0082.675] LineTo (hdc=0x2b01079b, x=122, y=33) returned 1 [0082.675] SetBkMode (hdc=0x2b01079b, mode=2) returned 1 [0082.675] MoveToEx (in: hdc=0x2b01079b, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0082.675] GetROP2 (hdc=0x2b01079b) returned 13 [0082.675] GetBkMode (hdc=0x2b01079b) returned 2 [0082.675] SetBkMode (hdc=0x2b01079b, mode=1) returned 2 [0082.675] SelectObject (hdc=0x2b01079b, h=0x2230079e) returned 0x2230079e [0082.675] MoveToEx (in: hdc=0x2b01079b, x=122, y=33, lppt=0x25a9c30 | out: lppt=0x25a9c30) returned 1 [0082.675] LineTo (hdc=0x2b01079b, x=122, y=1) returned 1 [0082.675] SetBkMode (hdc=0x2b01079b, mode=2) returned 1 [0082.675] MoveToEx (in: hdc=0x2b01079b, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0082.675] SelectObject (hdc=0x2b01079b, h=0x1b00017) returned 0x2230079e [0082.675] DeleteObject (ho=0x2230079e) returned 1 [0082.675] RestoreDC (hdc=0x2b01079b, nSavedDC=-1) returned 1 [0082.675] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.675] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b01079b) returned 0x0 [0082.676] GdipGetDC (graphics=0x1c46d570, hdc=0x439220) returned 0x0 [0082.676] BitBlt (hdc=0xa0100d0, x=0, y=0, cx=125, cy=36, hdcSrc=0x2b01079b, x1=0, y1=0, rop=0xcc0020) returned 1 [0082.676] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.676] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b01079b) returned 0x0 [0082.677] SelectPalette (hdc=0xa0100d0, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0082.677] SelectObject (hdc=0x2b01079b, h=0x185000f) returned 0x2905055a [0082.677] DeleteDC (hdc=0x2b01079b) returned 1 [0082.677] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0082.677] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0082.677] EndPaint (hWnd=0xa01fa, lpPaint=0x439328) returned 1 [0082.677] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25a9c88, cPoints=0x1 | out: lpPoints=0x25a9c88) returned 39715228 [0082.677] WindowFromPoint (Point=0x26e000001ea) returned 0xa01fa [0082.677] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26e01ea) returned 0x1 [0082.677] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0082.677] NotifyWinEvent (event=0x800c, hwnd=0xa01fa, idObject=-4, idChild=0) [0082.677] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0xfffffffffffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0082.678] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x439c00) returned 0x0 [0082.678] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x439c00) returned 0x0 [0082.695] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x5f8c40 [0082.695] RtlMoveMemory (in: Destination=0x5f8c40, Source=0x2594d08, Length=0x70 | out: Destination=0x5f8c40) [0082.695] ShellExecuteExW (in: pExecInfo=0x25aae48*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25aae48*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0082.992] GetKeyState (nVirtKey=1) returned 1 [0082.992] GetKeyState (nVirtKey=2) returned 0 [0082.992] GetKeyState (nVirtKey=4) returned 0 [0082.992] GetKeyState (nVirtKey=5) returned 0 [0082.992] GetKeyState (nVirtKey=6) returned 0 [0085.090] GetKeyState (nVirtKey=1) returned 1 [0085.090] GetKeyState (nVirtKey=2) returned 0 [0085.090] GetKeyState (nVirtKey=4) returned 0 [0085.090] GetKeyState (nVirtKey=5) returned 0 [0085.090] GetKeyState (nVirtKey=6) returned 0 [0085.550] GetKeyState (nVirtKey=1) returned 1 [0085.550] GetKeyState (nVirtKey=2) returned 0 [0085.550] GetKeyState (nVirtKey=4) returned 0 [0085.550] GetKeyState (nVirtKey=5) returned 0 [0085.550] GetKeyState (nVirtKey=6) returned 0 [0085.615] GetKeyState (nVirtKey=1) returned -128 [0085.615] GetKeyState (nVirtKey=2) returned 0 [0085.615] GetKeyState (nVirtKey=4) returned 0 [0085.615] GetKeyState (nVirtKey=5) returned 0 [0085.615] GetKeyState (nVirtKey=6) returned 0 [0085.615] IsWindowVisible (hWnd=0xa01fa) returned 1 [0085.615] IsWindowEnabled (hWnd=0xa01fa) returned 1 [0085.615] SetFocus (hWnd=0xa01fa) returned 0xa01fa [0085.615] GetFocus () returned 0xa01fa [0085.616] GetFocus () returned 0xa01fa [0085.616] GetFocus () returned 0xa01fa [0085.616] GetKeyState (nVirtKey=1) returned -128 [0085.616] GetKeyState (nVirtKey=2) returned 0 [0085.616] GetKeyState (nVirtKey=4) returned 0 [0085.616] GetKeyState (nVirtKey=5) returned 0 [0085.616] GetKeyState (nVirtKey=6) returned 0 [0085.616] GetCapture () returned 0xa01fa [0085.616] GetKeyState (nVirtKey=1) returned -128 [0085.616] GetKeyState (nVirtKey=2) returned 0 [0085.616] GetKeyState (nVirtKey=4) returned 0 [0085.616] GetKeyState (nVirtKey=5) returned 0 [0085.616] GetKeyState (nVirtKey=6) returned 0 [0085.616] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0085.616] InvalidateRect (hWnd=0xa01fa, lpRect=0x439130, bErase=0) returned 1 [0085.616] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25aafc0, cPoints=0x1 | out: lpPoints=0x25aafc0) returned 39715228 [0085.616] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0085.616] InvalidateRect (hWnd=0xa01fa, lpRect=0x439080, bErase=0) returned 1 [0085.616] UpdateWindow (hWnd=0xa01fa) returned 0 [0085.616] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x438698 | out: lpPaint=0x438698) returned 0xa0100d0 [0085.616] SelectPalette (hdc=0xa0100d0, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0085.617] CreateCompatibleDC (hdc=0xa0100d0) returned 0x80107a6 [0085.617] SelectObject (hdc=0x80107a6, h=0x2905055a) returned 0x185000f [0085.617] GdipCreateFromHDC (hdc=0x80107a6, graphics=0x4384a0) returned 0x0 [0085.617] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0085.617] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0085.617] GdipCreateMatrix (matrix=0x4385d0) returned 0x0 [0085.617] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471430) returned 0x0 [0085.617] GdipIsMatrixIdentity (matrix=0x1c471430, result=0x438630) returned 0x0 [0085.617] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x5c4b30 [0085.617] GdipGetMatrixElements (matrix=0x1c471430, matrixOut=0x5c4b30) returned 0x0 [0085.617] LocalFree (hMem=0x5c4b30) returned 0x0 [0085.617] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.617] GdipDeleteMatrix (matrix=0x1c471430) returned 0x0 [0085.617] GdipCreateRegion (region=0x4385d0) returned 0x0 [0085.617] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0085.617] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x438600) returned 0x0 [0085.618] GdipSaveGraphics (graphics=0x1c46d570, state=0x4386d0) returned 0x0 [0085.618] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd880dbd) returned 0x0 [0085.618] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.618] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0085.618] GdipGetDC (graphics=0x1c46d570, hdc=0x437ac0) returned 0x0 [0085.618] GetCurrentObject (hdc=0x80107a6, type=0x1) returned 0x1b00017 [0085.618] GetCurrentObject (hdc=0x80107a6, type=0x2) returned 0x1900010 [0085.618] GetCurrentObject (hdc=0x80107a6, type=0x7) returned 0x2905055a [0085.618] GetCurrentObject (hdc=0x80107a6, type=0x6) returned 0x18a0048 [0085.618] SaveDC (hdc=0x80107a6) returned 1 [0085.618] GetNearestColor (hdc=0x80107a6, color=0xf0f0f0) returned 0xf0f0f0 [0085.618] GetNearestColor (hdc=0x80107a6, color=0xa0a0a0) returned 0xa0a0a0 [0085.618] GetNearestColor (hdc=0x80107a6, color=0x696969) returned 0x696969 [0085.618] GetNearestColor (hdc=0x80107a6, color=0xa0a0a0) returned 0xa0a0a0 [0085.619] GetNearestColor (hdc=0x80107a6, color=0x0) returned 0x0 [0085.619] GetNearestColor (hdc=0x80107a6, color=0xffffff) returned 0xffffff [0085.619] GetNearestColor (hdc=0x80107a6, color=0xe5e5e5) returned 0xe5e5e5 [0085.619] GetNearestColor (hdc=0x80107a6, color=0xd8d8d8) returned 0xd8d8d8 [0085.619] GetNearestColor (hdc=0x80107a6, color=0x0) returned 0x0 [0085.619] RestoreDC (hdc=0x80107a6, nSavedDC=-1) returned 1 [0085.619] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.619] GdipReleaseDC (graphics=0x1c46d570, hdc=0x80107a6) returned 0x0 [0085.619] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0085.620] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3080 [0085.620] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0085.620] CoTaskMemFree (pv=0x1f2f3080) [0085.620] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x4381b0) returned 0x0 [0085.620] GdipSetStringFormatAlign (format=0x1c475a50, align=0x1) returned 0x0 [0085.620] GdipSetStringFormatLineAlign (format=0x1c475a50, align=0x1) returned 0x0 [0085.620] GdipSetStringFormatHotkeyPrefix (format=0x1c475a50, hotkeyPrefix=2) returned 0x0 [0085.620] GdipGetStringFormatFlags (format=0x1c475a50, flags=0x4381e0) returned 0x0 [0085.620] GdipGetStringFormatTrimming (format=0x1c475a50, trimming=0x4381e0) returned 0x0 [0085.620] GdipGetStringFormatHotkeyPrefix (format=0x1c475a50, hotkeyPrefix=0x4381e0) returned 0x0 [0085.620] GdipGetFontSize (font=0x1c475a50, size=0x4381e0) returned 0x0 [0085.620] GdipGetFontStyle (font=0x1c475a50, style=0x4381e0) returned 0x0 [0085.620] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.620] GdipDeleteStringFormat (format=0x1c475a50) returned 0x0 [0085.621] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0085.621] CoTaskMemAlloc (cb=0x13) returned 0x1f2f32c0 [0085.621] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0085.621] CoTaskMemFree (pv=0x1f2f32c0) [0085.621] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x437e70) returned 0x0 [0085.621] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x437e80) returned 0x0 [0085.621] GdipSetStringFormatFlags (format=0x1c475f90, flags=0) returned 0x0 [0085.621] GdipSetStringFormatTrimming (format=0x1c475f90, trimming=0x1) returned 0x0 [0085.621] GdipSetStringFormatHotkeyPrefix (format=0x1c475f90, hotkeyPrefix=2) returned 0x0 [0085.622] GdipSetStringFormatAlign (format=0x1c475f90, align=0x1) returned 0x0 [0085.622] GdipSetStringFormatLineAlign (format=0x1c475f90, align=0x1) returned 0x0 [0085.622] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x437d98, stringFormat=0x1c475f90, boundingBox=0x437d88, codepointsFitted=0x437d84, linesFilled=0x437d80) returned 0x0 [0085.622] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.622] GdipDeleteStringFormat (format=0x1c475f90) returned 0x0 [0085.622] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.622] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0085.622] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0085.622] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3080 [0085.622] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0085.622] CoTaskMemFree (pv=0x1f2f3080) [0085.623] GdipCreateRegion (region=0x437de0) returned 0x0 [0085.623] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0085.623] GdipCreateMatrix (matrix=0x437de0) returned 0x0 [0085.623] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4716b0) returned 0x0 [0085.623] GdipIsMatrixIdentity (matrix=0x1c4716b0, result=0x437e40) returned 0x0 [0085.623] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x5c4b30 [0085.623] GdipGetMatrixElements (matrix=0x1c4716b0, matrixOut=0x5c4b30) returned 0x0 [0085.623] LocalFree (hMem=0x5c4b30) returned 0x0 [0085.623] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x5c4b30 [0085.623] GdipGetMatrixElements (matrix=0x1c4716b0, matrixOut=0x5c4b30) returned 0x0 [0085.623] LocalFree (hMem=0x5c4b30) returned 0x0 [0085.623] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.623] GdipDeleteMatrix (matrix=0x1c4716b0) returned 0x0 [0085.623] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x437e90) returned 0x0 [0085.623] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x437e50) returned 0x0 [0085.623] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x437e50) returned 0x0 [0085.623] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.623] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0085.623] GdipGetDC (graphics=0x1c46d570, hdc=0x437ec0) returned 0x0 [0085.623] GetCurrentObject (hdc=0x80107a6, type=0x1) returned 0x1b00017 [0085.623] GetCurrentObject (hdc=0x80107a6, type=0x2) returned 0x1900010 [0085.623] GetCurrentObject (hdc=0x80107a6, type=0x7) returned 0x2905055a [0085.624] GetCurrentObject (hdc=0x80107a6, type=0x6) returned 0x18a0048 [0085.624] SaveDC (hdc=0x80107a6) returned 1 [0085.624] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x570406cc [0085.624] GetClipRgn (hdc=0x80107a6, hrgn=0x570406cc) returned 0 [0085.624] SelectClipRgn (hdc=0x80107a6, hrgn=0x510405d8) returned 2 [0085.624] DeleteObject (ho=0x570406cc) returned 1 [0085.624] DeleteObject (ho=0x510405d8) returned 1 [0085.624] OffsetViewportOrgEx (in: hdc=0x80107a6, x=0, y=0, lppt=0x25abc40 | out: lppt=0x25abc40) returned 1 [0085.624] GetNearestColor (hdc=0x80107a6, color=0xf0f0f0) returned 0xf0f0f0 [0085.624] CreateSolidBrush (color=0xf0f0f0) returned 0x1a10075d [0085.624] FillRect (hDC=0x80107a6, lprc=0x437e90, hbr=0x1a10075d) returned 1 [0085.624] DeleteObject (ho=0x1a10075d) returned 1 [0085.624] RestoreDC (hdc=0x80107a6, nSavedDC=-1) returned 1 [0085.624] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.624] GdipReleaseDC (graphics=0x1c46d570, hdc=0x80107a6) returned 0x0 [0085.625] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0085.625] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2dc0 [0085.625] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0085.626] CoTaskMemFree (pv=0x1f2f2dc0) [0085.626] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x437f10) returned 0x0 [0085.626] GdipSetStringFormatAlign (format=0x1c475c10, align=0x1) returned 0x0 [0085.626] GdipSetStringFormatLineAlign (format=0x1c475c10, align=0x1) returned 0x0 [0085.626] GdipSetStringFormatHotkeyPrefix (format=0x1c475c10, hotkeyPrefix=2) returned 0x0 [0085.626] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x437f80) returned 0x0 [0085.626] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x437e90, stringFormat=0x1c475c10, brush=0x1c46cce0) returned 0x0 [0085.626] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.626] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0085.626] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.626] GdipDeleteStringFormat (format=0x1c475c10) returned 0x0 [0085.626] GetFocus () returned 0xa01fa [0085.627] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0085.627] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2d40 [0085.627] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0085.627] CoTaskMemFree (pv=0x1f2f2d40) [0085.627] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x438270) returned 0x0 [0085.627] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0085.627] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.627] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0085.627] GdipCreateRegion (region=0x437d40) returned 0x0 [0085.627] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0085.628] GdipCreateMatrix (matrix=0x437d40) returned 0x0 [0085.628] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471170) returned 0x0 [0085.628] GdipIsMatrixIdentity (matrix=0x1c471170, result=0x437da0) returned 0x0 [0085.628] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x5c4b30 [0085.628] GdipGetMatrixElements (matrix=0x1c471170, matrixOut=0x5c4b30) returned 0x0 [0085.628] LocalFree (hMem=0x5c4b30) returned 0x0 [0085.628] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x5c4b30 [0085.628] GdipGetMatrixElements (matrix=0x1c471170, matrixOut=0x5c4b30) returned 0x0 [0085.628] LocalFree (hMem=0x5c4b30) returned 0x0 [0085.628] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.628] GdipDeleteMatrix (matrix=0x1c471170) returned 0x0 [0085.628] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x437df0) returned 0x0 [0085.628] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x437db0) returned 0x0 [0085.628] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x437db0) returned 0x0 [0085.628] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.628] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0085.628] GdipGetDC (graphics=0x1c46d570, hdc=0x437e20) returned 0x0 [0085.628] GetCurrentObject (hdc=0x80107a6, type=0x1) returned 0x1b00017 [0085.628] GetCurrentObject (hdc=0x80107a6, type=0x2) returned 0x1900010 [0085.628] GetCurrentObject (hdc=0x80107a6, type=0x7) returned 0x2905055a [0085.628] GetCurrentObject (hdc=0x80107a6, type=0x6) returned 0x18a0048 [0085.629] SaveDC (hdc=0x80107a6) returned 1 [0085.629] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x520405d8 [0085.629] GetClipRgn (hdc=0x80107a6, hrgn=0x520405d8) returned 0 [0085.629] SelectClipRgn (hdc=0x80107a6, hrgn=0x580406cc) returned 2 [0085.629] DeleteObject (ho=0x520405d8) returned 1 [0085.629] DeleteObject (ho=0x580406cc) returned 1 [0085.629] OffsetViewportOrgEx (in: hdc=0x80107a6, x=0, y=0, lppt=0x25ac1e0 | out: lppt=0x25ac1e0) returned 1 [0085.629] GetROP2 (hdc=0x80107a6) returned 13 [0085.629] GetBkMode (hdc=0x80107a6) returned 2 [0085.629] SetBkMode (hdc=0x80107a6, mode=1) returned 2 [0085.629] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x103007a5 [0085.629] SelectObject (hdc=0x80107a6, h=0x103007a5) returned 0x1b00017 [0085.629] MoveToEx (in: hdc=0x80107a6, x=123, y=1, lppt=0x25ac248 | out: lppt=0x25ac248) returned 1 [0085.629] LineTo (hdc=0x80107a6, x=1, y=1) returned 1 [0085.629] SetBkMode (hdc=0x80107a6, mode=2) returned 1 [0085.629] MoveToEx (in: hdc=0x80107a6, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0085.629] GetROP2 (hdc=0x80107a6) returned 13 [0085.630] GetBkMode (hdc=0x80107a6) returned 2 [0085.630] SetBkMode (hdc=0x80107a6, mode=1) returned 2 [0085.630] SelectObject (hdc=0x80107a6, h=0x103007a5) returned 0x103007a5 [0085.630] MoveToEx (in: hdc=0x80107a6, x=1, y=1, lppt=0x25ac260 | out: lppt=0x25ac260) returned 1 [0085.630] LineTo (hdc=0x80107a6, x=1, y=34) returned 1 [0085.630] SetBkMode (hdc=0x80107a6, mode=2) returned 1 [0085.630] MoveToEx (in: hdc=0x80107a6, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0085.630] SelectObject (hdc=0x80107a6, h=0x1b00017) returned 0x103007a5 [0085.630] DeleteObject (ho=0x103007a5) returned 1 [0085.630] GetROP2 (hdc=0x80107a6) returned 13 [0085.630] GetBkMode (hdc=0x80107a6) returned 2 [0085.630] SetBkMode (hdc=0x80107a6, mode=1) returned 2 [0085.630] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x23007a8 [0085.630] SelectObject (hdc=0x80107a6, h=0x23007a8) returned 0x1b00017 [0085.630] MoveToEx (in: hdc=0x80107a6, x=1, y=34, lppt=0x25ac2c8 | out: lppt=0x25ac2c8) returned 1 [0085.630] LineTo (hdc=0x80107a6, x=123, y=34) returned 1 [0085.630] SetBkMode (hdc=0x80107a6, mode=2) returned 1 [0085.630] MoveToEx (in: hdc=0x80107a6, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0085.630] GetROP2 (hdc=0x80107a6) returned 13 [0085.630] GetBkMode (hdc=0x80107a6) returned 2 [0085.630] SetBkMode (hdc=0x80107a6, mode=1) returned 2 [0085.630] SelectObject (hdc=0x80107a6, h=0x23007a8) returned 0x23007a8 [0085.630] MoveToEx (in: hdc=0x80107a6, x=123, y=34, lppt=0x25ac2e0 | out: lppt=0x25ac2e0) returned 1 [0085.630] LineTo (hdc=0x80107a6, x=123, y=0) returned 1 [0085.631] SetBkMode (hdc=0x80107a6, mode=2) returned 1 [0085.631] MoveToEx (in: hdc=0x80107a6, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0085.631] SelectObject (hdc=0x80107a6, h=0x1b00017) returned 0x23007a8 [0085.631] DeleteObject (ho=0x23007a8) returned 1 [0085.631] GetROP2 (hdc=0x80107a6) returned 13 [0085.631] GetBkMode (hdc=0x80107a6) returned 2 [0085.631] SetBkMode (hdc=0x80107a6, mode=1) returned 2 [0085.631] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x113007a5 [0085.631] SelectObject (hdc=0x80107a6, h=0x113007a5) returned 0x1b00017 [0085.631] MoveToEx (in: hdc=0x80107a6, x=122, y=2, lppt=0x25ac348 | out: lppt=0x25ac348) returned 1 [0085.631] LineTo (hdc=0x80107a6, x=2, y=2) returned 1 [0085.631] SetBkMode (hdc=0x80107a6, mode=2) returned 1 [0085.631] MoveToEx (in: hdc=0x80107a6, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0085.631] GetROP2 (hdc=0x80107a6) returned 13 [0085.631] GetBkMode (hdc=0x80107a6) returned 2 [0085.631] SetBkMode (hdc=0x80107a6, mode=1) returned 2 [0085.631] SelectObject (hdc=0x80107a6, h=0x113007a5) returned 0x113007a5 [0085.631] MoveToEx (in: hdc=0x80107a6, x=2, y=2, lppt=0x25ac360 | out: lppt=0x25ac360) returned 1 [0085.631] LineTo (hdc=0x80107a6, x=2, y=33) returned 1 [0085.631] SetBkMode (hdc=0x80107a6, mode=2) returned 1 [0085.631] MoveToEx (in: hdc=0x80107a6, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0085.631] SelectObject (hdc=0x80107a6, h=0x1b00017) returned 0x113007a5 [0085.631] DeleteObject (ho=0x113007a5) returned 1 [0085.632] GetROP2 (hdc=0x80107a6) returned 13 [0085.632] GetBkMode (hdc=0x80107a6) returned 2 [0085.632] SetBkMode (hdc=0x80107a6, mode=1) returned 2 [0085.632] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x33007a8 [0085.632] SelectObject (hdc=0x80107a6, h=0x33007a8) returned 0x1b00017 [0085.632] MoveToEx (in: hdc=0x80107a6, x=2, y=33, lppt=0x25ac3c8 | out: lppt=0x25ac3c8) returned 1 [0085.632] LineTo (hdc=0x80107a6, x=122, y=33) returned 1 [0085.632] SetBkMode (hdc=0x80107a6, mode=2) returned 1 [0085.632] MoveToEx (in: hdc=0x80107a6, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0085.632] GetROP2 (hdc=0x80107a6) returned 13 [0085.632] GetBkMode (hdc=0x80107a6) returned 2 [0085.632] SetBkMode (hdc=0x80107a6, mode=1) returned 2 [0085.632] SelectObject (hdc=0x80107a6, h=0x33007a8) returned 0x33007a8 [0085.632] MoveToEx (in: hdc=0x80107a6, x=122, y=33, lppt=0x25ac3e0 | out: lppt=0x25ac3e0) returned 1 [0085.632] LineTo (hdc=0x80107a6, x=122, y=1) returned 1 [0085.632] SetBkMode (hdc=0x80107a6, mode=2) returned 1 [0085.632] MoveToEx (in: hdc=0x80107a6, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0085.632] SelectObject (hdc=0x80107a6, h=0x1b00017) returned 0x33007a8 [0085.632] DeleteObject (ho=0x33007a8) returned 1 [0085.632] RestoreDC (hdc=0x80107a6, nSavedDC=-1) returned 1 [0085.632] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.632] GdipReleaseDC (graphics=0x1c46d570, hdc=0x80107a6) returned 0x0 [0085.632] GdipGetDC (graphics=0x1c46d570, hdc=0x4385a0) returned 0x0 [0085.632] BitBlt (hdc=0xa0100d0, x=0, y=0, cx=125, cy=36, hdcSrc=0x80107a6, x1=0, y1=0, rop=0xcc0020) returned 1 [0085.635] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.635] GdipReleaseDC (graphics=0x1c46d570, hdc=0x80107a6) returned 0x0 [0085.635] SelectPalette (hdc=0xa0100d0, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0085.635] SelectObject (hdc=0x80107a6, h=0x185000f) returned 0x2905055a [0085.635] DeleteDC (hdc=0x80107a6) returned 1 [0085.635] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0085.635] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0085.635] EndPaint (hWnd=0xa01fa, lpPaint=0x4386a8) returned 1 [0085.635] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25ac438, cPoints=0x1 | out: lpPoints=0x25ac438) returned 39715228 [0085.635] WindowFromPoint (Point=0x274000001d0) returned 0xa01fa [0085.636] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x27401d0) returned 0x1 [0085.636] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0085.636] NotifyWinEvent (event=0x800c, hwnd=0xa01fa, idObject=-4, idChild=0) [0085.636] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0xfffffffffffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0085.636] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x438f80) returned 0x0 [0085.636] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x438f80) returned 0x0 [0085.654] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x5f8840 [0085.654] RtlMoveMemory (in: Destination=0x5f8840, Source=0x2594d08, Length=0x70 | out: Destination=0x5f8840) [0085.654] ShellExecuteExW (in: pExecInfo=0x25ad7b8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25ad7b8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0088.217] GetKeyState (nVirtKey=1) returned 0 [0088.217] GetKeyState (nVirtKey=2) returned 0 [0088.217] GetKeyState (nVirtKey=4) returned 0 [0088.217] GetKeyState (nVirtKey=5) returned 0 [0088.217] GetKeyState (nVirtKey=6) returned 0 [0088.567] GetKeyState (nVirtKey=1) returned 0 [0088.567] GetKeyState (nVirtKey=2) returned 0 [0088.567] GetKeyState (nVirtKey=4) returned 0 [0088.567] GetKeyState (nVirtKey=5) returned 0 [0088.567] GetKeyState (nVirtKey=6) returned 0 [0088.655] GetKeyState (nVirtKey=1) returned -127 [0088.655] GetKeyState (nVirtKey=2) returned 0 [0088.655] GetKeyState (nVirtKey=4) returned 0 [0088.655] GetKeyState (nVirtKey=5) returned 0 [0088.655] GetKeyState (nVirtKey=6) returned 0 [0088.655] IsWindowVisible (hWnd=0xa01fa) returned 1 [0088.655] IsWindowEnabled (hWnd=0xa01fa) returned 1 [0088.655] SetFocus (hWnd=0xa01fa) returned 0xa01fa [0088.656] GetFocus () returned 0xa01fa [0088.656] GetFocus () returned 0xa01fa [0088.656] GetFocus () returned 0xa01fa [0088.656] GetKeyState (nVirtKey=1) returned -127 [0088.656] GetKeyState (nVirtKey=2) returned 0 [0088.656] GetKeyState (nVirtKey=4) returned 0 [0088.656] GetKeyState (nVirtKey=5) returned 0 [0088.656] GetKeyState (nVirtKey=6) returned 0 [0088.656] GetCapture () returned 0xa01fa [0088.656] GetKeyState (nVirtKey=1) returned -127 [0088.656] GetKeyState (nVirtKey=2) returned 0 [0088.656] GetKeyState (nVirtKey=4) returned 0 [0088.656] GetKeyState (nVirtKey=5) returned 0 [0088.656] GetKeyState (nVirtKey=6) returned 0 [0088.656] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0088.656] InvalidateRect (hWnd=0xa01fa, lpRect=0x4384b0, bErase=0) returned 1 [0088.657] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25ad908, cPoints=0x1 | out: lpPoints=0x25ad908) returned 39715228 [0088.657] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0088.657] InvalidateRect (hWnd=0xa01fa, lpRect=0x438400, bErase=0) returned 1 [0088.657] UpdateWindow (hWnd=0xa01fa) returned 1 [0088.657] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x437a18 | out: lpPaint=0x437a18) returned 0x501071f [0088.657] SelectPalette (hdc=0x501071f, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0088.657] CreateCompatibleDC (hdc=0x501071f) returned 0x40107d9 [0088.657] SelectObject (hdc=0x40107d9, h=0x2905055a) returned 0x185000f [0088.657] GdipCreateFromHDC (hdc=0x40107d9, graphics=0x437820) returned 0x0 [0088.658] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0088.658] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0088.658] GdipCreateMatrix (matrix=0x437950) returned 0x0 [0088.658] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4710b0) returned 0x0 [0088.658] GdipIsMatrixIdentity (matrix=0x1c4710b0, result=0x4379b0) returned 0x0 [0088.658] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f7d30 [0088.658] GdipGetMatrixElements (matrix=0x1c4710b0, matrixOut=0x1f2f7d30) returned 0x0 [0088.658] LocalFree (hMem=0x1f2f7d30) returned 0x0 [0088.658] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.658] GdipDeleteMatrix (matrix=0x1c4710b0) returned 0x0 [0088.659] GdipCreateRegion (region=0x437950) returned 0x0 [0088.659] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0088.659] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x437980) returned 0x0 [0088.659] GdipSaveGraphics (graphics=0x1c46d570, state=0x437a50) returned 0x0 [0088.659] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd850dbd) returned 0x0 [0088.659] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.659] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0088.659] GdipGetDC (graphics=0x1c46d570, hdc=0x436e40) returned 0x0 [0088.659] GetCurrentObject (hdc=0x40107d9, type=0x1) returned 0x1b00017 [0088.659] GetCurrentObject (hdc=0x40107d9, type=0x2) returned 0x1900010 [0088.659] GetCurrentObject (hdc=0x40107d9, type=0x7) returned 0x2905055a [0088.660] GetCurrentObject (hdc=0x40107d9, type=0x6) returned 0x18a0048 [0088.660] SaveDC (hdc=0x40107d9) returned 1 [0088.660] GetNearestColor (hdc=0x40107d9, color=0xf0f0f0) returned 0xf0f0f0 [0088.660] GetNearestColor (hdc=0x40107d9, color=0xa0a0a0) returned 0xa0a0a0 [0088.660] GetNearestColor (hdc=0x40107d9, color=0x696969) returned 0x696969 [0088.660] GetNearestColor (hdc=0x40107d9, color=0xa0a0a0) returned 0xa0a0a0 [0088.660] GetNearestColor (hdc=0x40107d9, color=0x0) returned 0x0 [0088.661] GetNearestColor (hdc=0x40107d9, color=0xffffff) returned 0xffffff [0088.661] GetNearestColor (hdc=0x40107d9, color=0xe5e5e5) returned 0xe5e5e5 [0088.661] GetNearestColor (hdc=0x40107d9, color=0xd8d8d8) returned 0xd8d8d8 [0088.661] GetNearestColor (hdc=0x40107d9, color=0x0) returned 0x0 [0088.661] RestoreDC (hdc=0x40107d9, nSavedDC=-1) returned 1 [0088.661] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.661] GdipReleaseDC (graphics=0x1c46d570, hdc=0x40107d9) returned 0x0 [0088.662] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0088.662] CoTaskMemAlloc (cb=0x13) returned 0x1f2f25a0 [0088.662] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0088.663] CoTaskMemFree (pv=0x1f2f25a0) [0088.663] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x437530) returned 0x0 [0088.663] GdipSetStringFormatAlign (format=0x1c476150, align=0x1) returned 0x0 [0088.663] GdipSetStringFormatLineAlign (format=0x1c476150, align=0x1) returned 0x0 [0088.663] GdipSetStringFormatHotkeyPrefix (format=0x1c476150, hotkeyPrefix=2) returned 0x0 [0088.663] GdipGetStringFormatFlags (format=0x1c476150, flags=0x437560) returned 0x0 [0088.663] GdipGetStringFormatTrimming (format=0x1c476150, trimming=0x437560) returned 0x0 [0088.663] GdipGetStringFormatHotkeyPrefix (format=0x1c476150, hotkeyPrefix=0x437560) returned 0x0 [0088.663] GdipGetFontSize (font=0x1c476150, size=0x437560) returned 0x0 [0088.663] GdipGetFontStyle (font=0x1c476150, style=0x437560) returned 0x0 [0088.663] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.663] GdipDeleteStringFormat (format=0x1c476150) returned 0x0 [0088.664] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0088.664] CoTaskMemAlloc (cb=0x13) returned 0x1f2f29c0 [0088.665] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0088.665] CoTaskMemFree (pv=0x1f2f29c0) [0088.665] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x4371f0) returned 0x0 [0088.665] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x437200) returned 0x0 [0088.665] GdipSetStringFormatFlags (format=0x1c475d60, flags=0) returned 0x0 [0088.665] GdipSetStringFormatTrimming (format=0x1c475d60, trimming=0x1) returned 0x0 [0088.665] GdipSetStringFormatHotkeyPrefix (format=0x1c475d60, hotkeyPrefix=2) returned 0x0 [0088.665] GdipSetStringFormatAlign (format=0x1c475d60, align=0x1) returned 0x0 [0088.665] GdipSetStringFormatLineAlign (format=0x1c475d60, align=0x1) returned 0x0 [0088.665] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x437118, stringFormat=0x1c475d60, boundingBox=0x437108, codepointsFitted=0x437104, linesFilled=0x437100) returned 0x0 [0088.665] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.665] GdipDeleteStringFormat (format=0x1c475d60) returned 0x0 [0088.666] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.666] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0088.666] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0088.667] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2a20 [0088.667] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0088.667] CoTaskMemFree (pv=0x1f2f2a20) [0088.667] GdipCreateRegion (region=0x437160) returned 0x0 [0088.667] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0088.667] GdipCreateMatrix (matrix=0x437160) returned 0x0 [0088.667] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4714b0) returned 0x0 [0088.668] GdipIsMatrixIdentity (matrix=0x1c4714b0, result=0x4371c0) returned 0x0 [0088.668] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f8930 [0088.668] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f2f8930) returned 0x0 [0088.668] LocalFree (hMem=0x1f2f8930) returned 0x0 [0088.668] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f80b0 [0088.668] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f2f80b0) returned 0x0 [0088.668] LocalFree (hMem=0x1f2f80b0) returned 0x0 [0088.668] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.668] GdipDeleteMatrix (matrix=0x1c4714b0) returned 0x0 [0088.668] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x437210) returned 0x0 [0088.668] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x4371d0) returned 0x0 [0088.668] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x4371d0) returned 0x0 [0088.668] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.669] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0088.669] GdipGetDC (graphics=0x1c46d570, hdc=0x437240) returned 0x0 [0088.669] GetCurrentObject (hdc=0x40107d9, type=0x1) returned 0x1b00017 [0088.669] GetCurrentObject (hdc=0x40107d9, type=0x2) returned 0x1900010 [0088.669] GetCurrentObject (hdc=0x40107d9, type=0x7) returned 0x2905055a [0088.669] GetCurrentObject (hdc=0x40107d9, type=0x6) returned 0x18a0048 [0088.669] SaveDC (hdc=0x40107d9) returned 1 [0088.669] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x590406cc [0088.669] GetClipRgn (hdc=0x40107d9, hrgn=0x590406cc) returned 0 [0088.669] SelectClipRgn (hdc=0x40107d9, hrgn=0x530405d8) returned 2 [0088.670] DeleteObject (ho=0x590406cc) returned 1 [0088.670] DeleteObject (ho=0x530405d8) returned 1 [0088.670] OffsetViewportOrgEx (in: hdc=0x40107d9, x=0, y=0, lppt=0x25ae588 | out: lppt=0x25ae588) returned 1 [0088.670] GetNearestColor (hdc=0x40107d9, color=0xf0f0f0) returned 0xf0f0f0 [0088.670] CreateSolidBrush (color=0xf0f0f0) returned 0x1b10075d [0088.670] FillRect (hDC=0x40107d9, lprc=0x437210, hbr=0x1b10075d) returned 1 [0088.670] DeleteObject (ho=0x1b10075d) returned 1 [0088.670] RestoreDC (hdc=0x40107d9, nSavedDC=-1) returned 1 [0088.671] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.671] GdipReleaseDC (graphics=0x1c46d570, hdc=0x40107d9) returned 0x0 [0088.672] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0088.672] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2c80 [0088.672] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0088.672] CoTaskMemFree (pv=0x1f2f2c80) [0088.673] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x437290) returned 0x0 [0088.673] GdipSetStringFormatAlign (format=0x1c475d60, align=0x1) returned 0x0 [0088.673] GdipSetStringFormatLineAlign (format=0x1c475d60, align=0x1) returned 0x0 [0088.674] GdipSetStringFormatHotkeyPrefix (format=0x1c475d60, hotkeyPrefix=2) returned 0x0 [0088.674] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x437300) returned 0x0 [0088.674] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x437210, stringFormat=0x1c475d60, brush=0x1c46cce0) returned 0x0 [0088.674] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.674] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0088.674] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.674] GdipDeleteStringFormat (format=0x1c475d60) returned 0x0 [0088.674] GetFocus () returned 0xa01fa [0088.677] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0088.677] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2c60 [0088.677] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0088.677] CoTaskMemFree (pv=0x1f2f2c60) [0088.678] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x4375f0) returned 0x0 [0088.678] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0088.678] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.678] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0088.679] GdipCreateRegion (region=0x4370c0) returned 0x0 [0088.679] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0088.679] GdipCreateMatrix (matrix=0x4370c0) returned 0x0 [0088.679] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4715b0) returned 0x0 [0088.679] GdipIsMatrixIdentity (matrix=0x1c4715b0, result=0x437120) returned 0x0 [0088.679] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f8030 [0088.679] GdipGetMatrixElements (matrix=0x1c4715b0, matrixOut=0x1f2f8030) returned 0x0 [0088.679] LocalFree (hMem=0x1f2f8030) returned 0x0 [0088.679] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f2f7ff0 [0088.679] GdipGetMatrixElements (matrix=0x1c4715b0, matrixOut=0x1f2f7ff0) returned 0x0 [0088.679] LocalFree (hMem=0x1f2f7ff0) returned 0x0 [0088.679] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.679] GdipDeleteMatrix (matrix=0x1c4715b0) returned 0x0 [0088.679] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x437170) returned 0x0 [0088.680] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x437130) returned 0x0 [0088.680] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x437130) returned 0x0 [0088.680] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.680] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0088.680] GdipGetDC (graphics=0x1c46d570, hdc=0x4371a0) returned 0x0 [0088.680] GetCurrentObject (hdc=0x40107d9, type=0x1) returned 0x1b00017 [0088.680] GetCurrentObject (hdc=0x40107d9, type=0x2) returned 0x1900010 [0088.680] GetCurrentObject (hdc=0x40107d9, type=0x7) returned 0x2905055a [0088.680] GetCurrentObject (hdc=0x40107d9, type=0x6) returned 0x18a0048 [0088.681] SaveDC (hdc=0x40107d9) returned 1 [0088.681] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x540405d8 [0088.681] GetClipRgn (hdc=0x40107d9, hrgn=0x540405d8) returned 0 [0088.681] SelectClipRgn (hdc=0x40107d9, hrgn=0x5a0406cc) returned 2 [0088.681] DeleteObject (ho=0x540405d8) returned 1 [0088.681] DeleteObject (ho=0x5a0406cc) returned 1 [0088.681] OffsetViewportOrgEx (in: hdc=0x40107d9, x=0, y=0, lppt=0x25aeb28 | out: lppt=0x25aeb28) returned 1 [0088.681] GetROP2 (hdc=0x40107d9) returned 13 [0088.681] GetBkMode (hdc=0x40107d9) returned 2 [0088.681] SetBkMode (hdc=0x40107d9, mode=1) returned 2 [0088.682] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x13007db [0088.682] SelectObject (hdc=0x40107d9, h=0x13007db) returned 0x1b00017 [0088.682] MoveToEx (in: hdc=0x40107d9, x=123, y=1, lppt=0x25aeb90 | out: lppt=0x25aeb90) returned 1 [0088.682] LineTo (hdc=0x40107d9, x=1, y=1) returned 1 [0088.682] SetBkMode (hdc=0x40107d9, mode=2) returned 1 [0088.682] MoveToEx (in: hdc=0x40107d9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0088.682] GetROP2 (hdc=0x40107d9) returned 13 [0088.682] GetBkMode (hdc=0x40107d9) returned 2 [0088.682] SetBkMode (hdc=0x40107d9, mode=1) returned 2 [0088.682] SelectObject (hdc=0x40107d9, h=0x13007db) returned 0x13007db [0088.682] MoveToEx (in: hdc=0x40107d9, x=1, y=1, lppt=0x25aeba8 | out: lppt=0x25aeba8) returned 1 [0088.682] LineTo (hdc=0x40107d9, x=1, y=34) returned 1 [0088.682] SetBkMode (hdc=0x40107d9, mode=2) returned 1 [0088.683] MoveToEx (in: hdc=0x40107d9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0088.683] SelectObject (hdc=0x40107d9, h=0x1b00017) returned 0x13007db [0088.683] DeleteObject (ho=0x13007db) returned 1 [0088.683] GetROP2 (hdc=0x40107d9) returned 13 [0088.683] GetBkMode (hdc=0x40107d9) returned 2 [0088.683] SetBkMode (hdc=0x40107d9, mode=1) returned 2 [0088.683] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x13007dc [0088.683] SelectObject (hdc=0x40107d9, h=0x13007dc) returned 0x1b00017 [0088.683] MoveToEx (in: hdc=0x40107d9, x=1, y=34, lppt=0x25aec10 | out: lppt=0x25aec10) returned 1 [0088.683] LineTo (hdc=0x40107d9, x=123, y=34) returned 1 [0088.684] SetBkMode (hdc=0x40107d9, mode=2) returned 1 [0088.684] MoveToEx (in: hdc=0x40107d9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0088.684] GetROP2 (hdc=0x40107d9) returned 13 [0088.684] GetBkMode (hdc=0x40107d9) returned 2 [0088.684] SetBkMode (hdc=0x40107d9, mode=1) returned 2 [0088.684] SelectObject (hdc=0x40107d9, h=0x13007dc) returned 0x13007dc [0088.684] MoveToEx (in: hdc=0x40107d9, x=123, y=34, lppt=0x25aec28 | out: lppt=0x25aec28) returned 1 [0088.684] LineTo (hdc=0x40107d9, x=123, y=0) returned 1 [0088.684] SetBkMode (hdc=0x40107d9, mode=2) returned 1 [0088.684] MoveToEx (in: hdc=0x40107d9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0088.684] SelectObject (hdc=0x40107d9, h=0x1b00017) returned 0x13007dc [0088.684] DeleteObject (ho=0x13007dc) returned 1 [0088.685] GetROP2 (hdc=0x40107d9) returned 13 [0088.685] GetBkMode (hdc=0x40107d9) returned 2 [0088.685] SetBkMode (hdc=0x40107d9, mode=1) returned 2 [0088.685] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x23007db [0088.685] SelectObject (hdc=0x40107d9, h=0x23007db) returned 0x1b00017 [0088.685] MoveToEx (in: hdc=0x40107d9, x=122, y=2, lppt=0x25aec90 | out: lppt=0x25aec90) returned 1 [0088.685] LineTo (hdc=0x40107d9, x=2, y=2) returned 1 [0088.685] SetBkMode (hdc=0x40107d9, mode=2) returned 1 [0088.685] MoveToEx (in: hdc=0x40107d9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0088.685] GetROP2 (hdc=0x40107d9) returned 13 [0088.685] GetBkMode (hdc=0x40107d9) returned 2 [0088.685] SetBkMode (hdc=0x40107d9, mode=1) returned 2 [0088.685] SelectObject (hdc=0x40107d9, h=0x23007db) returned 0x23007db [0088.685] MoveToEx (in: hdc=0x40107d9, x=2, y=2, lppt=0x25aeca8 | out: lppt=0x25aeca8) returned 1 [0088.686] LineTo (hdc=0x40107d9, x=2, y=33) returned 1 [0088.686] SetBkMode (hdc=0x40107d9, mode=2) returned 1 [0088.686] MoveToEx (in: hdc=0x40107d9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0088.686] SelectObject (hdc=0x40107d9, h=0x1b00017) returned 0x23007db [0088.686] DeleteObject (ho=0x23007db) returned 1 [0088.687] GetROP2 (hdc=0x40107d9) returned 13 [0088.687] GetBkMode (hdc=0x40107d9) returned 2 [0088.687] SetBkMode (hdc=0x40107d9, mode=1) returned 2 [0088.687] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x23007dc [0088.687] SelectObject (hdc=0x40107d9, h=0x23007dc) returned 0x1b00017 [0088.687] MoveToEx (in: hdc=0x40107d9, x=2, y=33, lppt=0x25aed10 | out: lppt=0x25aed10) returned 1 [0088.687] LineTo (hdc=0x40107d9, x=122, y=33) returned 1 [0088.687] SetBkMode (hdc=0x40107d9, mode=2) returned 1 [0088.687] MoveToEx (in: hdc=0x40107d9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0088.688] GetROP2 (hdc=0x40107d9) returned 13 [0088.688] GetBkMode (hdc=0x40107d9) returned 2 [0088.688] SetBkMode (hdc=0x40107d9, mode=1) returned 2 [0088.688] SelectObject (hdc=0x40107d9, h=0x23007dc) returned 0x23007dc [0088.688] MoveToEx (in: hdc=0x40107d9, x=122, y=33, lppt=0x25aed28 | out: lppt=0x25aed28) returned 1 [0088.689] LineTo (hdc=0x40107d9, x=122, y=1) returned 1 [0088.689] SetBkMode (hdc=0x40107d9, mode=2) returned 1 [0088.689] MoveToEx (in: hdc=0x40107d9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0088.689] SelectObject (hdc=0x40107d9, h=0x1b00017) returned 0x23007dc [0088.689] DeleteObject (ho=0x23007dc) returned 1 [0088.689] RestoreDC (hdc=0x40107d9, nSavedDC=-1) returned 1 [0088.690] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.690] GdipReleaseDC (graphics=0x1c46d570, hdc=0x40107d9) returned 0x0 [0088.690] GdipGetDC (graphics=0x1c46d570, hdc=0x437920) returned 0x0 [0088.690] BitBlt (hdc=0x501071f, x=0, y=0, cx=125, cy=36, hdcSrc=0x40107d9, x1=0, y1=0, rop=0xcc0020) returned 1 [0088.691] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.691] GdipReleaseDC (graphics=0x1c46d570, hdc=0x40107d9) returned 0x0 [0088.691] SelectPalette (hdc=0x501071f, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0088.691] SelectObject (hdc=0x40107d9, h=0x185000f) returned 0x2905055a [0088.692] DeleteDC (hdc=0x40107d9) returned 1 [0088.692] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0088.692] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0088.692] EndPaint (hWnd=0xa01fa, lpPaint=0x437a28) returned 1 [0088.692] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25aed80, cPoints=0x1 | out: lpPoints=0x25aed80) returned 39715228 [0088.692] WindowFromPoint (Point=0x269000001cc) returned 0xa01fa [0088.692] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26901cc) returned 0x1 [0088.692] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0088.692] NotifyWinEvent (event=0x800c, hwnd=0xa01fa, idObject=-4, idChild=0) [0088.692] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0xfffffffffffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0088.693] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x438300) returned 0x0 [0088.693] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x438300) returned 0x0 [0088.749] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x5f9b40 [0088.749] RtlMoveMemory (in: Destination=0x5f9b40, Source=0x2594d08, Length=0x70 | out: Destination=0x5f9b40) [0088.749] ShellExecuteExW (in: pExecInfo=0x25b02c0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25b02c0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0091.615] GetKeyState (nVirtKey=1) returned 1 [0091.615] GetKeyState (nVirtKey=2) returned 0 [0091.615] GetKeyState (nVirtKey=4) returned 0 [0091.615] GetKeyState (nVirtKey=5) returned 0 [0091.615] GetKeyState (nVirtKey=6) returned 0 [0091.680] GetKeyState (nVirtKey=1) returned -128 [0091.680] GetKeyState (nVirtKey=2) returned 0 [0091.680] GetKeyState (nVirtKey=4) returned 0 [0091.680] GetKeyState (nVirtKey=5) returned 0 [0091.680] GetKeyState (nVirtKey=6) returned 0 [0091.680] IsWindowVisible (hWnd=0xa01fa) returned 1 [0091.680] IsWindowEnabled (hWnd=0xa01fa) returned 1 [0091.680] SetFocus (hWnd=0xa01fa) returned 0xa01fa [0091.680] GetFocus () returned 0xa01fa [0091.680] GetFocus () returned 0xa01fa [0091.680] GetFocus () returned 0xa01fa [0091.680] GetKeyState (nVirtKey=1) returned -128 [0091.680] GetKeyState (nVirtKey=2) returned 0 [0091.680] GetKeyState (nVirtKey=4) returned 0 [0091.680] GetKeyState (nVirtKey=5) returned 0 [0091.680] GetKeyState (nVirtKey=6) returned 0 [0091.681] GetCapture () returned 0xa01fa [0091.681] GetKeyState (nVirtKey=1) returned -128 [0091.681] GetKeyState (nVirtKey=2) returned 0 [0091.681] GetKeyState (nVirtKey=4) returned 0 [0091.681] GetKeyState (nVirtKey=5) returned 0 [0091.681] GetKeyState (nVirtKey=6) returned 0 [0091.681] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0091.681] InvalidateRect (hWnd=0xa01fa, lpRect=0x437830, bErase=0) returned 1 [0091.681] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25b03e8, cPoints=0x1 | out: lpPoints=0x25b03e8) returned 39715228 [0091.681] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0091.681] InvalidateRect (hWnd=0xa01fa, lpRect=0x437780, bErase=0) returned 1 [0091.681] UpdateWindow (hWnd=0xa01fa) returned 1 [0091.681] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x436d98 | out: lpPaint=0x436d98) returned 0x10105c2 [0091.681] SelectPalette (hdc=0x10105c2, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0091.681] CreateCompatibleDC (hdc=0x10105c2) returned 0xe010802 [0091.682] SelectObject (hdc=0xe010802, h=0x2905055a) returned 0x185000f [0091.682] GdipCreateFromHDC (hdc=0xe010802, graphics=0x436ba0) returned 0x0 [0091.682] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0091.682] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0091.682] GdipCreateMatrix (matrix=0x436cd0) returned 0x0 [0091.682] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4714f0) returned 0x0 [0091.682] GdipIsMatrixIdentity (matrix=0x1c4714f0, result=0x436d30) returned 0x0 [0091.682] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c610 [0091.682] GdipGetMatrixElements (matrix=0x1c4714f0, matrixOut=0x1f32c610) returned 0x0 [0091.682] LocalFree (hMem=0x1f32c610) returned 0x0 [0091.682] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.683] GdipDeleteMatrix (matrix=0x1c4714f0) returned 0x0 [0091.683] GdipCreateRegion (region=0x436cd0) returned 0x0 [0091.683] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0091.683] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x436d00) returned 0x0 [0091.683] GdipSaveGraphics (graphics=0x1c46d570, state=0x436dd0) returned 0x0 [0091.683] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd820dbd) returned 0x0 [0091.683] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.683] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0091.683] GdipGetDC (graphics=0x1c46d570, hdc=0x4361c0) returned 0x0 [0091.683] GetCurrentObject (hdc=0xe010802, type=0x1) returned 0x1b00017 [0091.683] GetCurrentObject (hdc=0xe010802, type=0x2) returned 0x1900010 [0091.683] GetCurrentObject (hdc=0xe010802, type=0x7) returned 0x2905055a [0091.683] GetCurrentObject (hdc=0xe010802, type=0x6) returned 0x18a0048 [0091.684] SaveDC (hdc=0xe010802) returned 1 [0091.684] GetNearestColor (hdc=0xe010802, color=0xf0f0f0) returned 0xf0f0f0 [0091.684] GetNearestColor (hdc=0xe010802, color=0xa0a0a0) returned 0xa0a0a0 [0091.684] GetNearestColor (hdc=0xe010802, color=0x696969) returned 0x696969 [0091.684] GetNearestColor (hdc=0xe010802, color=0xa0a0a0) returned 0xa0a0a0 [0091.684] GetNearestColor (hdc=0xe010802, color=0x0) returned 0x0 [0091.684] GetNearestColor (hdc=0xe010802, color=0xffffff) returned 0xffffff [0091.684] GetNearestColor (hdc=0xe010802, color=0xe5e5e5) returned 0xe5e5e5 [0091.684] GetNearestColor (hdc=0xe010802, color=0xd8d8d8) returned 0xd8d8d8 [0091.684] GetNearestColor (hdc=0xe010802, color=0x0) returned 0x0 [0091.684] RestoreDC (hdc=0xe010802, nSavedDC=-1) returned 1 [0091.685] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.685] GdipReleaseDC (graphics=0x1c46d570, hdc=0xe010802) returned 0x0 [0091.685] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0091.685] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2e00 [0091.686] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0091.686] CoTaskMemFree (pv=0x1f2f2e00) [0091.686] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x4368b0) returned 0x0 [0091.686] GdipSetStringFormatAlign (format=0x1c476310, align=0x1) returned 0x0 [0091.686] GdipSetStringFormatLineAlign (format=0x1c476310, align=0x1) returned 0x0 [0091.686] GdipSetStringFormatHotkeyPrefix (format=0x1c476310, hotkeyPrefix=2) returned 0x0 [0091.686] GdipGetStringFormatFlags (format=0x1c476310, flags=0x4368e0) returned 0x0 [0091.686] GdipGetStringFormatTrimming (format=0x1c476310, trimming=0x4368e0) returned 0x0 [0091.686] GdipGetStringFormatHotkeyPrefix (format=0x1c476310, hotkeyPrefix=0x4368e0) returned 0x0 [0091.686] GdipGetFontSize (font=0x1c476310, size=0x4368e0) returned 0x0 [0091.686] GdipGetFontStyle (font=0x1c476310, style=0x4368e0) returned 0x0 [0091.686] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.686] GdipDeleteStringFormat (format=0x1c476310) returned 0x0 [0091.687] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0091.687] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2ee0 [0091.687] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0091.687] CoTaskMemFree (pv=0x1f2f2ee0) [0091.687] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x436570) returned 0x0 [0091.688] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x436580) returned 0x0 [0091.688] GdipSetStringFormatFlags (format=0x1c476540, flags=0) returned 0x0 [0091.688] GdipSetStringFormatTrimming (format=0x1c476540, trimming=0x1) returned 0x0 [0091.688] GdipSetStringFormatHotkeyPrefix (format=0x1c476540, hotkeyPrefix=2) returned 0x0 [0091.688] GdipSetStringFormatAlign (format=0x1c476540, align=0x1) returned 0x0 [0091.688] GdipSetStringFormatLineAlign (format=0x1c476540, align=0x1) returned 0x0 [0091.688] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x436498, stringFormat=0x1c476540, boundingBox=0x436488, codepointsFitted=0x436484, linesFilled=0x436480) returned 0x0 [0091.688] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.688] GdipDeleteStringFormat (format=0x1c476540) returned 0x0 [0091.688] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.688] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0091.689] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0091.689] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2e60 [0091.689] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0091.690] CoTaskMemFree (pv=0x1f2f2e60) [0091.690] GdipCreateRegion (region=0x4364e0) returned 0x0 [0091.690] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0091.690] GdipCreateMatrix (matrix=0x4364e0) returned 0x0 [0091.690] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4713b0) returned 0x0 [0091.690] GdipIsMatrixIdentity (matrix=0x1c4713b0, result=0x436540) returned 0x0 [0091.690] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c650 [0091.690] GdipGetMatrixElements (matrix=0x1c4713b0, matrixOut=0x1f32c650) returned 0x0 [0091.690] LocalFree (hMem=0x1f32c650) returned 0x0 [0091.690] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32be90 [0091.690] GdipGetMatrixElements (matrix=0x1c4713b0, matrixOut=0x1f32be90) returned 0x0 [0091.690] LocalFree (hMem=0x1f32be90) returned 0x0 [0091.691] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.691] GdipDeleteMatrix (matrix=0x1c4713b0) returned 0x0 [0091.691] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x436590) returned 0x0 [0091.691] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x436550) returned 0x0 [0091.691] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x436550) returned 0x0 [0091.691] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.691] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0091.691] GdipGetDC (graphics=0x1c46d570, hdc=0x4365c0) returned 0x0 [0091.691] GetCurrentObject (hdc=0xe010802, type=0x1) returned 0x1b00017 [0091.691] GetCurrentObject (hdc=0xe010802, type=0x2) returned 0x1900010 [0091.691] GetCurrentObject (hdc=0xe010802, type=0x7) returned 0x2905055a [0091.691] GetCurrentObject (hdc=0xe010802, type=0x6) returned 0x18a0048 [0091.691] SaveDC (hdc=0xe010802) returned 1 [0091.691] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5b0406cc [0091.692] GetClipRgn (hdc=0xe010802, hrgn=0x5b0406cc) returned 0 [0091.692] SelectClipRgn (hdc=0xe010802, hrgn=0x550405d8) returned 2 [0091.692] DeleteObject (ho=0x5b0406cc) returned 1 [0091.692] DeleteObject (ho=0x550405d8) returned 1 [0091.692] OffsetViewportOrgEx (in: hdc=0xe010802, x=0, y=0, lppt=0x25b1068 | out: lppt=0x25b1068) returned 1 [0091.692] GetNearestColor (hdc=0xe010802, color=0xf0f0f0) returned 0xf0f0f0 [0091.692] CreateSolidBrush (color=0xf0f0f0) returned 0x1c10075d [0091.692] FillRect (hDC=0xe010802, lprc=0x436590, hbr=0x1c10075d) returned 1 [0091.692] DeleteObject (ho=0x1c10075d) returned 1 [0091.692] RestoreDC (hdc=0xe010802, nSavedDC=-1) returned 1 [0091.692] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.692] GdipReleaseDC (graphics=0x1c46d570, hdc=0xe010802) returned 0x0 [0091.693] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0091.693] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3120 [0091.694] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0091.694] CoTaskMemFree (pv=0x1f2f3120) [0091.694] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x436610) returned 0x0 [0091.694] GdipSetStringFormatAlign (format=0x1c476770, align=0x1) returned 0x0 [0091.694] GdipSetStringFormatLineAlign (format=0x1c476770, align=0x1) returned 0x0 [0091.694] GdipSetStringFormatHotkeyPrefix (format=0x1c476770, hotkeyPrefix=2) returned 0x0 [0091.694] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x436680) returned 0x0 [0091.694] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x436590, stringFormat=0x1c476770, brush=0x1c46cce0) returned 0x0 [0091.694] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.694] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0091.694] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.694] GdipDeleteStringFormat (format=0x1c476770) returned 0x0 [0091.694] GetFocus () returned 0xa01fa [0091.695] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0091.695] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3420 [0091.695] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0091.696] CoTaskMemFree (pv=0x1f2f3420) [0091.696] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x436970) returned 0x0 [0091.696] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0091.696] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.696] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0091.696] GdipCreateRegion (region=0x436440) returned 0x0 [0091.696] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0091.696] GdipCreateMatrix (matrix=0x436440) returned 0x0 [0091.696] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471330) returned 0x0 [0091.696] GdipIsMatrixIdentity (matrix=0x1c471330, result=0x4364a0) returned 0x0 [0091.696] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32be90 [0091.696] GdipGetMatrixElements (matrix=0x1c471330, matrixOut=0x1f32be90) returned 0x0 [0091.696] LocalFree (hMem=0x1f32be90) returned 0x0 [0091.696] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32ca50 [0091.696] GdipGetMatrixElements (matrix=0x1c471330, matrixOut=0x1f32ca50) returned 0x0 [0091.697] LocalFree (hMem=0x1f32ca50) returned 0x0 [0091.697] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.697] GdipDeleteMatrix (matrix=0x1c471330) returned 0x0 [0091.697] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x4364f0) returned 0x0 [0091.697] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x4364b0) returned 0x0 [0091.697] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x4364b0) returned 0x0 [0091.697] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.697] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0091.697] GdipGetDC (graphics=0x1c46d570, hdc=0x436520) returned 0x0 [0091.697] GetCurrentObject (hdc=0xe010802, type=0x1) returned 0x1b00017 [0091.697] GetCurrentObject (hdc=0xe010802, type=0x2) returned 0x1900010 [0091.697] GetCurrentObject (hdc=0xe010802, type=0x7) returned 0x2905055a [0091.697] GetCurrentObject (hdc=0xe010802, type=0x6) returned 0x18a0048 [0091.697] SaveDC (hdc=0xe010802) returned 1 [0091.698] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x560405d8 [0091.698] GetClipRgn (hdc=0xe010802, hrgn=0x560405d8) returned 0 [0091.698] SelectClipRgn (hdc=0xe010802, hrgn=0x5c0406cc) returned 2 [0091.698] DeleteObject (ho=0x560405d8) returned 1 [0091.698] DeleteObject (ho=0x5c0406cc) returned 1 [0091.698] OffsetViewportOrgEx (in: hdc=0xe010802, x=0, y=0, lppt=0x25b1608 | out: lppt=0x25b1608) returned 1 [0091.698] GetROP2 (hdc=0xe010802) returned 13 [0091.698] GetBkMode (hdc=0xe010802) returned 2 [0091.698] SetBkMode (hdc=0xe010802, mode=1) returned 2 [0091.698] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x63007fe [0091.698] SelectObject (hdc=0xe010802, h=0x63007fe) returned 0x1b00017 [0091.698] MoveToEx (in: hdc=0xe010802, x=123, y=1, lppt=0x25b1670 | out: lppt=0x25b1670) returned 1 [0091.698] LineTo (hdc=0xe010802, x=1, y=1) returned 1 [0091.699] SetBkMode (hdc=0xe010802, mode=2) returned 1 [0091.699] MoveToEx (in: hdc=0xe010802, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0091.699] GetROP2 (hdc=0xe010802) returned 13 [0091.699] GetBkMode (hdc=0xe010802) returned 2 [0091.699] SetBkMode (hdc=0xe010802, mode=1) returned 2 [0091.699] SelectObject (hdc=0xe010802, h=0x63007fe) returned 0x63007fe [0091.699] MoveToEx (in: hdc=0xe010802, x=1, y=1, lppt=0x25b1688 | out: lppt=0x25b1688) returned 1 [0091.699] LineTo (hdc=0xe010802, x=1, y=34) returned 1 [0091.699] SetBkMode (hdc=0xe010802, mode=2) returned 1 [0091.699] MoveToEx (in: hdc=0xe010802, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0091.699] SelectObject (hdc=0xe010802, h=0x1b00017) returned 0x63007fe [0091.699] DeleteObject (ho=0x63007fe) returned 1 [0091.699] GetROP2 (hdc=0xe010802) returned 13 [0091.699] GetBkMode (hdc=0xe010802) returned 2 [0091.699] SetBkMode (hdc=0xe010802, mode=1) returned 2 [0091.699] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x6300801 [0091.699] SelectObject (hdc=0xe010802, h=0x6300801) returned 0x1b00017 [0091.700] MoveToEx (in: hdc=0xe010802, x=1, y=34, lppt=0x25b16f0 | out: lppt=0x25b16f0) returned 1 [0091.700] LineTo (hdc=0xe010802, x=123, y=34) returned 1 [0091.700] SetBkMode (hdc=0xe010802, mode=2) returned 1 [0091.700] MoveToEx (in: hdc=0xe010802, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0091.700] GetROP2 (hdc=0xe010802) returned 13 [0091.700] GetBkMode (hdc=0xe010802) returned 2 [0091.700] SetBkMode (hdc=0xe010802, mode=1) returned 2 [0091.700] SelectObject (hdc=0xe010802, h=0x6300801) returned 0x6300801 [0091.700] MoveToEx (in: hdc=0xe010802, x=123, y=34, lppt=0x25b1708 | out: lppt=0x25b1708) returned 1 [0091.700] LineTo (hdc=0xe010802, x=123, y=0) returned 1 [0091.700] SetBkMode (hdc=0xe010802, mode=2) returned 1 [0091.700] MoveToEx (in: hdc=0xe010802, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0091.700] SelectObject (hdc=0xe010802, h=0x1b00017) returned 0x6300801 [0091.700] DeleteObject (ho=0x6300801) returned 1 [0091.700] GetROP2 (hdc=0xe010802) returned 13 [0091.700] GetBkMode (hdc=0xe010802) returned 2 [0091.700] SetBkMode (hdc=0xe010802, mode=1) returned 2 [0091.701] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x73007fe [0091.701] SelectObject (hdc=0xe010802, h=0x73007fe) returned 0x1b00017 [0091.701] MoveToEx (in: hdc=0xe010802, x=122, y=2, lppt=0x25b1770 | out: lppt=0x25b1770) returned 1 [0091.701] LineTo (hdc=0xe010802, x=2, y=2) returned 1 [0091.701] SetBkMode (hdc=0xe010802, mode=2) returned 1 [0091.701] MoveToEx (in: hdc=0xe010802, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0091.701] GetROP2 (hdc=0xe010802) returned 13 [0091.701] GetBkMode (hdc=0xe010802) returned 2 [0091.701] SetBkMode (hdc=0xe010802, mode=1) returned 2 [0091.701] SelectObject (hdc=0xe010802, h=0x73007fe) returned 0x73007fe [0091.701] MoveToEx (in: hdc=0xe010802, x=2, y=2, lppt=0x25b1788 | out: lppt=0x25b1788) returned 1 [0091.701] LineTo (hdc=0xe010802, x=2, y=33) returned 1 [0091.701] SetBkMode (hdc=0xe010802, mode=2) returned 1 [0091.701] MoveToEx (in: hdc=0xe010802, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0091.701] SelectObject (hdc=0xe010802, h=0x1b00017) returned 0x73007fe [0091.701] DeleteObject (ho=0x73007fe) returned 1 [0091.701] GetROP2 (hdc=0xe010802) returned 13 [0091.702] GetBkMode (hdc=0xe010802) returned 2 [0091.702] SetBkMode (hdc=0xe010802, mode=1) returned 2 [0091.702] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x7300801 [0091.702] SelectObject (hdc=0xe010802, h=0x7300801) returned 0x1b00017 [0091.702] MoveToEx (in: hdc=0xe010802, x=2, y=33, lppt=0x25b17f0 | out: lppt=0x25b17f0) returned 1 [0091.702] LineTo (hdc=0xe010802, x=122, y=33) returned 1 [0091.702] SetBkMode (hdc=0xe010802, mode=2) returned 1 [0091.702] MoveToEx (in: hdc=0xe010802, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0091.702] GetROP2 (hdc=0xe010802) returned 13 [0091.702] GetBkMode (hdc=0xe010802) returned 2 [0091.702] SetBkMode (hdc=0xe010802, mode=1) returned 2 [0091.702] SelectObject (hdc=0xe010802, h=0x7300801) returned 0x7300801 [0091.702] MoveToEx (in: hdc=0xe010802, x=122, y=33, lppt=0x25b1808 | out: lppt=0x25b1808) returned 1 [0091.702] LineTo (hdc=0xe010802, x=122, y=1) returned 1 [0091.702] SetBkMode (hdc=0xe010802, mode=2) returned 1 [0091.702] MoveToEx (in: hdc=0xe010802, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0091.702] SelectObject (hdc=0xe010802, h=0x1b00017) returned 0x7300801 [0091.702] DeleteObject (ho=0x7300801) returned 1 [0091.703] RestoreDC (hdc=0xe010802, nSavedDC=-1) returned 1 [0091.703] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.703] GdipReleaseDC (graphics=0x1c46d570, hdc=0xe010802) returned 0x0 [0091.703] GdipGetDC (graphics=0x1c46d570, hdc=0x436ca0) returned 0x0 [0091.703] BitBlt (hdc=0x10105c2, x=0, y=0, cx=125, cy=36, hdcSrc=0xe010802, x1=0, y1=0, rop=0xcc0020) returned 1 [0091.705] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.705] GdipReleaseDC (graphics=0x1c46d570, hdc=0xe010802) returned 0x0 [0091.705] SelectPalette (hdc=0x10105c2, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0091.705] SelectObject (hdc=0xe010802, h=0x185000f) returned 0x2905055a [0091.706] DeleteDC (hdc=0xe010802) returned 1 [0091.706] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0091.706] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0091.706] EndPaint (hWnd=0xa01fa, lpPaint=0x436da8) returned 1 [0091.706] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25b1860, cPoints=0x1 | out: lpPoints=0x25b1860) returned 39715228 [0091.706] WindowFromPoint (Point=0x26a000001e7) returned 0xa01fa [0091.706] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26a01e7) returned 0x1 [0091.706] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0091.706] NotifyWinEvent (event=0x800c, hwnd=0xa01fa, idObject=-4, idChild=0) [0091.706] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0xfffffffffffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0091.706] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x437680) returned 0x0 [0091.707] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x437680) returned 0x0 [0091.733] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x5f94c0 [0091.733] RtlMoveMemory (in: Destination=0x5f94c0, Source=0x2594d08, Length=0x70 | out: Destination=0x5f94c0) [0091.733] ShellExecuteExW (in: pExecInfo=0x25b2f60*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25b2f60*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0092.188] GetKeyState (nVirtKey=1) returned 0 [0092.188] GetKeyState (nVirtKey=2) returned 0 [0092.188] GetKeyState (nVirtKey=4) returned 0 [0092.188] GetKeyState (nVirtKey=5) returned 0 [0092.188] GetKeyState (nVirtKey=6) returned 0 [0094.510] GetKeyState (nVirtKey=1) returned 0 [0094.510] GetKeyState (nVirtKey=2) returned 0 [0094.510] GetKeyState (nVirtKey=4) returned 0 [0094.510] GetKeyState (nVirtKey=5) returned 0 [0094.510] GetKeyState (nVirtKey=6) returned 0 [0094.699] GetKeyState (nVirtKey=1) returned 0 [0094.699] GetKeyState (nVirtKey=2) returned 0 [0094.699] GetKeyState (nVirtKey=4) returned 0 [0094.699] GetKeyState (nVirtKey=5) returned 0 [0094.699] GetKeyState (nVirtKey=6) returned 0 [0094.768] GetKeyState (nVirtKey=1) returned -127 [0094.768] GetKeyState (nVirtKey=2) returned 0 [0094.768] GetKeyState (nVirtKey=4) returned 0 [0094.768] GetKeyState (nVirtKey=5) returned 0 [0094.768] GetKeyState (nVirtKey=6) returned 0 [0094.768] IsWindowVisible (hWnd=0xa01fa) returned 1 [0094.768] IsWindowEnabled (hWnd=0xa01fa) returned 1 [0094.768] SetFocus (hWnd=0xa01fa) returned 0xa01fa [0094.768] GetFocus () returned 0xa01fa [0094.768] GetFocus () returned 0xa01fa [0094.768] GetFocus () returned 0xa01fa [0094.768] GetKeyState (nVirtKey=1) returned -127 [0094.768] GetKeyState (nVirtKey=2) returned 0 [0094.768] GetKeyState (nVirtKey=4) returned 0 [0094.768] GetKeyState (nVirtKey=5) returned 0 [0094.768] GetKeyState (nVirtKey=6) returned 0 [0094.768] GetCapture () returned 0xa01fa [0094.768] GetKeyState (nVirtKey=1) returned -127 [0094.768] GetKeyState (nVirtKey=2) returned 0 [0094.768] GetKeyState (nVirtKey=4) returned 0 [0094.768] GetKeyState (nVirtKey=5) returned 0 [0094.768] GetKeyState (nVirtKey=6) returned 0 [0094.768] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0094.768] InvalidateRect (hWnd=0xa01fa, lpRect=0x436bb0, bErase=0) returned 1 [0094.769] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25b30d8, cPoints=0x1 | out: lpPoints=0x25b30d8) returned 39715228 [0094.769] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0094.769] InvalidateRect (hWnd=0xa01fa, lpRect=0x436b00, bErase=0) returned 1 [0094.769] UpdateWindow (hWnd=0xa01fa) returned 1 [0094.769] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x436118 | out: lpPaint=0x436118) returned 0xa0100d0 [0094.769] SelectPalette (hdc=0xa0100d0, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0094.769] CreateCompatibleDC (hdc=0xa0100d0) returned 0xf010835 [0094.769] SelectObject (hdc=0xf010835, h=0x2905055a) returned 0x185000f [0094.769] GdipCreateFromHDC (hdc=0xf010835, graphics=0x435f20) returned 0x0 [0094.769] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0094.770] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0094.770] GdipCreateMatrix (matrix=0x436050) returned 0x0 [0094.770] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471730) returned 0x0 [0094.770] GdipIsMatrixIdentity (matrix=0x1c471730, result=0x4360b0) returned 0x0 [0094.770] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32cd10 [0094.770] GdipGetMatrixElements (matrix=0x1c471730, matrixOut=0x1f32cd10) returned 0x0 [0094.770] LocalFree (hMem=0x1f32cd10) returned 0x0 [0094.770] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.770] GdipDeleteMatrix (matrix=0x1c471730) returned 0x0 [0094.770] GdipCreateRegion (region=0x436050) returned 0x0 [0094.770] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0094.770] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x436080) returned 0x0 [0094.770] GdipSaveGraphics (graphics=0x1c46d570, state=0x436150) returned 0x0 [0094.770] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd7f0dbd) returned 0x0 [0094.770] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.770] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0094.771] GdipGetDC (graphics=0x1c46d570, hdc=0x435540) returned 0x0 [0094.771] GetCurrentObject (hdc=0xf010835, type=0x1) returned 0x1b00017 [0094.771] GetCurrentObject (hdc=0xf010835, type=0x2) returned 0x1900010 [0094.771] GetCurrentObject (hdc=0xf010835, type=0x7) returned 0x2905055a [0094.771] GetCurrentObject (hdc=0xf010835, type=0x6) returned 0x18a0048 [0094.771] SaveDC (hdc=0xf010835) returned 1 [0094.771] GetNearestColor (hdc=0xf010835, color=0xf0f0f0) returned 0xf0f0f0 [0094.771] GetNearestColor (hdc=0xf010835, color=0xa0a0a0) returned 0xa0a0a0 [0094.771] GetNearestColor (hdc=0xf010835, color=0x696969) returned 0x696969 [0094.771] GetNearestColor (hdc=0xf010835, color=0xa0a0a0) returned 0xa0a0a0 [0094.771] GetNearestColor (hdc=0xf010835, color=0x0) returned 0x0 [0094.772] GetNearestColor (hdc=0xf010835, color=0xffffff) returned 0xffffff [0094.772] GetNearestColor (hdc=0xf010835, color=0xe5e5e5) returned 0xe5e5e5 [0094.772] GetNearestColor (hdc=0xf010835, color=0xd8d8d8) returned 0xd8d8d8 [0094.772] GetNearestColor (hdc=0xf010835, color=0x0) returned 0x0 [0094.772] RestoreDC (hdc=0xf010835, nSavedDC=-1) returned 1 [0094.772] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.772] GdipReleaseDC (graphics=0x1c46d570, hdc=0xf010835) returned 0x0 [0094.773] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0094.773] CoTaskMemAlloc (cb=0x13) returned 0x633960 [0094.773] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0094.773] CoTaskMemFree (pv=0x633960) [0094.773] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x435c30) returned 0x0 [0094.773] GdipSetStringFormatAlign (format=0x1c4760e0, align=0x1) returned 0x0 [0094.773] GdipSetStringFormatLineAlign (format=0x1c4760e0, align=0x1) returned 0x0 [0094.773] GdipSetStringFormatHotkeyPrefix (format=0x1c4760e0, hotkeyPrefix=2) returned 0x0 [0094.773] GdipGetStringFormatFlags (format=0x1c4760e0, flags=0x435c60) returned 0x0 [0094.774] GdipGetStringFormatTrimming (format=0x1c4760e0, trimming=0x435c60) returned 0x0 [0094.774] GdipGetStringFormatHotkeyPrefix (format=0x1c4760e0, hotkeyPrefix=0x435c60) returned 0x0 [0094.774] GdipGetFontSize (font=0x1c4760e0, size=0x435c60) returned 0x0 [0094.774] GdipGetFontStyle (font=0x1c4760e0, style=0x435c60) returned 0x0 [0094.774] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.774] GdipDeleteStringFormat (format=0x1c4760e0) returned 0x0 [0094.774] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0094.774] CoTaskMemAlloc (cb=0x13) returned 0x633ea0 [0094.775] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0094.775] CoTaskMemFree (pv=0x633ea0) [0094.775] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x4358f0) returned 0x0 [0094.775] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x435900) returned 0x0 [0094.775] GdipSetStringFormatFlags (format=0x1c4765b0, flags=0) returned 0x0 [0094.775] GdipSetStringFormatTrimming (format=0x1c4765b0, trimming=0x1) returned 0x0 [0094.775] GdipSetStringFormatHotkeyPrefix (format=0x1c4765b0, hotkeyPrefix=2) returned 0x0 [0094.775] GdipSetStringFormatAlign (format=0x1c4765b0, align=0x1) returned 0x0 [0094.775] GdipSetStringFormatLineAlign (format=0x1c4765b0, align=0x1) returned 0x0 [0094.775] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x435818, stringFormat=0x1c4765b0, boundingBox=0x435808, codepointsFitted=0x435804, linesFilled=0x435800) returned 0x0 [0094.775] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.775] GdipDeleteStringFormat (format=0x1c4765b0) returned 0x0 [0094.775] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.775] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0094.776] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0094.776] CoTaskMemAlloc (cb=0x13) returned 0x633aa0 [0094.776] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0094.776] CoTaskMemFree (pv=0x633aa0) [0094.776] GdipCreateRegion (region=0x435860) returned 0x0 [0094.776] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0094.776] GdipCreateMatrix (matrix=0x435860) returned 0x0 [0094.776] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4714b0) returned 0x0 [0094.776] GdipIsMatrixIdentity (matrix=0x1c4714b0, result=0x4358c0) returned 0x0 [0094.776] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c150 [0094.777] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f32c150) returned 0x0 [0094.777] LocalFree (hMem=0x1f32c150) returned 0x0 [0094.777] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c550 [0094.777] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f32c550) returned 0x0 [0094.777] LocalFree (hMem=0x1f32c550) returned 0x0 [0094.777] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.777] GdipDeleteMatrix (matrix=0x1c4714b0) returned 0x0 [0094.777] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x435910) returned 0x0 [0094.777] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x4358d0) returned 0x0 [0094.777] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x4358d0) returned 0x0 [0094.777] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.777] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0094.777] GdipGetDC (graphics=0x1c46d570, hdc=0x435940) returned 0x0 [0094.777] GetCurrentObject (hdc=0xf010835, type=0x1) returned 0x1b00017 [0094.777] GetCurrentObject (hdc=0xf010835, type=0x2) returned 0x1900010 [0094.777] GetCurrentObject (hdc=0xf010835, type=0x7) returned 0x2905055a [0094.777] GetCurrentObject (hdc=0xf010835, type=0x6) returned 0x18a0048 [0094.778] SaveDC (hdc=0xf010835) returned 1 [0094.778] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5d0406cc [0094.778] GetClipRgn (hdc=0xf010835, hrgn=0x5d0406cc) returned 0 [0094.778] SelectClipRgn (hdc=0xf010835, hrgn=0x570405d8) returned 2 [0094.778] DeleteObject (ho=0x5d0406cc) returned 1 [0094.778] DeleteObject (ho=0x570405d8) returned 1 [0094.778] OffsetViewportOrgEx (in: hdc=0xf010835, x=0, y=0, lppt=0x25b3d58 | out: lppt=0x25b3d58) returned 1 [0094.778] GetNearestColor (hdc=0xf010835, color=0xf0f0f0) returned 0xf0f0f0 [0094.778] CreateSolidBrush (color=0xf0f0f0) returned 0x1d10075d [0094.778] FillRect (hDC=0xf010835, lprc=0x435910, hbr=0x1d10075d) returned 1 [0094.778] DeleteObject (ho=0x1d10075d) returned 1 [0094.778] RestoreDC (hdc=0xf010835, nSavedDC=-1) returned 1 [0094.778] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.779] GdipReleaseDC (graphics=0x1c46d570, hdc=0xf010835) returned 0x0 [0094.779] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0094.779] CoTaskMemAlloc (cb=0x13) returned 0x633d00 [0094.779] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0094.779] CoTaskMemFree (pv=0x633d00) [0094.779] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x435990) returned 0x0 [0094.780] GdipSetStringFormatAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0094.780] GdipSetStringFormatLineAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0094.780] GdipSetStringFormatHotkeyPrefix (format=0x1c4762a0, hotkeyPrefix=2) returned 0x0 [0094.780] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x435a00) returned 0x0 [0094.780] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x435910, stringFormat=0x1c4762a0, brush=0x1c46cce0) returned 0x0 [0094.780] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.780] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0094.780] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.780] GdipDeleteStringFormat (format=0x1c4762a0) returned 0x0 [0094.780] GetFocus () returned 0xa01fa [0094.781] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0094.781] CoTaskMemAlloc (cb=0x13) returned 0x633840 [0094.781] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0094.781] CoTaskMemFree (pv=0x633840) [0094.781] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x435cf0) returned 0x0 [0094.781] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0094.781] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.781] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0094.783] GdipCreateRegion (region=0x4357c0) returned 0x0 [0094.783] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0094.783] GdipCreateMatrix (matrix=0x4357c0) returned 0x0 [0094.783] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4712f0) returned 0x0 [0094.783] GdipIsMatrixIdentity (matrix=0x1c4712f0, result=0x435820) returned 0x0 [0094.783] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32be50 [0094.783] GdipGetMatrixElements (matrix=0x1c4712f0, matrixOut=0x1f32be50) returned 0x0 [0094.784] LocalFree (hMem=0x1f32be50) returned 0x0 [0094.784] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c5d0 [0094.784] GdipGetMatrixElements (matrix=0x1c4712f0, matrixOut=0x1f32c5d0) returned 0x0 [0094.784] LocalFree (hMem=0x1f32c5d0) returned 0x0 [0094.784] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.784] GdipDeleteMatrix (matrix=0x1c4712f0) returned 0x0 [0094.784] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x435870) returned 0x0 [0094.784] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x435830) returned 0x0 [0094.784] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x435830) returned 0x0 [0094.784] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.784] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0094.784] GdipGetDC (graphics=0x1c46d570, hdc=0x4358a0) returned 0x0 [0094.784] GetCurrentObject (hdc=0xf010835, type=0x1) returned 0x1b00017 [0094.784] GetCurrentObject (hdc=0xf010835, type=0x2) returned 0x1900010 [0094.784] GetCurrentObject (hdc=0xf010835, type=0x7) returned 0x2905055a [0094.784] GetCurrentObject (hdc=0xf010835, type=0x6) returned 0x18a0048 [0094.784] SaveDC (hdc=0xf010835) returned 1 [0094.785] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x580405d8 [0094.785] GetClipRgn (hdc=0xf010835, hrgn=0x580405d8) returned 0 [0094.785] SelectClipRgn (hdc=0xf010835, hrgn=0x5e0406cc) returned 2 [0094.785] DeleteObject (ho=0x580405d8) returned 1 [0094.785] DeleteObject (ho=0x5e0406cc) returned 1 [0094.785] OffsetViewportOrgEx (in: hdc=0xf010835, x=0, y=0, lppt=0x25b42f8 | out: lppt=0x25b42f8) returned 1 [0094.785] GetROP2 (hdc=0xf010835) returned 13 [0094.785] GetBkMode (hdc=0xf010835) returned 2 [0094.785] SetBkMode (hdc=0xf010835, mode=1) returned 2 [0094.785] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x1f30083b [0094.785] SelectObject (hdc=0xf010835, h=0x1f30083b) returned 0x1b00017 [0094.785] MoveToEx (in: hdc=0xf010835, x=123, y=1, lppt=0x25b4360 | out: lppt=0x25b4360) returned 1 [0094.785] LineTo (hdc=0xf010835, x=1, y=1) returned 1 [0094.785] SetBkMode (hdc=0xf010835, mode=2) returned 1 [0094.785] MoveToEx (in: hdc=0xf010835, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0094.786] GetROP2 (hdc=0xf010835) returned 13 [0094.786] GetBkMode (hdc=0xf010835) returned 2 [0094.786] SetBkMode (hdc=0xf010835, mode=1) returned 2 [0094.786] SelectObject (hdc=0xf010835, h=0x1f30083b) returned 0x1f30083b [0094.786] MoveToEx (in: hdc=0xf010835, x=1, y=1, lppt=0x25b4378 | out: lppt=0x25b4378) returned 1 [0094.786] LineTo (hdc=0xf010835, x=1, y=34) returned 1 [0094.786] SetBkMode (hdc=0xf010835, mode=2) returned 1 [0094.786] MoveToEx (in: hdc=0xf010835, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0094.786] SelectObject (hdc=0xf010835, h=0x1b00017) returned 0x1f30083b [0094.786] DeleteObject (ho=0x1f30083b) returned 1 [0094.786] GetROP2 (hdc=0xf010835) returned 13 [0094.786] GetBkMode (hdc=0xf010835) returned 2 [0094.786] SetBkMode (hdc=0xf010835, mode=1) returned 2 [0094.786] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x1030083a [0094.786] SelectObject (hdc=0xf010835, h=0x1030083a) returned 0x1b00017 [0094.786] MoveToEx (in: hdc=0xf010835, x=1, y=34, lppt=0x25b43e0 | out: lppt=0x25b43e0) returned 1 [0094.786] LineTo (hdc=0xf010835, x=123, y=34) returned 1 [0094.786] SetBkMode (hdc=0xf010835, mode=2) returned 1 [0094.786] MoveToEx (in: hdc=0xf010835, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0094.787] GetROP2 (hdc=0xf010835) returned 13 [0094.787] GetBkMode (hdc=0xf010835) returned 2 [0094.787] SetBkMode (hdc=0xf010835, mode=1) returned 2 [0094.787] SelectObject (hdc=0xf010835, h=0x1030083a) returned 0x1030083a [0094.787] MoveToEx (in: hdc=0xf010835, x=123, y=34, lppt=0x25b43f8 | out: lppt=0x25b43f8) returned 1 [0094.787] LineTo (hdc=0xf010835, x=123, y=0) returned 1 [0094.787] SetBkMode (hdc=0xf010835, mode=2) returned 1 [0094.787] MoveToEx (in: hdc=0xf010835, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0094.787] SelectObject (hdc=0xf010835, h=0x1b00017) returned 0x1030083a [0094.787] DeleteObject (ho=0x1030083a) returned 1 [0094.787] GetROP2 (hdc=0xf010835) returned 13 [0094.787] GetBkMode (hdc=0xf010835) returned 2 [0094.787] SetBkMode (hdc=0xf010835, mode=1) returned 2 [0094.787] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x2030083b [0094.787] SelectObject (hdc=0xf010835, h=0x2030083b) returned 0x1b00017 [0094.787] MoveToEx (in: hdc=0xf010835, x=122, y=2, lppt=0x25b4460 | out: lppt=0x25b4460) returned 1 [0094.787] LineTo (hdc=0xf010835, x=2, y=2) returned 1 [0094.787] SetBkMode (hdc=0xf010835, mode=2) returned 1 [0094.788] MoveToEx (in: hdc=0xf010835, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0094.788] GetROP2 (hdc=0xf010835) returned 13 [0094.788] GetBkMode (hdc=0xf010835) returned 2 [0094.788] SetBkMode (hdc=0xf010835, mode=1) returned 2 [0094.788] SelectObject (hdc=0xf010835, h=0x2030083b) returned 0x2030083b [0094.788] MoveToEx (in: hdc=0xf010835, x=2, y=2, lppt=0x25b4478 | out: lppt=0x25b4478) returned 1 [0094.788] LineTo (hdc=0xf010835, x=2, y=33) returned 1 [0094.788] SetBkMode (hdc=0xf010835, mode=2) returned 1 [0094.788] MoveToEx (in: hdc=0xf010835, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0094.788] SelectObject (hdc=0xf010835, h=0x1b00017) returned 0x2030083b [0094.788] DeleteObject (ho=0x2030083b) returned 1 [0094.788] GetROP2 (hdc=0xf010835) returned 13 [0094.788] GetBkMode (hdc=0xf010835) returned 2 [0094.788] SetBkMode (hdc=0xf010835, mode=1) returned 2 [0094.788] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x1130083a [0094.788] SelectObject (hdc=0xf010835, h=0x1130083a) returned 0x1b00017 [0094.788] MoveToEx (in: hdc=0xf010835, x=2, y=33, lppt=0x25b44e0 | out: lppt=0x25b44e0) returned 1 [0094.788] LineTo (hdc=0xf010835, x=122, y=33) returned 1 [0094.789] SetBkMode (hdc=0xf010835, mode=2) returned 1 [0094.789] MoveToEx (in: hdc=0xf010835, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0094.789] GetROP2 (hdc=0xf010835) returned 13 [0094.789] GetBkMode (hdc=0xf010835) returned 2 [0094.789] SetBkMode (hdc=0xf010835, mode=1) returned 2 [0094.789] SelectObject (hdc=0xf010835, h=0x1130083a) returned 0x1130083a [0094.789] MoveToEx (in: hdc=0xf010835, x=122, y=33, lppt=0x25b44f8 | out: lppt=0x25b44f8) returned 1 [0094.789] LineTo (hdc=0xf010835, x=122, y=1) returned 1 [0094.789] SetBkMode (hdc=0xf010835, mode=2) returned 1 [0094.789] MoveToEx (in: hdc=0xf010835, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0094.789] SelectObject (hdc=0xf010835, h=0x1b00017) returned 0x1130083a [0094.789] DeleteObject (ho=0x1130083a) returned 1 [0094.789] RestoreDC (hdc=0xf010835, nSavedDC=-1) returned 1 [0094.789] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.789] GdipReleaseDC (graphics=0x1c46d570, hdc=0xf010835) returned 0x0 [0094.789] GdipGetDC (graphics=0x1c46d570, hdc=0x436020) returned 0x0 [0094.789] BitBlt (hdc=0xa0100d0, x=0, y=0, cx=125, cy=36, hdcSrc=0xf010835, x1=0, y1=0, rop=0xcc0020) returned 1 [0094.790] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.791] GdipReleaseDC (graphics=0x1c46d570, hdc=0xf010835) returned 0x0 [0094.791] SelectPalette (hdc=0xa0100d0, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0094.791] SelectObject (hdc=0xf010835, h=0x185000f) returned 0x2905055a [0094.791] DeleteDC (hdc=0xf010835) returned 1 [0094.791] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0094.791] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0094.791] EndPaint (hWnd=0xa01fa, lpPaint=0x436128) returned 1 [0094.791] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25b4550, cPoints=0x1 | out: lpPoints=0x25b4550) returned 39715228 [0094.791] WindowFromPoint (Point=0x273000001e7) returned 0xa01fa [0094.791] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x27301e7) returned 0x1 [0094.791] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0094.791] NotifyWinEvent (event=0x800c, hwnd=0xa01fa, idObject=-4, idChild=0) [0094.791] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0xfffffffffffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0094.792] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x436a00) returned 0x0 [0094.792] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x436a00) returned 0x0 [0094.803] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x5f8cc0 [0094.803] RtlMoveMemory (in: Destination=0x5f8cc0, Source=0x2594d08, Length=0x70 | out: Destination=0x5f8cc0) [0094.803] ShellExecuteExW (in: pExecInfo=0x25b5e10*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25b5e10*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0095.869] GetKeyState (nVirtKey=1) returned 1 [0095.869] GetKeyState (nVirtKey=2) returned 0 [0095.870] GetKeyState (nVirtKey=4) returned 0 [0095.870] GetKeyState (nVirtKey=5) returned 0 [0095.870] GetKeyState (nVirtKey=6) returned 0 [0096.018] GetKeyState (nVirtKey=1) returned 1 [0096.018] GetKeyState (nVirtKey=2) returned 0 [0096.018] GetKeyState (nVirtKey=4) returned 0 [0096.018] GetKeyState (nVirtKey=5) returned 0 [0096.018] GetKeyState (nVirtKey=6) returned 0 [0096.073] GetKeyState (nVirtKey=1) returned 1 [0096.073] GetKeyState (nVirtKey=2) returned 0 [0096.073] GetKeyState (nVirtKey=4) returned 0 [0096.073] GetKeyState (nVirtKey=5) returned 0 [0096.073] GetKeyState (nVirtKey=6) returned 0 [0096.076] GetKeyState (nVirtKey=1) returned 1 [0096.076] GetKeyState (nVirtKey=2) returned 0 [0096.076] GetKeyState (nVirtKey=4) returned 0 [0096.076] GetKeyState (nVirtKey=5) returned 0 [0096.076] GetKeyState (nVirtKey=6) returned 0 [0096.085] GetKeyState (nVirtKey=1) returned 1 [0096.085] GetKeyState (nVirtKey=2) returned 0 [0096.085] GetKeyState (nVirtKey=4) returned 0 [0096.085] GetKeyState (nVirtKey=5) returned 0 [0096.085] GetKeyState (nVirtKey=6) returned 0 [0096.113] GetKeyState (nVirtKey=1) returned 1 [0096.113] GetKeyState (nVirtKey=2) returned 0 [0096.113] GetKeyState (nVirtKey=4) returned 0 [0096.113] GetKeyState (nVirtKey=5) returned 0 [0096.113] GetKeyState (nVirtKey=6) returned 0 [0096.116] GetKeyState (nVirtKey=1) returned 1 [0096.116] GetKeyState (nVirtKey=2) returned 0 [0096.116] GetKeyState (nVirtKey=4) returned 0 [0096.116] GetKeyState (nVirtKey=5) returned 0 [0096.116] GetKeyState (nVirtKey=6) returned 0 [0096.127] GetKeyState (nVirtKey=1) returned 1 [0096.127] GetKeyState (nVirtKey=2) returned 0 [0096.127] GetKeyState (nVirtKey=4) returned 0 [0096.127] GetKeyState (nVirtKey=5) returned 0 [0096.127] GetKeyState (nVirtKey=6) returned 0 [0097.060] GetKeyState (nVirtKey=1) returned 1 [0097.060] GetKeyState (nVirtKey=2) returned 0 [0097.060] GetKeyState (nVirtKey=4) returned 0 [0097.060] GetKeyState (nVirtKey=5) returned 0 [0097.060] GetKeyState (nVirtKey=6) returned 0 [0097.739] GetKeyState (nVirtKey=1) returned 1 [0097.739] GetKeyState (nVirtKey=2) returned 0 [0097.739] GetKeyState (nVirtKey=4) returned 0 [0097.739] GetKeyState (nVirtKey=5) returned 0 [0097.739] GetKeyState (nVirtKey=6) returned 0 [0097.802] GetKeyState (nVirtKey=1) returned -128 [0097.802] GetKeyState (nVirtKey=2) returned 0 [0097.802] GetKeyState (nVirtKey=4) returned 0 [0097.802] GetKeyState (nVirtKey=5) returned 0 [0097.802] GetKeyState (nVirtKey=6) returned 0 [0097.802] IsWindowVisible (hWnd=0xa01fa) returned 1 [0097.802] IsWindowEnabled (hWnd=0xa01fa) returned 1 [0097.802] SetFocus (hWnd=0xa01fa) returned 0xa01fa [0097.802] GetFocus () returned 0xa01fa [0097.802] GetFocus () returned 0xa01fa [0097.802] GetFocus () returned 0xa01fa [0097.802] GetKeyState (nVirtKey=1) returned -128 [0097.802] GetKeyState (nVirtKey=2) returned 0 [0097.802] GetKeyState (nVirtKey=4) returned 0 [0097.802] GetKeyState (nVirtKey=5) returned 0 [0097.802] GetKeyState (nVirtKey=6) returned 0 [0097.802] GetCapture () returned 0xa01fa [0097.802] GetKeyState (nVirtKey=1) returned -128 [0097.802] GetKeyState (nVirtKey=2) returned 0 [0097.802] GetKeyState (nVirtKey=4) returned 0 [0097.802] GetKeyState (nVirtKey=5) returned 0 [0097.802] GetKeyState (nVirtKey=6) returned 0 [0097.802] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0097.802] InvalidateRect (hWnd=0xa01fa, lpRect=0x435f30, bErase=0) returned 1 [0097.803] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25b60a0, cPoints=0x1 | out: lpPoints=0x25b60a0) returned 39715228 [0097.803] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0097.803] InvalidateRect (hWnd=0xa01fa, lpRect=0x435e80, bErase=0) returned 1 [0097.803] UpdateWindow (hWnd=0xa01fa) returned 1 [0097.803] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x435498 | out: lpPaint=0x435498) returned 0x30108ea [0097.803] SelectPalette (hdc=0x30108ea, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0097.803] CreateCompatibleDC (hdc=0x30108ea) returned 0x20108eb [0097.803] SelectObject (hdc=0x20108eb, h=0x2905055a) returned 0x185000f [0097.803] GdipCreateFromHDC (hdc=0x20108eb, graphics=0x4352a0) returned 0x0 [0097.803] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0097.804] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0097.804] GdipCreateMatrix (matrix=0x4353d0) returned 0x0 [0097.804] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471670) returned 0x0 [0097.804] GdipIsMatrixIdentity (matrix=0x1c471670, result=0x435430) returned 0x0 [0097.804] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c5d0 [0097.804] GdipGetMatrixElements (matrix=0x1c471670, matrixOut=0x1f32c5d0) returned 0x0 [0097.804] LocalFree (hMem=0x1f32c5d0) returned 0x0 [0097.804] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.804] GdipDeleteMatrix (matrix=0x1c471670) returned 0x0 [0097.804] GdipCreateRegion (region=0x4353d0) returned 0x0 [0097.804] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0097.804] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x435400) returned 0x0 [0097.804] GdipSaveGraphics (graphics=0x1c46d570, state=0x4354d0) returned 0x0 [0097.804] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd7c0dbd) returned 0x0 [0097.804] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.804] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0097.804] GdipGetDC (graphics=0x1c46d570, hdc=0x4348c0) returned 0x0 [0097.804] GetCurrentObject (hdc=0x20108eb, type=0x1) returned 0x1b00017 [0097.805] GetCurrentObject (hdc=0x20108eb, type=0x2) returned 0x1900010 [0097.805] GetCurrentObject (hdc=0x20108eb, type=0x7) returned 0x2905055a [0097.805] GetCurrentObject (hdc=0x20108eb, type=0x6) returned 0x18a0048 [0097.805] SaveDC (hdc=0x20108eb) returned 1 [0097.805] GetNearestColor (hdc=0x20108eb, color=0xf0f0f0) returned 0xf0f0f0 [0097.805] GetNearestColor (hdc=0x20108eb, color=0xa0a0a0) returned 0xa0a0a0 [0097.805] GetNearestColor (hdc=0x20108eb, color=0x696969) returned 0x696969 [0097.805] GetNearestColor (hdc=0x20108eb, color=0xa0a0a0) returned 0xa0a0a0 [0097.805] GetNearestColor (hdc=0x20108eb, color=0x0) returned 0x0 [0097.805] GetNearestColor (hdc=0x20108eb, color=0xffffff) returned 0xffffff [0097.805] GetNearestColor (hdc=0x20108eb, color=0xe5e5e5) returned 0xe5e5e5 [0097.805] GetNearestColor (hdc=0x20108eb, color=0xd8d8d8) returned 0xd8d8d8 [0097.806] GetNearestColor (hdc=0x20108eb, color=0x0) returned 0x0 [0097.806] RestoreDC (hdc=0x20108eb, nSavedDC=-1) returned 1 [0097.806] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.806] GdipReleaseDC (graphics=0x1c46d570, hdc=0x20108eb) returned 0x0 [0097.806] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0097.806] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3420 [0097.807] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0097.807] CoTaskMemFree (pv=0x1f2f3420) [0097.807] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x434fb0) returned 0x0 [0097.807] GdipSetStringFormatAlign (format=0x1c476310, align=0x1) returned 0x0 [0097.807] GdipSetStringFormatLineAlign (format=0x1c476310, align=0x1) returned 0x0 [0097.807] GdipSetStringFormatHotkeyPrefix (format=0x1c476310, hotkeyPrefix=2) returned 0x0 [0097.807] GdipGetStringFormatFlags (format=0x1c476310, flags=0x434fe0) returned 0x0 [0097.807] GdipGetStringFormatTrimming (format=0x1c476310, trimming=0x434fe0) returned 0x0 [0097.807] GdipGetStringFormatHotkeyPrefix (format=0x1c476310, hotkeyPrefix=0x434fe0) returned 0x0 [0097.807] GdipGetFontSize (font=0x1c476310, size=0x434fe0) returned 0x0 [0097.807] GdipGetFontStyle (font=0x1c476310, style=0x434fe0) returned 0x0 [0097.807] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.807] GdipDeleteStringFormat (format=0x1c476310) returned 0x0 [0097.808] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0097.808] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3000 [0097.808] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0097.808] CoTaskMemFree (pv=0x1f2f3000) [0097.808] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x434c70) returned 0x0 [0097.808] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x434c80) returned 0x0 [0097.808] GdipSetStringFormatFlags (format=0x1c475a50, flags=0) returned 0x0 [0097.808] GdipSetStringFormatTrimming (format=0x1c475a50, trimming=0x1) returned 0x0 [0097.808] GdipSetStringFormatHotkeyPrefix (format=0x1c475a50, hotkeyPrefix=2) returned 0x0 [0097.808] GdipSetStringFormatAlign (format=0x1c475a50, align=0x1) returned 0x0 [0097.808] GdipSetStringFormatLineAlign (format=0x1c475a50, align=0x1) returned 0x0 [0097.808] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x434b98, stringFormat=0x1c475a50, boundingBox=0x434b88, codepointsFitted=0x434b84, linesFilled=0x434b80) returned 0x0 [0097.809] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.809] GdipDeleteStringFormat (format=0x1c475a50) returned 0x0 [0097.809] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.809] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0097.809] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0097.809] CoTaskMemAlloc (cb=0x13) returned 0x1f2f30c0 [0097.809] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0097.809] CoTaskMemFree (pv=0x1f2f30c0) [0097.809] GdipCreateRegion (region=0x434be0) returned 0x0 [0097.809] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0097.809] GdipCreateMatrix (matrix=0x434be0) returned 0x0 [0097.809] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4715b0) returned 0x0 [0097.810] GdipIsMatrixIdentity (matrix=0x1c4715b0, result=0x434c40) returned 0x0 [0097.810] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c810 [0097.810] GdipGetMatrixElements (matrix=0x1c4715b0, matrixOut=0x1f32c810) returned 0x0 [0097.810] LocalFree (hMem=0x1f32c810) returned 0x0 [0097.810] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c690 [0097.810] GdipGetMatrixElements (matrix=0x1c4715b0, matrixOut=0x1f32c690) returned 0x0 [0097.810] LocalFree (hMem=0x1f32c690) returned 0x0 [0097.810] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.810] GdipDeleteMatrix (matrix=0x1c4715b0) returned 0x0 [0097.810] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x434c90) returned 0x0 [0097.810] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x434c50) returned 0x0 [0097.810] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x434c50) returned 0x0 [0097.810] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.810] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0097.810] GdipGetDC (graphics=0x1c46d570, hdc=0x434cc0) returned 0x0 [0097.811] GetCurrentObject (hdc=0x20108eb, type=0x1) returned 0x1b00017 [0097.811] GetCurrentObject (hdc=0x20108eb, type=0x2) returned 0x1900010 [0097.811] GetCurrentObject (hdc=0x20108eb, type=0x7) returned 0x2905055a [0097.811] GetCurrentObject (hdc=0x20108eb, type=0x6) returned 0x18a0048 [0097.811] SaveDC (hdc=0x20108eb) returned 1 [0097.811] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5f0406cc [0097.811] GetClipRgn (hdc=0x20108eb, hrgn=0x5f0406cc) returned 0 [0097.811] SelectClipRgn (hdc=0x20108eb, hrgn=0x590405d8) returned 2 [0097.811] DeleteObject (ho=0x5f0406cc) returned 1 [0097.811] DeleteObject (ho=0x590405d8) returned 1 [0097.812] OffsetViewportOrgEx (in: hdc=0x20108eb, x=0, y=0, lppt=0x25b6d20 | out: lppt=0x25b6d20) returned 1 [0097.812] GetNearestColor (hdc=0x20108eb, color=0xf0f0f0) returned 0xf0f0f0 [0097.812] CreateSolidBrush (color=0xf0f0f0) returned 0x1e10075d [0097.812] FillRect (hDC=0x20108eb, lprc=0x434c90, hbr=0x1e10075d) returned 1 [0097.812] DeleteObject (ho=0x1e10075d) returned 1 [0097.812] RestoreDC (hdc=0x20108eb, nSavedDC=-1) returned 1 [0097.812] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.812] GdipReleaseDC (graphics=0x1c46d570, hdc=0x20108eb) returned 0x0 [0097.812] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0097.813] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2cc0 [0097.813] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0097.814] CoTaskMemFree (pv=0x1f2f2cc0) [0097.815] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x434d10) returned 0x0 [0097.815] GdipSetStringFormatAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0097.815] GdipSetStringFormatLineAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0097.815] GdipSetStringFormatHotkeyPrefix (format=0x1c4762a0, hotkeyPrefix=2) returned 0x0 [0097.815] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x434d80) returned 0x0 [0097.815] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x434c90, stringFormat=0x1c4762a0, brush=0x1c46cce0) returned 0x0 [0097.815] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.815] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0097.815] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.815] GdipDeleteStringFormat (format=0x1c4762a0) returned 0x0 [0097.815] GetFocus () returned 0xa01fa [0097.816] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0097.816] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2e60 [0097.816] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0097.816] CoTaskMemFree (pv=0x1f2f2e60) [0097.816] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x435070) returned 0x0 [0097.816] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0097.816] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.816] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0097.816] GdipCreateRegion (region=0x434b40) returned 0x0 [0097.817] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0097.817] GdipCreateMatrix (matrix=0x434b40) returned 0x0 [0097.817] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4714b0) returned 0x0 [0097.817] GdipIsMatrixIdentity (matrix=0x1c4714b0, result=0x434ba0) returned 0x0 [0097.817] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c290 [0097.817] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f32c290) returned 0x0 [0097.817] LocalFree (hMem=0x1f32c290) returned 0x0 [0097.817] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32bf90 [0097.817] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f32bf90) returned 0x0 [0097.817] LocalFree (hMem=0x1f32bf90) returned 0x0 [0097.817] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.817] GdipDeleteMatrix (matrix=0x1c4714b0) returned 0x0 [0097.817] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x434bf0) returned 0x0 [0097.817] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x434bb0) returned 0x0 [0097.817] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x434bb0) returned 0x0 [0097.817] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.817] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0097.817] GdipGetDC (graphics=0x1c46d570, hdc=0x434c20) returned 0x0 [0097.818] GetCurrentObject (hdc=0x20108eb, type=0x1) returned 0x1b00017 [0097.818] GetCurrentObject (hdc=0x20108eb, type=0x2) returned 0x1900010 [0097.818] GetCurrentObject (hdc=0x20108eb, type=0x7) returned 0x2905055a [0097.818] GetCurrentObject (hdc=0x20108eb, type=0x6) returned 0x18a0048 [0097.818] SaveDC (hdc=0x20108eb) returned 1 [0097.818] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5a0405d8 [0097.818] GetClipRgn (hdc=0x20108eb, hrgn=0x5a0405d8) returned 0 [0097.818] SelectClipRgn (hdc=0x20108eb, hrgn=0x600406cc) returned 2 [0097.818] DeleteObject (ho=0x5a0405d8) returned 1 [0097.818] DeleteObject (ho=0x600406cc) returned 1 [0097.818] OffsetViewportOrgEx (in: hdc=0x20108eb, x=0, y=0, lppt=0x25b72c0 | out: lppt=0x25b72c0) returned 1 [0097.818] GetROP2 (hdc=0x20108eb) returned 13 [0097.818] GetBkMode (hdc=0x20108eb) returned 2 [0097.818] SetBkMode (hdc=0x20108eb, mode=1) returned 2 [0097.818] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x13008ed [0097.818] SelectObject (hdc=0x20108eb, h=0x13008ed) returned 0x1b00017 [0097.819] MoveToEx (in: hdc=0x20108eb, x=123, y=1, lppt=0x25b7328 | out: lppt=0x25b7328) returned 1 [0097.819] LineTo (hdc=0x20108eb, x=1, y=1) returned 1 [0097.819] SetBkMode (hdc=0x20108eb, mode=2) returned 1 [0097.819] MoveToEx (in: hdc=0x20108eb, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0097.819] GetROP2 (hdc=0x20108eb) returned 13 [0097.819] GetBkMode (hdc=0x20108eb) returned 2 [0097.819] SetBkMode (hdc=0x20108eb, mode=1) returned 2 [0097.819] SelectObject (hdc=0x20108eb, h=0x13008ed) returned 0x13008ed [0097.819] MoveToEx (in: hdc=0x20108eb, x=1, y=1, lppt=0x25b7340 | out: lppt=0x25b7340) returned 1 [0097.819] LineTo (hdc=0x20108eb, x=1, y=34) returned 1 [0097.819] SetBkMode (hdc=0x20108eb, mode=2) returned 1 [0097.819] MoveToEx (in: hdc=0x20108eb, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0097.819] SelectObject (hdc=0x20108eb, h=0x1b00017) returned 0x13008ed [0097.819] DeleteObject (ho=0x13008ed) returned 1 [0097.819] GetROP2 (hdc=0x20108eb) returned 13 [0097.819] GetBkMode (hdc=0x20108eb) returned 2 [0097.819] SetBkMode (hdc=0x20108eb, mode=1) returned 2 [0097.819] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x13008ee [0097.819] SelectObject (hdc=0x20108eb, h=0x13008ee) returned 0x1b00017 [0097.820] MoveToEx (in: hdc=0x20108eb, x=1, y=34, lppt=0x25b73a8 | out: lppt=0x25b73a8) returned 1 [0097.820] LineTo (hdc=0x20108eb, x=123, y=34) returned 1 [0097.820] SetBkMode (hdc=0x20108eb, mode=2) returned 1 [0097.820] MoveToEx (in: hdc=0x20108eb, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0097.820] GetROP2 (hdc=0x20108eb) returned 13 [0097.820] GetBkMode (hdc=0x20108eb) returned 2 [0097.820] SetBkMode (hdc=0x20108eb, mode=1) returned 2 [0097.820] SelectObject (hdc=0x20108eb, h=0x13008ee) returned 0x13008ee [0097.820] MoveToEx (in: hdc=0x20108eb, x=123, y=34, lppt=0x25b73c0 | out: lppt=0x25b73c0) returned 1 [0097.820] LineTo (hdc=0x20108eb, x=123, y=0) returned 1 [0097.820] SetBkMode (hdc=0x20108eb, mode=2) returned 1 [0097.820] MoveToEx (in: hdc=0x20108eb, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0097.820] SelectObject (hdc=0x20108eb, h=0x1b00017) returned 0x13008ee [0097.820] DeleteObject (ho=0x13008ee) returned 1 [0097.820] GetROP2 (hdc=0x20108eb) returned 13 [0097.820] GetBkMode (hdc=0x20108eb) returned 2 [0097.820] SetBkMode (hdc=0x20108eb, mode=1) returned 2 [0097.820] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x23008ed [0097.820] SelectObject (hdc=0x20108eb, h=0x23008ed) returned 0x1b00017 [0097.821] MoveToEx (in: hdc=0x20108eb, x=122, y=2, lppt=0x25b7428 | out: lppt=0x25b7428) returned 1 [0097.821] LineTo (hdc=0x20108eb, x=2, y=2) returned 1 [0097.821] SetBkMode (hdc=0x20108eb, mode=2) returned 1 [0097.821] MoveToEx (in: hdc=0x20108eb, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0097.821] GetROP2 (hdc=0x20108eb) returned 13 [0097.821] GetBkMode (hdc=0x20108eb) returned 2 [0097.821] SetBkMode (hdc=0x20108eb, mode=1) returned 2 [0097.821] SelectObject (hdc=0x20108eb, h=0x23008ed) returned 0x23008ed [0097.821] MoveToEx (in: hdc=0x20108eb, x=2, y=2, lppt=0x25b7440 | out: lppt=0x25b7440) returned 1 [0097.821] LineTo (hdc=0x20108eb, x=2, y=33) returned 1 [0097.821] SetBkMode (hdc=0x20108eb, mode=2) returned 1 [0097.821] MoveToEx (in: hdc=0x20108eb, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0097.821] SelectObject (hdc=0x20108eb, h=0x1b00017) returned 0x23008ed [0097.821] DeleteObject (ho=0x23008ed) returned 1 [0097.821] GetROP2 (hdc=0x20108eb) returned 13 [0097.821] GetBkMode (hdc=0x20108eb) returned 2 [0097.821] SetBkMode (hdc=0x20108eb, mode=1) returned 2 [0097.821] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x23008ee [0097.822] SelectObject (hdc=0x20108eb, h=0x23008ee) returned 0x1b00017 [0097.822] MoveToEx (in: hdc=0x20108eb, x=2, y=33, lppt=0x25b74a8 | out: lppt=0x25b74a8) returned 1 [0097.822] LineTo (hdc=0x20108eb, x=122, y=33) returned 1 [0097.822] SetBkMode (hdc=0x20108eb, mode=2) returned 1 [0097.822] MoveToEx (in: hdc=0x20108eb, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0097.822] GetROP2 (hdc=0x20108eb) returned 13 [0097.822] GetBkMode (hdc=0x20108eb) returned 2 [0097.822] SetBkMode (hdc=0x20108eb, mode=1) returned 2 [0097.822] SelectObject (hdc=0x20108eb, h=0x23008ee) returned 0x23008ee [0097.822] MoveToEx (in: hdc=0x20108eb, x=122, y=33, lppt=0x25b74c0 | out: lppt=0x25b74c0) returned 1 [0097.822] LineTo (hdc=0x20108eb, x=122, y=1) returned 1 [0097.822] SetBkMode (hdc=0x20108eb, mode=2) returned 1 [0097.822] MoveToEx (in: hdc=0x20108eb, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0097.822] SelectObject (hdc=0x20108eb, h=0x1b00017) returned 0x23008ee [0097.822] DeleteObject (ho=0x23008ee) returned 1 [0097.822] RestoreDC (hdc=0x20108eb, nSavedDC=-1) returned 1 [0097.822] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.822] GdipReleaseDC (graphics=0x1c46d570, hdc=0x20108eb) returned 0x0 [0097.822] GdipGetDC (graphics=0x1c46d570, hdc=0x4353a0) returned 0x0 [0097.823] BitBlt (hdc=0x30108ea, x=0, y=0, cx=125, cy=36, hdcSrc=0x20108eb, x1=0, y1=0, rop=0xcc0020) returned 1 [0097.824] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.824] GdipReleaseDC (graphics=0x1c46d570, hdc=0x20108eb) returned 0x0 [0097.824] SelectPalette (hdc=0x30108ea, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0097.824] SelectObject (hdc=0x20108eb, h=0x185000f) returned 0x2905055a [0097.824] DeleteDC (hdc=0x20108eb) returned 1 [0097.824] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0097.824] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0097.824] EndPaint (hWnd=0xa01fa, lpPaint=0x4354a8) returned 1 [0097.824] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25b7518, cPoints=0x1 | out: lpPoints=0x25b7518) returned 39715228 [0097.824] WindowFromPoint (Point=0x26c000001f5) returned 0xa01fa [0097.824] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26c01f5) returned 0x1 [0097.824] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0097.824] NotifyWinEvent (event=0x800c, hwnd=0xa01fa, idObject=-4, idChild=0) [0097.824] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0xfffffffffffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0097.825] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x435d80) returned 0x0 [0097.825] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x435d80) returned 0x0 [0097.834] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x5f9ac0 [0097.834] RtlMoveMemory (in: Destination=0x5f9ac0, Source=0x2594d08, Length=0x70 | out: Destination=0x5f9ac0) [0097.834] ShellExecuteExW (in: pExecInfo=0x25b8f98*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25b8f98*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0098.354] GetKeyState (nVirtKey=1) returned 0 [0098.354] GetKeyState (nVirtKey=2) returned 0 [0098.354] GetKeyState (nVirtKey=4) returned 0 [0098.354] GetKeyState (nVirtKey=5) returned 0 [0098.354] GetKeyState (nVirtKey=6) returned 0 [0098.634] GetKeyState (nVirtKey=1) returned 0 [0098.634] GetKeyState (nVirtKey=2) returned 0 [0098.634] GetKeyState (nVirtKey=4) returned 0 [0098.634] GetKeyState (nVirtKey=5) returned 0 [0098.634] GetKeyState (nVirtKey=6) returned 0 [0098.637] GetKeyState (nVirtKey=1) returned 0 [0098.637] GetKeyState (nVirtKey=2) returned 0 [0098.637] GetKeyState (nVirtKey=4) returned 0 [0098.637] GetKeyState (nVirtKey=5) returned 0 [0098.637] GetKeyState (nVirtKey=6) returned 0 [0098.641] GetKeyState (nVirtKey=1) returned 0 [0098.642] GetKeyState (nVirtKey=2) returned 0 [0098.642] GetKeyState (nVirtKey=4) returned 0 [0098.642] GetKeyState (nVirtKey=5) returned 0 [0098.642] GetKeyState (nVirtKey=6) returned 0 [0099.576] GetKeyState (nVirtKey=1) returned 0 [0099.576] GetKeyState (nVirtKey=2) returned 0 [0099.576] GetKeyState (nVirtKey=4) returned 0 [0099.576] GetKeyState (nVirtKey=5) returned 0 [0099.576] GetKeyState (nVirtKey=6) returned 0 [0100.588] GetKeyState (nVirtKey=1) returned 0 [0100.588] GetKeyState (nVirtKey=2) returned 0 [0100.588] GetKeyState (nVirtKey=4) returned 0 [0100.589] GetKeyState (nVirtKey=5) returned 0 [0100.589] GetKeyState (nVirtKey=6) returned 0 [0100.647] GetKeyState (nVirtKey=1) returned 0 [0100.647] GetKeyState (nVirtKey=2) returned 0 [0100.647] GetKeyState (nVirtKey=4) returned 0 [0100.647] GetKeyState (nVirtKey=5) returned 0 [0100.647] GetKeyState (nVirtKey=6) returned 0 [0100.651] GetKeyState (nVirtKey=1) returned 0 [0100.651] GetKeyState (nVirtKey=2) returned 0 [0100.651] GetKeyState (nVirtKey=4) returned 0 [0100.651] GetKeyState (nVirtKey=5) returned 0 [0100.652] GetKeyState (nVirtKey=6) returned 0 [0100.657] GetKeyState (nVirtKey=1) returned 0 [0100.657] GetKeyState (nVirtKey=2) returned 0 [0100.657] GetKeyState (nVirtKey=4) returned 0 [0100.657] GetKeyState (nVirtKey=5) returned 0 [0100.657] GetKeyState (nVirtKey=6) returned 0 [0100.792] GetKeyState (nVirtKey=1) returned 0 [0100.792] GetKeyState (nVirtKey=2) returned 0 [0100.792] GetKeyState (nVirtKey=4) returned 0 [0100.792] GetKeyState (nVirtKey=5) returned 0 [0100.792] GetKeyState (nVirtKey=6) returned 0 [0100.855] GetKeyState (nVirtKey=1) returned -127 [0100.856] GetKeyState (nVirtKey=2) returned 0 [0100.856] GetKeyState (nVirtKey=4) returned 0 [0100.856] GetKeyState (nVirtKey=5) returned 0 [0100.856] GetKeyState (nVirtKey=6) returned 0 [0100.856] IsWindowVisible (hWnd=0xa01fa) returned 1 [0100.856] IsWindowEnabled (hWnd=0xa01fa) returned 1 [0100.856] SetFocus (hWnd=0xa01fa) returned 0xa01fa [0100.856] GetFocus () returned 0xa01fa [0100.856] GetFocus () returned 0xa01fa [0100.856] GetFocus () returned 0xa01fa [0100.856] GetKeyState (nVirtKey=1) returned -127 [0100.856] GetKeyState (nVirtKey=2) returned 0 [0100.856] GetKeyState (nVirtKey=4) returned 0 [0100.856] GetKeyState (nVirtKey=5) returned 0 [0100.856] GetKeyState (nVirtKey=6) returned 0 [0100.856] GetCapture () returned 0xa01fa [0100.856] GetKeyState (nVirtKey=1) returned -127 [0100.856] GetKeyState (nVirtKey=2) returned 0 [0100.856] GetKeyState (nVirtKey=4) returned 0 [0100.856] GetKeyState (nVirtKey=5) returned 0 [0100.856] GetKeyState (nVirtKey=6) returned 0 [0100.856] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0100.856] InvalidateRect (hWnd=0xa01fa, lpRect=0x4352b0, bErase=0) returned 1 [0100.857] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25b9228, cPoints=0x1 | out: lpPoints=0x25b9228) returned 39715228 [0100.857] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0100.857] InvalidateRect (hWnd=0xa01fa, lpRect=0x435200, bErase=0) returned 1 [0100.857] UpdateWindow (hWnd=0xa01fa) returned 1 [0100.857] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x434818 | out: lpPaint=0x434818) returned 0xa0108e8 [0100.857] SelectPalette (hdc=0xa0108e8, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0100.857] CreateCompatibleDC (hdc=0xa0108e8) returned 0x60108f9 [0100.857] SelectObject (hdc=0x60108f9, h=0x2905055a) returned 0x185000f [0100.857] GdipCreateFromHDC (hdc=0x60108f9, graphics=0x434620) returned 0x0 [0100.857] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0100.857] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0100.858] GdipCreateMatrix (matrix=0x434750) returned 0x0 [0100.858] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471330) returned 0x0 [0100.858] GdipIsMatrixIdentity (matrix=0x1c471330, result=0x4347b0) returned 0x0 [0100.858] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32bf10 [0100.858] GdipGetMatrixElements (matrix=0x1c471330, matrixOut=0x1f32bf10) returned 0x0 [0100.858] LocalFree (hMem=0x1f32bf10) returned 0x0 [0100.858] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.858] GdipDeleteMatrix (matrix=0x1c471330) returned 0x0 [0100.858] GdipCreateRegion (region=0x434750) returned 0x0 [0100.858] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0100.858] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x434780) returned 0x0 [0100.858] GdipSaveGraphics (graphics=0x1c46d570, state=0x434850) returned 0x0 [0100.858] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd790dbd) returned 0x0 [0100.858] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.858] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0100.858] GdipGetDC (graphics=0x1c46d570, hdc=0x433c40) returned 0x0 [0100.859] GetCurrentObject (hdc=0x60108f9, type=0x1) returned 0x1b00017 [0100.859] GetCurrentObject (hdc=0x60108f9, type=0x2) returned 0x1900010 [0100.859] GetCurrentObject (hdc=0x60108f9, type=0x7) returned 0x2905055a [0100.859] GetCurrentObject (hdc=0x60108f9, type=0x6) returned 0x18a0048 [0100.859] SaveDC (hdc=0x60108f9) returned 1 [0100.859] GetNearestColor (hdc=0x60108f9, color=0xf0f0f0) returned 0xf0f0f0 [0100.859] GetNearestColor (hdc=0x60108f9, color=0xa0a0a0) returned 0xa0a0a0 [0100.859] GetNearestColor (hdc=0x60108f9, color=0x696969) returned 0x696969 [0100.859] GetNearestColor (hdc=0x60108f9, color=0xa0a0a0) returned 0xa0a0a0 [0100.859] GetNearestColor (hdc=0x60108f9, color=0x0) returned 0x0 [0100.859] GetNearestColor (hdc=0x60108f9, color=0xffffff) returned 0xffffff [0100.860] GetNearestColor (hdc=0x60108f9, color=0xe5e5e5) returned 0xe5e5e5 [0100.862] GetNearestColor (hdc=0x60108f9, color=0xd8d8d8) returned 0xd8d8d8 [0100.862] GetNearestColor (hdc=0x60108f9, color=0x0) returned 0x0 [0100.862] RestoreDC (hdc=0x60108f9, nSavedDC=-1) returned 1 [0100.863] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.863] GdipReleaseDC (graphics=0x1c46d570, hdc=0x60108f9) returned 0x0 [0100.863] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0100.863] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2ac0 [0100.864] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0100.864] CoTaskMemFree (pv=0x1f2f2ac0) [0100.864] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x434330) returned 0x0 [0100.864] GdipSetStringFormatAlign (format=0x1c475a50, align=0x1) returned 0x0 [0100.864] GdipSetStringFormatLineAlign (format=0x1c475a50, align=0x1) returned 0x0 [0100.864] GdipSetStringFormatHotkeyPrefix (format=0x1c475a50, hotkeyPrefix=2) returned 0x0 [0100.864] GdipGetStringFormatFlags (format=0x1c475a50, flags=0x434360) returned 0x0 [0100.864] GdipGetStringFormatTrimming (format=0x1c475a50, trimming=0x434360) returned 0x0 [0100.864] GdipGetStringFormatHotkeyPrefix (format=0x1c475a50, hotkeyPrefix=0x434360) returned 0x0 [0100.864] GdipGetFontSize (font=0x1c475a50, size=0x434360) returned 0x0 [0100.864] GdipGetFontStyle (font=0x1c475a50, style=0x434360) returned 0x0 [0100.864] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.864] GdipDeleteStringFormat (format=0x1c475a50) returned 0x0 [0100.865] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0100.865] CoTaskMemAlloc (cb=0x13) returned 0x1f2f24a0 [0100.865] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0100.865] CoTaskMemFree (pv=0x1f2f24a0) [0100.865] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x433ff0) returned 0x0 [0100.866] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x434000) returned 0x0 [0100.866] GdipSetStringFormatFlags (format=0x1c476540, flags=0) returned 0x0 [0100.866] GdipSetStringFormatTrimming (format=0x1c476540, trimming=0x1) returned 0x0 [0100.866] GdipSetStringFormatHotkeyPrefix (format=0x1c476540, hotkeyPrefix=2) returned 0x0 [0100.866] GdipSetStringFormatAlign (format=0x1c476540, align=0x1) returned 0x0 [0100.866] GdipSetStringFormatLineAlign (format=0x1c476540, align=0x1) returned 0x0 [0100.866] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x433f18, stringFormat=0x1c476540, boundingBox=0x433f08, codepointsFitted=0x433f04, linesFilled=0x433f00) returned 0x0 [0100.866] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.866] GdipDeleteStringFormat (format=0x1c476540) returned 0x0 [0100.866] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.866] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0100.867] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0100.867] CoTaskMemAlloc (cb=0x13) returned 0x1f2f24a0 [0100.867] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0100.867] CoTaskMemFree (pv=0x1f2f24a0) [0100.867] GdipCreateRegion (region=0x433f60) returned 0x0 [0100.867] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0100.867] GdipCreateMatrix (matrix=0x433f60) returned 0x0 [0100.867] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4715b0) returned 0x0 [0100.867] GdipIsMatrixIdentity (matrix=0x1c4715b0, result=0x433fc0) returned 0x0 [0100.867] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c410 [0100.868] GdipGetMatrixElements (matrix=0x1c4715b0, matrixOut=0x1f32c410) returned 0x0 [0100.868] LocalFree (hMem=0x1f32c410) returned 0x0 [0100.868] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32be50 [0100.868] GdipGetMatrixElements (matrix=0x1c4715b0, matrixOut=0x1f32be50) returned 0x0 [0100.868] LocalFree (hMem=0x1f32be50) returned 0x0 [0100.868] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.868] GdipDeleteMatrix (matrix=0x1c4715b0) returned 0x0 [0100.868] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x434010) returned 0x0 [0100.868] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x433fd0) returned 0x0 [0100.868] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x433fd0) returned 0x0 [0100.868] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.868] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0100.868] GdipGetDC (graphics=0x1c46d570, hdc=0x434040) returned 0x0 [0100.868] GetCurrentObject (hdc=0x60108f9, type=0x1) returned 0x1b00017 [0100.868] GetCurrentObject (hdc=0x60108f9, type=0x2) returned 0x1900010 [0100.868] GetCurrentObject (hdc=0x60108f9, type=0x7) returned 0x2905055a [0100.869] GetCurrentObject (hdc=0x60108f9, type=0x6) returned 0x18a0048 [0100.869] SaveDC (hdc=0x60108f9) returned 1 [0100.869] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x610406cc [0100.869] GetClipRgn (hdc=0x60108f9, hrgn=0x610406cc) returned 0 [0100.869] SelectClipRgn (hdc=0x60108f9, hrgn=0x5b0405d8) returned 2 [0100.869] DeleteObject (ho=0x610406cc) returned 1 [0100.869] DeleteObject (ho=0x5b0405d8) returned 1 [0100.869] OffsetViewportOrgEx (in: hdc=0x60108f9, x=0, y=0, lppt=0x25b9ea8 | out: lppt=0x25b9ea8) returned 1 [0100.869] GetNearestColor (hdc=0x60108f9, color=0xf0f0f0) returned 0xf0f0f0 [0100.869] CreateSolidBrush (color=0xf0f0f0) returned 0x1f10075d [0100.869] FillRect (hDC=0x60108f9, lprc=0x434010, hbr=0x1f10075d) returned 1 [0100.869] DeleteObject (ho=0x1f10075d) returned 1 [0100.869] RestoreDC (hdc=0x60108f9, nSavedDC=-1) returned 1 [0100.870] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.870] GdipReleaseDC (graphics=0x1c46d570, hdc=0x60108f9) returned 0x0 [0100.870] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0100.870] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2520 [0100.871] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0100.871] CoTaskMemFree (pv=0x1f2f2520) [0100.871] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x434090) returned 0x0 [0100.871] GdipSetStringFormatAlign (format=0x1c475f20, align=0x1) returned 0x0 [0100.871] GdipSetStringFormatLineAlign (format=0x1c475f20, align=0x1) returned 0x0 [0100.871] GdipSetStringFormatHotkeyPrefix (format=0x1c475f20, hotkeyPrefix=2) returned 0x0 [0100.871] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x434100) returned 0x0 [0100.871] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x434010, stringFormat=0x1c475f20, brush=0x1c46cce0) returned 0x0 [0100.871] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.871] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0100.871] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.872] GdipDeleteStringFormat (format=0x1c475f20) returned 0x0 [0100.872] GetFocus () returned 0xa01fa [0100.872] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0100.872] CoTaskMemAlloc (cb=0x13) returned 0x1f2f29c0 [0100.872] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0100.872] CoTaskMemFree (pv=0x1f2f29c0) [0100.872] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x4343f0) returned 0x0 [0100.873] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0100.873] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.873] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0100.873] GdipCreateRegion (region=0x433ec0) returned 0x0 [0100.873] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0100.874] GdipCreateMatrix (matrix=0x433ec0) returned 0x0 [0100.874] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471170) returned 0x0 [0100.874] GdipIsMatrixIdentity (matrix=0x1c471170, result=0x433f20) returned 0x0 [0100.874] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c3d0 [0100.874] GdipGetMatrixElements (matrix=0x1c471170, matrixOut=0x1f32c3d0) returned 0x0 [0100.874] LocalFree (hMem=0x1f32c3d0) returned 0x0 [0100.874] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c910 [0100.874] GdipGetMatrixElements (matrix=0x1c471170, matrixOut=0x1f32c910) returned 0x0 [0100.874] LocalFree (hMem=0x1f32c910) returned 0x0 [0100.874] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.874] GdipDeleteMatrix (matrix=0x1c471170) returned 0x0 [0100.874] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x433f70) returned 0x0 [0100.874] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x433f30) returned 0x0 [0100.874] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x433f30) returned 0x0 [0100.874] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.874] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0100.874] GdipGetDC (graphics=0x1c46d570, hdc=0x433fa0) returned 0x0 [0100.874] GetCurrentObject (hdc=0x60108f9, type=0x1) returned 0x1b00017 [0100.874] GetCurrentObject (hdc=0x60108f9, type=0x2) returned 0x1900010 [0100.875] GetCurrentObject (hdc=0x60108f9, type=0x7) returned 0x2905055a [0100.875] GetCurrentObject (hdc=0x60108f9, type=0x6) returned 0x18a0048 [0100.875] SaveDC (hdc=0x60108f9) returned 1 [0100.875] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5c0405d8 [0100.875] GetClipRgn (hdc=0x60108f9, hrgn=0x5c0405d8) returned 0 [0100.875] SelectClipRgn (hdc=0x60108f9, hrgn=0x620406cc) returned 2 [0100.875] DeleteObject (ho=0x5c0405d8) returned 1 [0100.875] DeleteObject (ho=0x620406cc) returned 1 [0100.875] OffsetViewportOrgEx (in: hdc=0x60108f9, x=0, y=0, lppt=0x25ba448 | out: lppt=0x25ba448) returned 1 [0100.875] GetROP2 (hdc=0x60108f9) returned 13 [0100.878] GetBkMode (hdc=0x60108f9) returned 2 [0100.878] SetBkMode (hdc=0x60108f9, mode=1) returned 2 [0100.878] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x33008f8 [0100.878] SelectObject (hdc=0x60108f9, h=0x33008f8) returned 0x1b00017 [0100.878] MoveToEx (in: hdc=0x60108f9, x=123, y=1, lppt=0x25ba4b0 | out: lppt=0x25ba4b0) returned 1 [0100.878] LineTo (hdc=0x60108f9, x=1, y=1) returned 1 [0100.878] SetBkMode (hdc=0x60108f9, mode=2) returned 1 [0100.878] MoveToEx (in: hdc=0x60108f9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0100.878] GetROP2 (hdc=0x60108f9) returned 13 [0100.878] GetBkMode (hdc=0x60108f9) returned 2 [0100.878] SetBkMode (hdc=0x60108f9, mode=1) returned 2 [0100.879] SelectObject (hdc=0x60108f9, h=0x33008f8) returned 0x33008f8 [0100.879] MoveToEx (in: hdc=0x60108f9, x=1, y=1, lppt=0x25ba4c8 | out: lppt=0x25ba4c8) returned 1 [0100.879] LineTo (hdc=0x60108f9, x=1, y=34) returned 1 [0100.879] SetBkMode (hdc=0x60108f9, mode=2) returned 1 [0100.879] MoveToEx (in: hdc=0x60108f9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0100.879] SelectObject (hdc=0x60108f9, h=0x1b00017) returned 0x33008f8 [0100.879] DeleteObject (ho=0x33008f8) returned 1 [0100.879] GetROP2 (hdc=0x60108f9) returned 13 [0100.879] GetBkMode (hdc=0x60108f9) returned 2 [0100.879] SetBkMode (hdc=0x60108f9, mode=1) returned 2 [0100.879] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xd300955 [0100.879] SelectObject (hdc=0x60108f9, h=0xd300955) returned 0x1b00017 [0100.879] MoveToEx (in: hdc=0x60108f9, x=1, y=34, lppt=0x25ba530 | out: lppt=0x25ba530) returned 1 [0100.879] LineTo (hdc=0x60108f9, x=123, y=34) returned 1 [0100.879] SetBkMode (hdc=0x60108f9, mode=2) returned 1 [0100.879] MoveToEx (in: hdc=0x60108f9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0100.880] GetROP2 (hdc=0x60108f9) returned 13 [0100.880] GetBkMode (hdc=0x60108f9) returned 2 [0100.880] SetBkMode (hdc=0x60108f9, mode=1) returned 2 [0100.880] SelectObject (hdc=0x60108f9, h=0xd300955) returned 0xd300955 [0100.880] MoveToEx (in: hdc=0x60108f9, x=123, y=34, lppt=0x25ba548 | out: lppt=0x25ba548) returned 1 [0100.880] LineTo (hdc=0x60108f9, x=123, y=0) returned 1 [0100.880] SetBkMode (hdc=0x60108f9, mode=2) returned 1 [0100.880] MoveToEx (in: hdc=0x60108f9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0100.880] SelectObject (hdc=0x60108f9, h=0x1b00017) returned 0xd300955 [0100.880] DeleteObject (ho=0xd300955) returned 1 [0100.880] GetROP2 (hdc=0x60108f9) returned 13 [0100.880] GetBkMode (hdc=0x60108f9) returned 2 [0100.880] SetBkMode (hdc=0x60108f9, mode=1) returned 2 [0100.880] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x43008f8 [0100.880] SelectObject (hdc=0x60108f9, h=0x43008f8) returned 0x1b00017 [0100.880] MoveToEx (in: hdc=0x60108f9, x=122, y=2, lppt=0x25ba5b0 | out: lppt=0x25ba5b0) returned 1 [0100.880] LineTo (hdc=0x60108f9, x=2, y=2) returned 1 [0100.880] SetBkMode (hdc=0x60108f9, mode=2) returned 1 [0100.881] MoveToEx (in: hdc=0x60108f9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0100.881] GetROP2 (hdc=0x60108f9) returned 13 [0100.881] GetBkMode (hdc=0x60108f9) returned 2 [0100.881] SetBkMode (hdc=0x60108f9, mode=1) returned 2 [0100.881] SelectObject (hdc=0x60108f9, h=0x43008f8) returned 0x43008f8 [0100.881] MoveToEx (in: hdc=0x60108f9, x=2, y=2, lppt=0x25ba5c8 | out: lppt=0x25ba5c8) returned 1 [0100.881] LineTo (hdc=0x60108f9, x=2, y=33) returned 1 [0100.881] SetBkMode (hdc=0x60108f9, mode=2) returned 1 [0100.881] MoveToEx (in: hdc=0x60108f9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0100.881] SelectObject (hdc=0x60108f9, h=0x1b00017) returned 0x43008f8 [0100.881] DeleteObject (ho=0x43008f8) returned 1 [0100.881] GetROP2 (hdc=0x60108f9) returned 13 [0100.881] GetBkMode (hdc=0x60108f9) returned 2 [0100.881] SetBkMode (hdc=0x60108f9, mode=1) returned 2 [0100.881] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xe300955 [0100.881] SelectObject (hdc=0x60108f9, h=0xe300955) returned 0x1b00017 [0100.881] MoveToEx (in: hdc=0x60108f9, x=2, y=33, lppt=0x25ba630 | out: lppt=0x25ba630) returned 1 [0100.881] LineTo (hdc=0x60108f9, x=122, y=33) returned 1 [0100.882] SetBkMode (hdc=0x60108f9, mode=2) returned 1 [0100.882] MoveToEx (in: hdc=0x60108f9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0100.882] GetROP2 (hdc=0x60108f9) returned 13 [0100.882] GetBkMode (hdc=0x60108f9) returned 2 [0100.882] SetBkMode (hdc=0x60108f9, mode=1) returned 2 [0100.882] SelectObject (hdc=0x60108f9, h=0xe300955) returned 0xe300955 [0100.882] MoveToEx (in: hdc=0x60108f9, x=122, y=33, lppt=0x25ba648 | out: lppt=0x25ba648) returned 1 [0100.882] LineTo (hdc=0x60108f9, x=122, y=1) returned 1 [0100.882] SetBkMode (hdc=0x60108f9, mode=2) returned 1 [0100.882] MoveToEx (in: hdc=0x60108f9, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0100.882] SelectObject (hdc=0x60108f9, h=0x1b00017) returned 0xe300955 [0100.882] DeleteObject (ho=0xe300955) returned 1 [0100.882] RestoreDC (hdc=0x60108f9, nSavedDC=-1) returned 1 [0100.882] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.882] GdipReleaseDC (graphics=0x1c46d570, hdc=0x60108f9) returned 0x0 [0100.882] GdipGetDC (graphics=0x1c46d570, hdc=0x434720) returned 0x0 [0100.882] BitBlt (hdc=0xa0108e8, x=0, y=0, cx=125, cy=36, hdcSrc=0x60108f9, x1=0, y1=0, rop=0xcc0020) returned 1 [0100.883] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.883] GdipReleaseDC (graphics=0x1c46d570, hdc=0x60108f9) returned 0x0 [0100.884] SelectPalette (hdc=0xa0108e8, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0100.884] SelectObject (hdc=0x60108f9, h=0x185000f) returned 0x2905055a [0100.884] DeleteDC (hdc=0x60108f9) returned 1 [0100.884] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0100.884] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0100.884] EndPaint (hWnd=0xa01fa, lpPaint=0x434828) returned 1 [0100.884] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25ba6a0, cPoints=0x1 | out: lpPoints=0x25ba6a0) returned 39715228 [0100.884] WindowFromPoint (Point=0x26e000001f2) returned 0xa01fa [0100.884] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26e01f2) returned 0x1 [0100.884] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0100.884] NotifyWinEvent (event=0x800c, hwnd=0xa01fa, idObject=-4, idChild=0) [0100.884] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0xfffffffffffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0100.885] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x435100) returned 0x0 [0100.885] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x435100) returned 0x0 [0100.895] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x5f9c40 [0100.895] RtlMoveMemory (in: Destination=0x5f9c40, Source=0x2594d08, Length=0x70 | out: Destination=0x5f9c40) [0100.895] ShellExecuteExW (in: pExecInfo=0x25bc2e0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25bc2e0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0101.975] GetKeyState (nVirtKey=1) returned 1 [0101.975] GetKeyState (nVirtKey=2) returned 0 [0101.975] GetKeyState (nVirtKey=4) returned 0 [0101.975] GetKeyState (nVirtKey=5) returned 0 [0101.975] GetKeyState (nVirtKey=6) returned 0 [0102.059] GetKeyState (nVirtKey=1) returned 1 [0102.059] GetKeyState (nVirtKey=2) returned 0 [0102.059] GetKeyState (nVirtKey=4) returned 0 [0102.059] GetKeyState (nVirtKey=5) returned 0 [0102.059] GetKeyState (nVirtKey=6) returned 0 [0102.061] GetKeyState (nVirtKey=1) returned 1 [0102.061] GetKeyState (nVirtKey=2) returned 0 [0102.061] GetKeyState (nVirtKey=4) returned 0 [0102.061] GetKeyState (nVirtKey=5) returned 0 [0102.061] GetKeyState (nVirtKey=6) returned 0 [0102.062] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0102.062] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0102.063] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x4343d8 | out: lpPaint=0x4343d8) returned 0xc010937 [0102.063] SelectPalette (hdc=0xc010937, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0102.063] CreateCompatibleDC (hdc=0xc010937) returned 0xc01095e [0102.063] SelectObject (hdc=0xc01095e, h=0x2905055a) returned 0x185000f [0102.064] GdipCreateFromHDC (hdc=0xc01095e, graphics=0x4341e0) returned 0x0 [0102.064] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0102.064] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0102.064] GdipCreateMatrix (matrix=0x434310) returned 0x0 [0102.064] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471230) returned 0x0 [0102.064] GdipIsMatrixIdentity (matrix=0x1c471230, result=0x434370) returned 0x0 [0102.064] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c5d0 [0102.064] GdipGetMatrixElements (matrix=0x1c471230, matrixOut=0x1f32c5d0) returned 0x0 [0102.064] LocalFree (hMem=0x1f32c5d0) returned 0x0 [0102.064] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.065] GdipDeleteMatrix (matrix=0x1c471230) returned 0x0 [0102.065] GdipCreateRegion (region=0x434310) returned 0x0 [0102.065] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0102.065] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x434340) returned 0x0 [0102.065] GdipSaveGraphics (graphics=0x1c46d570, state=0x434410) returned 0x0 [0102.065] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd760dbd) returned 0x0 [0102.065] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.065] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0102.065] GdipGetDC (graphics=0x1c46d570, hdc=0x433800) returned 0x0 [0102.065] GetCurrentObject (hdc=0xc01095e, type=0x1) returned 0x1b00017 [0102.065] GetCurrentObject (hdc=0xc01095e, type=0x2) returned 0x1900010 [0102.065] GetCurrentObject (hdc=0xc01095e, type=0x7) returned 0x2905055a [0102.065] GetCurrentObject (hdc=0xc01095e, type=0x6) returned 0x18a0048 [0102.065] SaveDC (hdc=0xc01095e) returned 1 [0102.065] GetNearestColor (hdc=0xc01095e, color=0xf0f0f0) returned 0xf0f0f0 [0102.065] GetNearestColor (hdc=0xc01095e, color=0xa0a0a0) returned 0xa0a0a0 [0102.066] GetNearestColor (hdc=0xc01095e, color=0x696969) returned 0x696969 [0102.066] GetNearestColor (hdc=0xc01095e, color=0xa0a0a0) returned 0xa0a0a0 [0102.066] GetNearestColor (hdc=0xc01095e, color=0x0) returned 0x0 [0102.066] GetNearestColor (hdc=0xc01095e, color=0xffffff) returned 0xffffff [0102.066] GetNearestColor (hdc=0xc01095e, color=0xe5e5e5) returned 0xe5e5e5 [0102.066] GetNearestColor (hdc=0xc01095e, color=0xd8d8d8) returned 0xd8d8d8 [0102.066] GetNearestColor (hdc=0xc01095e, color=0x0) returned 0x0 [0102.066] RestoreDC (hdc=0xc01095e, nSavedDC=-1) returned 1 [0102.066] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.066] GdipReleaseDC (graphics=0x1c46d570, hdc=0xc01095e) returned 0x0 [0102.067] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0102.067] CoTaskMemAlloc (cb=0x13) returned 0x633de0 [0102.067] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0102.067] CoTaskMemFree (pv=0x633de0) [0102.067] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x433ef0) returned 0x0 [0102.067] GdipSetStringFormatAlign (format=0x1c476380, align=0x1) returned 0x0 [0102.068] GdipSetStringFormatLineAlign (format=0x1c476380, align=0x1) returned 0x0 [0102.068] GdipSetStringFormatHotkeyPrefix (format=0x1c476380, hotkeyPrefix=2) returned 0x0 [0102.068] GdipGetStringFormatFlags (format=0x1c476380, flags=0x433f20) returned 0x0 [0102.068] GdipGetStringFormatTrimming (format=0x1c476380, trimming=0x433f20) returned 0x0 [0102.068] GdipGetStringFormatHotkeyPrefix (format=0x1c476380, hotkeyPrefix=0x433f20) returned 0x0 [0102.068] GdipGetFontSize (font=0x1c476380, size=0x433f20) returned 0x0 [0102.068] GdipGetFontStyle (font=0x1c476380, style=0x433f20) returned 0x0 [0102.068] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.068] GdipDeleteStringFormat (format=0x1c476380) returned 0x0 [0102.068] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0102.069] CoTaskMemAlloc (cb=0x13) returned 0x633ca0 [0102.069] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0102.069] CoTaskMemFree (pv=0x633ca0) [0102.069] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x433bb0) returned 0x0 [0102.069] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x433bc0) returned 0x0 [0102.069] GdipSetStringFormatFlags (format=0x1c4762a0, flags=0) returned 0x0 [0102.069] GdipSetStringFormatTrimming (format=0x1c4762a0, trimming=0x1) returned 0x0 [0102.069] GdipSetStringFormatHotkeyPrefix (format=0x1c4762a0, hotkeyPrefix=2) returned 0x0 [0102.069] GdipSetStringFormatAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0102.070] GdipSetStringFormatLineAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0102.070] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x433ad8, stringFormat=0x1c4762a0, boundingBox=0x433ac8, codepointsFitted=0x433ac4, linesFilled=0x433ac0) returned 0x0 [0102.070] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.070] GdipDeleteStringFormat (format=0x1c4762a0) returned 0x0 [0102.070] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.070] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0102.070] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0102.070] CoTaskMemAlloc (cb=0x13) returned 0x633c40 [0102.071] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0102.071] CoTaskMemFree (pv=0x633c40) [0102.071] GdipCreateRegion (region=0x433b20) returned 0x0 [0102.071] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0102.071] GdipCreateMatrix (matrix=0x433b20) returned 0x0 [0102.071] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471670) returned 0x0 [0102.071] GdipIsMatrixIdentity (matrix=0x1c471670, result=0x433b80) returned 0x0 [0102.071] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c490 [0102.071] GdipGetMatrixElements (matrix=0x1c471670, matrixOut=0x1f32c490) returned 0x0 [0102.071] LocalFree (hMem=0x1f32c490) returned 0x0 [0102.072] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32bed0 [0102.072] GdipGetMatrixElements (matrix=0x1c471670, matrixOut=0x1f32bed0) returned 0x0 [0102.072] LocalFree (hMem=0x1f32bed0) returned 0x0 [0102.072] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.072] GdipDeleteMatrix (matrix=0x1c471670) returned 0x0 [0102.072] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x433bd0) returned 0x0 [0102.072] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x433b90) returned 0x0 [0102.072] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x433b90) returned 0x0 [0102.072] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.072] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0102.072] GdipGetDC (graphics=0x1c46d570, hdc=0x433c00) returned 0x0 [0102.072] GetCurrentObject (hdc=0xc01095e, type=0x1) returned 0x1b00017 [0102.072] GetCurrentObject (hdc=0xc01095e, type=0x2) returned 0x1900010 [0102.072] GetCurrentObject (hdc=0xc01095e, type=0x7) returned 0x2905055a [0102.073] GetCurrentObject (hdc=0xc01095e, type=0x6) returned 0x18a0048 [0102.073] SaveDC (hdc=0xc01095e) returned 1 [0102.073] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x630406cc [0102.073] GetClipRgn (hdc=0xc01095e, hrgn=0x630406cc) returned 0 [0102.073] SelectClipRgn (hdc=0xc01095e, hrgn=0x5d0405d8) returned 2 [0102.073] DeleteObject (ho=0x630406cc) returned 1 [0102.073] DeleteObject (ho=0x5d0405d8) returned 1 [0102.073] OffsetViewportOrgEx (in: hdc=0xc01095e, x=0, y=0, lppt=0x25bd038 | out: lppt=0x25bd038) returned 1 [0102.073] GetNearestColor (hdc=0xc01095e, color=0xf0f0f0) returned 0xf0f0f0 [0102.073] CreateSolidBrush (color=0xf0f0f0) returned 0x2010075d [0102.074] FillRect (hDC=0xc01095e, lprc=0x433bd0, hbr=0x2010075d) returned 1 [0102.074] DeleteObject (ho=0x2010075d) returned 1 [0102.074] RestoreDC (hdc=0xc01095e, nSavedDC=-1) returned 1 [0102.074] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.074] GdipReleaseDC (graphics=0x1c46d570, hdc=0xc01095e) returned 0x0 [0102.074] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0102.075] CoTaskMemAlloc (cb=0x13) returned 0x633c40 [0102.075] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0102.075] CoTaskMemFree (pv=0x633c40) [0102.075] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x433c50) returned 0x0 [0102.076] GdipSetStringFormatAlign (format=0x1c476540, align=0x1) returned 0x0 [0102.076] GdipSetStringFormatLineAlign (format=0x1c476540, align=0x1) returned 0x0 [0102.076] GdipSetStringFormatHotkeyPrefix (format=0x1c476540, hotkeyPrefix=2) returned 0x0 [0102.076] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x433cc0) returned 0x0 [0102.076] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x433bd0, stringFormat=0x1c476540, brush=0x1c46cce0) returned 0x0 [0102.076] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.076] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0102.076] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.076] GdipDeleteStringFormat (format=0x1c476540) returned 0x0 [0102.076] GetFocus () returned 0xa01fa [0102.077] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0102.077] CoTaskMemAlloc (cb=0x13) returned 0x633c40 [0102.077] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0102.077] CoTaskMemFree (pv=0x633c40) [0102.077] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x433fb0) returned 0x0 [0102.077] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0102.077] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.077] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0102.078] GdipCreateRegion (region=0x433a80) returned 0x0 [0102.078] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0102.078] GdipCreateMatrix (matrix=0x433a80) returned 0x0 [0102.078] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471170) returned 0x0 [0102.078] GdipIsMatrixIdentity (matrix=0x1c471170, result=0x433ae0) returned 0x0 [0102.078] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c390 [0102.078] GdipGetMatrixElements (matrix=0x1c471170, matrixOut=0x1f32c390) returned 0x0 [0102.078] LocalFree (hMem=0x1f32c390) returned 0x0 [0102.078] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32cd90 [0102.078] GdipGetMatrixElements (matrix=0x1c471170, matrixOut=0x1f32cd90) returned 0x0 [0102.078] LocalFree (hMem=0x1f32cd90) returned 0x0 [0102.078] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.078] GdipDeleteMatrix (matrix=0x1c471170) returned 0x0 [0102.078] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x433b30) returned 0x0 [0102.078] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x433af0) returned 0x0 [0102.078] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x433af0) returned 0x0 [0102.078] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.081] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0102.082] GdipGetDC (graphics=0x1c46d570, hdc=0x433b60) returned 0x0 [0102.082] GetCurrentObject (hdc=0xc01095e, type=0x1) returned 0x1b00017 [0102.082] GetCurrentObject (hdc=0xc01095e, type=0x2) returned 0x1900010 [0102.082] GetCurrentObject (hdc=0xc01095e, type=0x7) returned 0x2905055a [0102.082] GetCurrentObject (hdc=0xc01095e, type=0x6) returned 0x18a0048 [0102.082] SaveDC (hdc=0xc01095e) returned 1 [0102.082] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5e0405d8 [0102.082] GetClipRgn (hdc=0xc01095e, hrgn=0x5e0405d8) returned 0 [0102.082] SelectClipRgn (hdc=0xc01095e, hrgn=0x640406cc) returned 2 [0102.082] DeleteObject (ho=0x5e0405d8) returned 1 [0102.082] DeleteObject (ho=0x640406cc) returned 1 [0102.082] OffsetViewportOrgEx (in: hdc=0xc01095e, x=0, y=0, lppt=0x25bd5d8 | out: lppt=0x25bd5d8) returned 1 [0102.083] GetROP2 (hdc=0xc01095e) returned 13 [0102.083] GetBkMode (hdc=0xc01095e) returned 2 [0102.083] SetBkMode (hdc=0xc01095e, mode=1) returned 2 [0102.083] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x130098b [0102.083] SelectObject (hdc=0xc01095e, h=0x130098b) returned 0x1b00017 [0102.083] MoveToEx (in: hdc=0xc01095e, x=123, y=1, lppt=0x25bd640 | out: lppt=0x25bd640) returned 1 [0102.083] LineTo (hdc=0xc01095e, x=1, y=1) returned 1 [0102.083] SetBkMode (hdc=0xc01095e, mode=2) returned 1 [0102.083] MoveToEx (in: hdc=0xc01095e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0102.083] GetROP2 (hdc=0xc01095e) returned 13 [0102.083] GetBkMode (hdc=0xc01095e) returned 2 [0102.083] SetBkMode (hdc=0xc01095e, mode=1) returned 2 [0102.083] SelectObject (hdc=0xc01095e, h=0x130098b) returned 0x130098b [0102.083] MoveToEx (in: hdc=0xc01095e, x=1, y=1, lppt=0x25bd658 | out: lppt=0x25bd658) returned 1 [0102.083] LineTo (hdc=0xc01095e, x=1, y=34) returned 1 [0102.083] SetBkMode (hdc=0xc01095e, mode=2) returned 1 [0102.083] MoveToEx (in: hdc=0xc01095e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0102.083] SelectObject (hdc=0xc01095e, h=0x1b00017) returned 0x130098b [0102.083] DeleteObject (ho=0x130098b) returned 1 [0102.084] GetROP2 (hdc=0xc01095e) returned 13 [0102.084] GetBkMode (hdc=0xc01095e) returned 2 [0102.084] SetBkMode (hdc=0xc01095e, mode=1) returned 2 [0102.084] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x130098c [0102.084] SelectObject (hdc=0xc01095e, h=0x130098c) returned 0x1b00017 [0102.084] MoveToEx (in: hdc=0xc01095e, x=1, y=34, lppt=0x25bd6c0 | out: lppt=0x25bd6c0) returned 1 [0102.084] LineTo (hdc=0xc01095e, x=123, y=34) returned 1 [0102.084] SetBkMode (hdc=0xc01095e, mode=2) returned 1 [0102.084] MoveToEx (in: hdc=0xc01095e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0102.084] GetROP2 (hdc=0xc01095e) returned 13 [0102.084] GetBkMode (hdc=0xc01095e) returned 2 [0102.084] SetBkMode (hdc=0xc01095e, mode=1) returned 2 [0102.084] SelectObject (hdc=0xc01095e, h=0x130098c) returned 0x130098c [0102.084] MoveToEx (in: hdc=0xc01095e, x=123, y=34, lppt=0x25bd6d8 | out: lppt=0x25bd6d8) returned 1 [0102.084] LineTo (hdc=0xc01095e, x=123, y=0) returned 1 [0102.084] SetBkMode (hdc=0xc01095e, mode=2) returned 1 [0102.084] MoveToEx (in: hdc=0xc01095e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0102.084] SelectObject (hdc=0xc01095e, h=0x1b00017) returned 0x130098c [0102.084] DeleteObject (ho=0x130098c) returned 1 [0102.085] GetROP2 (hdc=0xc01095e) returned 13 [0102.085] GetBkMode (hdc=0xc01095e) returned 2 [0102.085] SetBkMode (hdc=0xc01095e, mode=1) returned 2 [0102.085] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x230098b [0102.085] SelectObject (hdc=0xc01095e, h=0x230098b) returned 0x1b00017 [0102.085] MoveToEx (in: hdc=0xc01095e, x=122, y=2, lppt=0x25bd740 | out: lppt=0x25bd740) returned 1 [0102.085] LineTo (hdc=0xc01095e, x=2, y=2) returned 1 [0102.085] SetBkMode (hdc=0xc01095e, mode=2) returned 1 [0102.085] MoveToEx (in: hdc=0xc01095e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0102.085] GetROP2 (hdc=0xc01095e) returned 13 [0102.085] GetBkMode (hdc=0xc01095e) returned 2 [0102.085] SetBkMode (hdc=0xc01095e, mode=1) returned 2 [0102.085] SelectObject (hdc=0xc01095e, h=0x230098b) returned 0x230098b [0102.085] MoveToEx (in: hdc=0xc01095e, x=2, y=2, lppt=0x25bd758 | out: lppt=0x25bd758) returned 1 [0102.085] LineTo (hdc=0xc01095e, x=2, y=33) returned 1 [0102.085] SetBkMode (hdc=0xc01095e, mode=2) returned 1 [0102.085] MoveToEx (in: hdc=0xc01095e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0102.085] SelectObject (hdc=0xc01095e, h=0x1b00017) returned 0x230098b [0102.086] DeleteObject (ho=0x230098b) returned 1 [0102.086] GetROP2 (hdc=0xc01095e) returned 13 [0102.086] GetBkMode (hdc=0xc01095e) returned 2 [0102.086] SetBkMode (hdc=0xc01095e, mode=1) returned 2 [0102.086] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x230098c [0102.086] SelectObject (hdc=0xc01095e, h=0x230098c) returned 0x1b00017 [0102.086] MoveToEx (in: hdc=0xc01095e, x=2, y=33, lppt=0x25bd7c0 | out: lppt=0x25bd7c0) returned 1 [0102.086] LineTo (hdc=0xc01095e, x=122, y=33) returned 1 [0102.086] SetBkMode (hdc=0xc01095e, mode=2) returned 1 [0102.086] MoveToEx (in: hdc=0xc01095e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0102.086] GetROP2 (hdc=0xc01095e) returned 13 [0102.086] GetBkMode (hdc=0xc01095e) returned 2 [0102.086] SetBkMode (hdc=0xc01095e, mode=1) returned 2 [0102.086] SelectObject (hdc=0xc01095e, h=0x230098c) returned 0x230098c [0102.086] MoveToEx (in: hdc=0xc01095e, x=122, y=33, lppt=0x25bd7d8 | out: lppt=0x25bd7d8) returned 1 [0102.086] LineTo (hdc=0xc01095e, x=122, y=1) returned 1 [0102.086] SetBkMode (hdc=0xc01095e, mode=2) returned 1 [0102.086] MoveToEx (in: hdc=0xc01095e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0102.087] SelectObject (hdc=0xc01095e, h=0x1b00017) returned 0x230098c [0102.087] DeleteObject (ho=0x230098c) returned 1 [0102.087] RestoreDC (hdc=0xc01095e, nSavedDC=-1) returned 1 [0102.087] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.087] GdipReleaseDC (graphics=0x1c46d570, hdc=0xc01095e) returned 0x0 [0102.087] GdipGetDC (graphics=0x1c46d570, hdc=0x4342e0) returned 0x0 [0102.087] BitBlt (hdc=0xc010937, x=0, y=0, cx=125, cy=36, hdcSrc=0xc01095e, x1=0, y1=0, rop=0xcc0020) returned 1 [0102.088] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.088] GdipReleaseDC (graphics=0x1c46d570, hdc=0xc01095e) returned 0x0 [0102.088] SelectPalette (hdc=0xc010937, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0102.088] SelectObject (hdc=0xc01095e, h=0x185000f) returned 0x2905055a [0102.088] DeleteDC (hdc=0xc01095e) returned 1 [0102.088] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0102.088] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0102.088] EndPaint (hWnd=0xa01fa, lpPaint=0x4343e8) returned 1 [0104.895] _TrackMouseEvent (in: lpEventTrack=0x2591800 | out: lpEventTrack=0x2591800) returned 1 [0104.895] SendMessageW (hWnd=0xa01fa, Msg=0xc169, wParam=0x0, lParam=0x0) returned 0x0 [0104.895] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0xc169, wParam=0x0, lParam=0x0) returned 0x0 [0104.895] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0104.895] GetKeyState (nVirtKey=1) returned 1 [0104.895] GetKeyState (nVirtKey=2) returned 0 [0104.895] GetKeyState (nVirtKey=4) returned 0 [0104.895] GetKeyState (nVirtKey=5) returned 0 [0104.896] GetKeyState (nVirtKey=6) returned 0 [0104.896] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x4343d8 | out: lpPaint=0x4343d8) returned 0x3010951 [0104.896] SelectPalette (hdc=0x3010951, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0104.896] CreateCompatibleDC (hdc=0x3010951) returned 0x50109db [0104.896] SelectObject (hdc=0x50109db, h=0x2905055a) returned 0x185000f [0104.896] GdipCreateFromHDC (hdc=0x50109db, graphics=0x4341e0) returned 0x0 [0104.896] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0104.896] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0104.897] GdipCreateMatrix (matrix=0x434310) returned 0x0 [0104.897] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471670) returned 0x0 [0104.897] GdipIsMatrixIdentity (matrix=0x1c471670, result=0x434370) returned 0x0 [0104.897] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c390 [0104.897] GdipGetMatrixElements (matrix=0x1c471670, matrixOut=0x1f32c390) returned 0x0 [0104.897] LocalFree (hMem=0x1f32c390) returned 0x0 [0104.897] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.897] GdipDeleteMatrix (matrix=0x1c471670) returned 0x0 [0104.897] GdipCreateRegion (region=0x434310) returned 0x0 [0104.897] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0104.897] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x434340) returned 0x0 [0104.897] GdipSaveGraphics (graphics=0x1c46d570, state=0x434410) returned 0x0 [0104.897] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd730dbd) returned 0x0 [0104.897] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.897] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0104.897] GdipGetDC (graphics=0x1c46d570, hdc=0x433800) returned 0x0 [0104.898] GetCurrentObject (hdc=0x50109db, type=0x1) returned 0x1b00017 [0104.898] GetCurrentObject (hdc=0x50109db, type=0x2) returned 0x1900010 [0104.898] GetCurrentObject (hdc=0x50109db, type=0x7) returned 0x2905055a [0104.898] GetCurrentObject (hdc=0x50109db, type=0x6) returned 0x18a0048 [0104.898] SaveDC (hdc=0x50109db) returned 1 [0104.898] GetNearestColor (hdc=0x50109db, color=0xf0f0f0) returned 0xf0f0f0 [0104.898] GetNearestColor (hdc=0x50109db, color=0xa0a0a0) returned 0xa0a0a0 [0104.898] GetNearestColor (hdc=0x50109db, color=0x696969) returned 0x696969 [0104.898] GetNearestColor (hdc=0x50109db, color=0xa0a0a0) returned 0xa0a0a0 [0104.899] GetNearestColor (hdc=0x50109db, color=0x0) returned 0x0 [0104.899] GetNearestColor (hdc=0x50109db, color=0xffffff) returned 0xffffff [0104.899] GetNearestColor (hdc=0x50109db, color=0xe5e5e5) returned 0xe5e5e5 [0104.899] GetNearestColor (hdc=0x50109db, color=0xd8d8d8) returned 0xd8d8d8 [0104.899] GetNearestColor (hdc=0x50109db, color=0x0) returned 0x0 [0104.899] RestoreDC (hdc=0x50109db, nSavedDC=-1) returned 1 [0104.899] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.899] GdipReleaseDC (graphics=0x1c46d570, hdc=0x50109db) returned 0x0 [0104.900] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0104.900] CoTaskMemAlloc (cb=0x13) returned 0x633d80 [0104.900] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0104.900] CoTaskMemFree (pv=0x633d80) [0104.900] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x433ef0) returned 0x0 [0104.900] GdipSetStringFormatAlign (format=0x1c476380, align=0x1) returned 0x0 [0104.900] GdipSetStringFormatLineAlign (format=0x1c476380, align=0x1) returned 0x0 [0104.900] GdipSetStringFormatHotkeyPrefix (format=0x1c476380, hotkeyPrefix=2) returned 0x0 [0104.901] GdipGetStringFormatFlags (format=0x1c476380, flags=0x433f20) returned 0x0 [0104.901] GdipGetStringFormatTrimming (format=0x1c476380, trimming=0x433f20) returned 0x0 [0104.901] GdipGetStringFormatHotkeyPrefix (format=0x1c476380, hotkeyPrefix=0x433f20) returned 0x0 [0104.901] GdipGetFontSize (font=0x1c476380, size=0x433f20) returned 0x0 [0104.901] GdipGetFontStyle (font=0x1c476380, style=0x433f20) returned 0x0 [0104.901] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.901] GdipDeleteStringFormat (format=0x1c476380) returned 0x0 [0104.901] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0104.901] CoTaskMemAlloc (cb=0x13) returned 0x633de0 [0104.902] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0104.902] CoTaskMemFree (pv=0x633de0) [0104.902] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x433bb0) returned 0x0 [0104.902] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x433bc0) returned 0x0 [0104.902] GdipSetStringFormatFlags (format=0x1c4762a0, flags=0) returned 0x0 [0104.902] GdipSetStringFormatTrimming (format=0x1c4762a0, trimming=0x1) returned 0x0 [0104.902] GdipSetStringFormatHotkeyPrefix (format=0x1c4762a0, hotkeyPrefix=2) returned 0x0 [0104.902] GdipSetStringFormatAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0104.902] GdipSetStringFormatLineAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0104.902] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x433ad8, stringFormat=0x1c4762a0, boundingBox=0x433ac8, codepointsFitted=0x433ac4, linesFilled=0x433ac0) returned 0x0 [0104.903] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.903] GdipDeleteStringFormat (format=0x1c4762a0) returned 0x0 [0104.903] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.903] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0104.903] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0104.903] CoTaskMemAlloc (cb=0x13) returned 0x633f40 [0104.903] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0104.904] CoTaskMemFree (pv=0x633f40) [0104.904] GdipCreateRegion (region=0x433b20) returned 0x0 [0104.904] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0104.904] GdipCreateMatrix (matrix=0x433b20) returned 0x0 [0104.904] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4714b0) returned 0x0 [0104.904] GdipIsMatrixIdentity (matrix=0x1c4714b0, result=0x433b80) returned 0x0 [0104.904] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c190 [0104.904] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f32c190) returned 0x0 [0104.904] LocalFree (hMem=0x1f32c190) returned 0x0 [0104.904] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c750 [0104.904] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f32c750) returned 0x0 [0104.904] LocalFree (hMem=0x1f32c750) returned 0x0 [0104.904] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.904] GdipDeleteMatrix (matrix=0x1c4714b0) returned 0x0 [0104.904] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x433bd0) returned 0x0 [0104.904] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x433b90) returned 0x0 [0104.904] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x433b90) returned 0x0 [0104.905] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.905] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0104.905] GdipGetDC (graphics=0x1c46d570, hdc=0x433c00) returned 0x0 [0104.905] GetCurrentObject (hdc=0x50109db, type=0x1) returned 0x1b00017 [0104.905] GetCurrentObject (hdc=0x50109db, type=0x2) returned 0x1900010 [0104.905] GetCurrentObject (hdc=0x50109db, type=0x7) returned 0x2905055a [0104.905] GetCurrentObject (hdc=0x50109db, type=0x6) returned 0x18a0048 [0104.905] SaveDC (hdc=0x50109db) returned 1 [0104.905] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x650406cc [0104.905] GetClipRgn (hdc=0x50109db, hrgn=0x650406cc) returned 0 [0104.905] SelectClipRgn (hdc=0x50109db, hrgn=0x5f0405d8) returned 2 [0104.905] DeleteObject (ho=0x650406cc) returned 1 [0104.905] DeleteObject (ho=0x5f0405d8) returned 1 [0104.905] OffsetViewportOrgEx (in: hdc=0x50109db, x=0, y=0, lppt=0x25be498 | out: lppt=0x25be498) returned 1 [0104.905] GetNearestColor (hdc=0x50109db, color=0xf0f0f0) returned 0xf0f0f0 [0104.906] CreateSolidBrush (color=0xf0f0f0) returned 0x2110075d [0104.906] FillRect (hDC=0x50109db, lprc=0x433bd0, hbr=0x2110075d) returned 1 [0104.906] DeleteObject (ho=0x2110075d) returned 1 [0104.906] RestoreDC (hdc=0x50109db, nSavedDC=-1) returned 1 [0104.906] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.906] GdipReleaseDC (graphics=0x1c46d570, hdc=0x50109db) returned 0x0 [0104.906] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0104.908] CoTaskMemAlloc (cb=0x13) returned 0x633f40 [0104.908] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0104.908] CoTaskMemFree (pv=0x633f40) [0104.908] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x433c50) returned 0x0 [0104.908] GdipSetStringFormatAlign (format=0x1c475f20, align=0x1) returned 0x0 [0104.908] GdipSetStringFormatLineAlign (format=0x1c475f20, align=0x1) returned 0x0 [0104.908] GdipSetStringFormatHotkeyPrefix (format=0x1c475f20, hotkeyPrefix=2) returned 0x0 [0104.908] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x433cc0) returned 0x0 [0104.909] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x433bd0, stringFormat=0x1c475f20, brush=0x1c46cce0) returned 0x0 [0104.909] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.909] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0104.909] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.909] GdipDeleteStringFormat (format=0x1c475f20) returned 0x0 [0104.909] GetFocus () returned 0xa01fa [0104.909] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0104.909] CoTaskMemAlloc (cb=0x13) returned 0x633c60 [0104.910] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0104.910] CoTaskMemFree (pv=0x633c60) [0104.910] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x433fb0) returned 0x0 [0104.910] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0104.910] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.910] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0104.910] GdipCreateRegion (region=0x433a80) returned 0x0 [0104.910] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0104.910] GdipCreateMatrix (matrix=0x433a80) returned 0x0 [0104.910] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4710f0) returned 0x0 [0104.910] GdipIsMatrixIdentity (matrix=0x1c4710f0, result=0x433ae0) returned 0x0 [0104.910] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c9d0 [0104.910] GdipGetMatrixElements (matrix=0x1c4710f0, matrixOut=0x1f32c9d0) returned 0x0 [0104.910] LocalFree (hMem=0x1f32c9d0) returned 0x0 [0104.910] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c750 [0104.911] GdipGetMatrixElements (matrix=0x1c4710f0, matrixOut=0x1f32c750) returned 0x0 [0104.911] LocalFree (hMem=0x1f32c750) returned 0x0 [0104.911] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.911] GdipDeleteMatrix (matrix=0x1c4710f0) returned 0x0 [0104.911] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x433b30) returned 0x0 [0104.911] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x433af0) returned 0x0 [0104.911] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x433af0) returned 0x0 [0104.911] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.911] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0104.911] GdipGetDC (graphics=0x1c46d570, hdc=0x433b60) returned 0x0 [0104.911] GetCurrentObject (hdc=0x50109db, type=0x1) returned 0x1b00017 [0104.911] GetCurrentObject (hdc=0x50109db, type=0x2) returned 0x1900010 [0104.911] GetCurrentObject (hdc=0x50109db, type=0x7) returned 0x2905055a [0104.911] GetCurrentObject (hdc=0x50109db, type=0x6) returned 0x18a0048 [0104.911] SaveDC (hdc=0x50109db) returned 1 [0104.912] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x600405d8 [0104.912] GetClipRgn (hdc=0x50109db, hrgn=0x600405d8) returned 0 [0104.912] SelectClipRgn (hdc=0x50109db, hrgn=0x660406cc) returned 2 [0104.912] DeleteObject (ho=0x600405d8) returned 1 [0104.912] DeleteObject (ho=0x660406cc) returned 1 [0104.912] OffsetViewportOrgEx (in: hdc=0x50109db, x=0, y=0, lppt=0x25bea38 | out: lppt=0x25bea38) returned 1 [0104.912] GetROP2 (hdc=0x50109db) returned 13 [0104.912] GetBkMode (hdc=0x50109db) returned 2 [0104.912] SetBkMode (hdc=0x50109db, mode=1) returned 2 [0104.912] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x3300989 [0104.912] SelectObject (hdc=0x50109db, h=0x3300989) returned 0x1b00017 [0104.912] MoveToEx (in: hdc=0x50109db, x=123, y=1, lppt=0x25beaa0 | out: lppt=0x25beaa0) returned 1 [0104.912] LineTo (hdc=0x50109db, x=1, y=1) returned 1 [0104.912] SetBkMode (hdc=0x50109db, mode=2) returned 1 [0104.912] MoveToEx (in: hdc=0x50109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.912] GetROP2 (hdc=0x50109db) returned 13 [0104.913] GetBkMode (hdc=0x50109db) returned 2 [0104.913] SetBkMode (hdc=0x50109db, mode=1) returned 2 [0104.913] SelectObject (hdc=0x50109db, h=0x3300989) returned 0x3300989 [0104.913] MoveToEx (in: hdc=0x50109db, x=1, y=1, lppt=0x25beab8 | out: lppt=0x25beab8) returned 1 [0104.913] LineTo (hdc=0x50109db, x=1, y=34) returned 1 [0104.913] SetBkMode (hdc=0x50109db, mode=2) returned 1 [0104.913] MoveToEx (in: hdc=0x50109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.913] SelectObject (hdc=0x50109db, h=0x1b00017) returned 0x3300989 [0104.913] DeleteObject (ho=0x3300989) returned 1 [0104.913] GetROP2 (hdc=0x50109db) returned 13 [0104.913] GetBkMode (hdc=0x50109db) returned 2 [0104.913] SetBkMode (hdc=0x50109db, mode=1) returned 2 [0104.913] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x13009dc [0104.913] SelectObject (hdc=0x50109db, h=0x13009dc) returned 0x1b00017 [0104.913] MoveToEx (in: hdc=0x50109db, x=1, y=34, lppt=0x25beb20 | out: lppt=0x25beb20) returned 1 [0104.913] LineTo (hdc=0x50109db, x=123, y=34) returned 1 [0104.913] SetBkMode (hdc=0x50109db, mode=2) returned 1 [0104.913] MoveToEx (in: hdc=0x50109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.914] GetROP2 (hdc=0x50109db) returned 13 [0104.914] GetBkMode (hdc=0x50109db) returned 2 [0104.914] SetBkMode (hdc=0x50109db, mode=1) returned 2 [0104.914] SelectObject (hdc=0x50109db, h=0x13009dc) returned 0x13009dc [0104.914] MoveToEx (in: hdc=0x50109db, x=123, y=34, lppt=0x25beb38 | out: lppt=0x25beb38) returned 1 [0104.914] LineTo (hdc=0x50109db, x=123, y=0) returned 1 [0104.914] SetBkMode (hdc=0x50109db, mode=2) returned 1 [0104.914] MoveToEx (in: hdc=0x50109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.914] SelectObject (hdc=0x50109db, h=0x1b00017) returned 0x13009dc [0104.914] DeleteObject (ho=0x13009dc) returned 1 [0104.914] GetROP2 (hdc=0x50109db) returned 13 [0104.914] GetBkMode (hdc=0x50109db) returned 2 [0104.914] SetBkMode (hdc=0x50109db, mode=1) returned 2 [0104.914] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x4300989 [0104.914] SelectObject (hdc=0x50109db, h=0x4300989) returned 0x1b00017 [0104.914] MoveToEx (in: hdc=0x50109db, x=122, y=2, lppt=0x25beba0 | out: lppt=0x25beba0) returned 1 [0104.914] LineTo (hdc=0x50109db, x=2, y=2) returned 1 [0104.915] SetBkMode (hdc=0x50109db, mode=2) returned 1 [0104.915] MoveToEx (in: hdc=0x50109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.915] GetROP2 (hdc=0x50109db) returned 13 [0104.915] GetBkMode (hdc=0x50109db) returned 2 [0104.915] SetBkMode (hdc=0x50109db, mode=1) returned 2 [0104.915] SelectObject (hdc=0x50109db, h=0x4300989) returned 0x4300989 [0104.915] MoveToEx (in: hdc=0x50109db, x=2, y=2, lppt=0x25bebb8 | out: lppt=0x25bebb8) returned 1 [0104.915] LineTo (hdc=0x50109db, x=2, y=33) returned 1 [0104.915] SetBkMode (hdc=0x50109db, mode=2) returned 1 [0104.915] MoveToEx (in: hdc=0x50109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.915] SelectObject (hdc=0x50109db, h=0x1b00017) returned 0x4300989 [0104.915] DeleteObject (ho=0x4300989) returned 1 [0104.915] GetROP2 (hdc=0x50109db) returned 13 [0104.915] GetBkMode (hdc=0x50109db) returned 2 [0104.915] SetBkMode (hdc=0x50109db, mode=1) returned 2 [0104.915] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x23009dc [0104.915] SelectObject (hdc=0x50109db, h=0x23009dc) returned 0x1b00017 [0104.915] MoveToEx (in: hdc=0x50109db, x=2, y=33, lppt=0x25bec20 | out: lppt=0x25bec20) returned 1 [0104.915] LineTo (hdc=0x50109db, x=122, y=33) returned 1 [0104.916] SetBkMode (hdc=0x50109db, mode=2) returned 1 [0104.916] MoveToEx (in: hdc=0x50109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.916] GetROP2 (hdc=0x50109db) returned 13 [0104.916] GetBkMode (hdc=0x50109db) returned 2 [0104.916] SetBkMode (hdc=0x50109db, mode=1) returned 2 [0104.916] SelectObject (hdc=0x50109db, h=0x23009dc) returned 0x23009dc [0104.916] MoveToEx (in: hdc=0x50109db, x=122, y=33, lppt=0x25bec38 | out: lppt=0x25bec38) returned 1 [0104.916] LineTo (hdc=0x50109db, x=122, y=1) returned 1 [0104.916] SetBkMode (hdc=0x50109db, mode=2) returned 1 [0104.916] MoveToEx (in: hdc=0x50109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.916] SelectObject (hdc=0x50109db, h=0x1b00017) returned 0x23009dc [0104.916] DeleteObject (ho=0x23009dc) returned 1 [0104.916] RestoreDC (hdc=0x50109db, nSavedDC=-1) returned 1 [0104.916] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.916] GdipReleaseDC (graphics=0x1c46d570, hdc=0x50109db) returned 0x0 [0104.916] GdipGetDC (graphics=0x1c46d570, hdc=0x4342e0) returned 0x0 [0104.916] BitBlt (hdc=0x3010951, x=0, y=0, cx=125, cy=36, hdcSrc=0x50109db, x1=0, y1=0, rop=0xcc0020) returned 1 [0104.918] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.918] GdipReleaseDC (graphics=0x1c46d570, hdc=0x50109db) returned 0x0 [0104.918] SelectPalette (hdc=0x3010951, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0104.937] SelectObject (hdc=0x50109db, h=0x185000f) returned 0x2905055a [0104.937] DeleteDC (hdc=0x50109db) returned 1 [0104.937] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.937] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0104.937] EndPaint (hWnd=0xa01fa, lpPaint=0x4343e8) returned 1 [0104.946] GetKeyState (nVirtKey=1) returned 1 [0104.946] GetKeyState (nVirtKey=2) returned 0 [0104.946] GetKeyState (nVirtKey=4) returned 0 [0104.946] GetKeyState (nVirtKey=5) returned 0 [0104.946] GetKeyState (nVirtKey=6) returned 0 [0104.946] GetKeyState (nVirtKey=1) returned -128 [0104.946] GetKeyState (nVirtKey=2) returned 0 [0104.946] GetKeyState (nVirtKey=4) returned 0 [0104.946] GetKeyState (nVirtKey=5) returned 0 [0104.946] GetKeyState (nVirtKey=6) returned 0 [0104.946] IsWindowVisible (hWnd=0xa01fa) returned 1 [0104.946] IsWindowEnabled (hWnd=0xa01fa) returned 1 [0104.946] SetFocus (hWnd=0xa01fa) returned 0xa01fa [0104.946] GetFocus () returned 0xa01fa [0104.946] GetFocus () returned 0xa01fa [0104.946] GetFocus () returned 0xa01fa [0104.946] GetKeyState (nVirtKey=1) returned -128 [0104.946] GetKeyState (nVirtKey=2) returned 0 [0104.946] GetKeyState (nVirtKey=4) returned 0 [0104.946] GetKeyState (nVirtKey=5) returned 0 [0104.946] GetKeyState (nVirtKey=6) returned 0 [0104.946] GetCapture () returned 0xa01fa [0104.946] GetKeyState (nVirtKey=1) returned -128 [0104.946] GetKeyState (nVirtKey=2) returned 0 [0104.946] GetKeyState (nVirtKey=4) returned 0 [0104.946] GetKeyState (nVirtKey=5) returned 0 [0104.947] GetKeyState (nVirtKey=6) returned 0 [0104.947] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0104.947] InvalidateRect (hWnd=0xa01fa, lpRect=0x434630, bErase=0) returned 1 [0104.947] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25bed18, cPoints=0x1 | out: lpPoints=0x25bed18) returned 39715228 [0104.947] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0104.947] InvalidateRect (hWnd=0xa01fa, lpRect=0x434580, bErase=0) returned 1 [0104.947] UpdateWindow (hWnd=0xa01fa) returned 1 [0104.947] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x433b98 | out: lpPaint=0x433b98) returned 0x3010951 [0104.947] SelectPalette (hdc=0x3010951, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0104.947] CreateCompatibleDC (hdc=0x3010951) returned 0xc0109db [0104.947] SelectObject (hdc=0xc0109db, h=0x2905055a) returned 0x185000f [0104.947] GdipCreateFromHDC (hdc=0xc0109db, graphics=0x4339a0) returned 0x0 [0104.947] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0104.947] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0104.948] GdipCreateMatrix (matrix=0x433ad0) returned 0x0 [0104.948] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4714b0) returned 0x0 [0104.948] GdipIsMatrixIdentity (matrix=0x1c4714b0, result=0x433b30) returned 0x0 [0104.948] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c450 [0104.948] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f32c450) returned 0x0 [0104.948] LocalFree (hMem=0x1f32c450) returned 0x0 [0104.948] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.948] GdipDeleteMatrix (matrix=0x1c4714b0) returned 0x0 [0104.948] GdipCreateRegion (region=0x433ad0) returned 0x0 [0104.948] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0104.948] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x433b00) returned 0x0 [0104.948] GdipSaveGraphics (graphics=0x1c46d570, state=0x433bd0) returned 0x0 [0104.948] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd700dbd) returned 0x0 [0104.948] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.948] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0104.948] GdipGetDC (graphics=0x1c46d570, hdc=0x432fc0) returned 0x0 [0104.948] GetCurrentObject (hdc=0xc0109db, type=0x1) returned 0x1b00017 [0104.948] GetCurrentObject (hdc=0xc0109db, type=0x2) returned 0x1900010 [0104.948] GetCurrentObject (hdc=0xc0109db, type=0x7) returned 0x2905055a [0104.949] GetCurrentObject (hdc=0xc0109db, type=0x6) returned 0x18a0048 [0104.949] SaveDC (hdc=0xc0109db) returned 1 [0104.949] GetNearestColor (hdc=0xc0109db, color=0xf0f0f0) returned 0xf0f0f0 [0104.949] GetNearestColor (hdc=0xc0109db, color=0xa0a0a0) returned 0xa0a0a0 [0104.949] GetNearestColor (hdc=0xc0109db, color=0x696969) returned 0x696969 [0104.949] GetNearestColor (hdc=0xc0109db, color=0xa0a0a0) returned 0xa0a0a0 [0104.949] GetNearestColor (hdc=0xc0109db, color=0x0) returned 0x0 [0104.949] GetNearestColor (hdc=0xc0109db, color=0xffffff) returned 0xffffff [0104.949] GetNearestColor (hdc=0xc0109db, color=0xe5e5e5) returned 0xe5e5e5 [0104.949] GetNearestColor (hdc=0xc0109db, color=0xd8d8d8) returned 0xd8d8d8 [0104.949] GetNearestColor (hdc=0xc0109db, color=0x0) returned 0x0 [0104.949] RestoreDC (hdc=0xc0109db, nSavedDC=-1) returned 1 [0104.949] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.949] GdipReleaseDC (graphics=0x1c46d570, hdc=0xc0109db) returned 0x0 [0104.950] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0104.950] CoTaskMemAlloc (cb=0x13) returned 0x633f40 [0104.950] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0104.950] CoTaskMemFree (pv=0x633f40) [0104.950] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x4336b0) returned 0x0 [0104.950] GdipSetStringFormatAlign (format=0x1c4760e0, align=0x1) returned 0x0 [0104.950] GdipSetStringFormatLineAlign (format=0x1c4760e0, align=0x1) returned 0x0 [0104.950] GdipSetStringFormatHotkeyPrefix (format=0x1c4760e0, hotkeyPrefix=2) returned 0x0 [0104.950] GdipGetStringFormatFlags (format=0x1c4760e0, flags=0x4336e0) returned 0x0 [0104.951] GdipGetStringFormatTrimming (format=0x1c4760e0, trimming=0x4336e0) returned 0x0 [0104.951] GdipGetStringFormatHotkeyPrefix (format=0x1c4760e0, hotkeyPrefix=0x4336e0) returned 0x0 [0104.951] GdipGetFontSize (font=0x1c4760e0, size=0x4336e0) returned 0x0 [0104.951] GdipGetFontStyle (font=0x1c4760e0, style=0x4336e0) returned 0x0 [0104.951] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.951] GdipDeleteStringFormat (format=0x1c4760e0) returned 0x0 [0104.951] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0104.951] CoTaskMemAlloc (cb=0x13) returned 0x633c60 [0104.951] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0104.951] CoTaskMemFree (pv=0x633c60) [0104.951] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x433370) returned 0x0 [0104.952] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x433380) returned 0x0 [0104.952] GdipSetStringFormatFlags (format=0x1c476690, flags=0) returned 0x0 [0104.952] GdipSetStringFormatTrimming (format=0x1c476690, trimming=0x1) returned 0x0 [0104.952] GdipSetStringFormatHotkeyPrefix (format=0x1c476690, hotkeyPrefix=2) returned 0x0 [0104.952] GdipSetStringFormatAlign (format=0x1c476690, align=0x1) returned 0x0 [0104.952] GdipSetStringFormatLineAlign (format=0x1c476690, align=0x1) returned 0x0 [0104.952] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x433298, stringFormat=0x1c476690, boundingBox=0x433288, codepointsFitted=0x433284, linesFilled=0x433280) returned 0x0 [0104.952] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.952] GdipDeleteStringFormat (format=0x1c476690) returned 0x0 [0104.952] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.952] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0104.952] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0104.952] CoTaskMemAlloc (cb=0x13) returned 0x633c60 [0104.953] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0104.953] CoTaskMemFree (pv=0x633c60) [0104.953] GdipCreateRegion (region=0x4332e0) returned 0x0 [0104.953] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0104.953] GdipCreateMatrix (matrix=0x4332e0) returned 0x0 [0104.953] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4714f0) returned 0x0 [0104.953] GdipIsMatrixIdentity (matrix=0x1c4714f0, result=0x433340) returned 0x0 [0104.953] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c950 [0104.953] GdipGetMatrixElements (matrix=0x1c4714f0, matrixOut=0x1f32c950) returned 0x0 [0104.953] LocalFree (hMem=0x1f32c950) returned 0x0 [0104.953] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c050 [0104.953] GdipGetMatrixElements (matrix=0x1c4714f0, matrixOut=0x1f32c050) returned 0x0 [0104.953] LocalFree (hMem=0x1f32c050) returned 0x0 [0104.953] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.953] GdipDeleteMatrix (matrix=0x1c4714f0) returned 0x0 [0104.953] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x433390) returned 0x0 [0104.955] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x433350) returned 0x0 [0104.955] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x433350) returned 0x0 [0104.955] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.955] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0104.955] GdipGetDC (graphics=0x1c46d570, hdc=0x4333c0) returned 0x0 [0104.955] GetCurrentObject (hdc=0xc0109db, type=0x1) returned 0x1b00017 [0104.955] GetCurrentObject (hdc=0xc0109db, type=0x2) returned 0x1900010 [0104.955] GetCurrentObject (hdc=0xc0109db, type=0x7) returned 0x2905055a [0104.955] GetCurrentObject (hdc=0xc0109db, type=0x6) returned 0x18a0048 [0104.955] SaveDC (hdc=0xc0109db) returned 1 [0104.955] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x670406cc [0104.955] GetClipRgn (hdc=0xc0109db, hrgn=0x670406cc) returned 0 [0104.955] SelectClipRgn (hdc=0xc0109db, hrgn=0x610405d8) returned 2 [0104.955] DeleteObject (ho=0x670406cc) returned 1 [0104.955] DeleteObject (ho=0x610405d8) returned 1 [0104.956] OffsetViewportOrgEx (in: hdc=0xc0109db, x=0, y=0, lppt=0x25bf998 | out: lppt=0x25bf998) returned 1 [0104.956] GetNearestColor (hdc=0xc0109db, color=0xf0f0f0) returned 0xf0f0f0 [0104.956] CreateSolidBrush (color=0xf0f0f0) returned 0x2210075d [0104.956] FillRect (hDC=0xc0109db, lprc=0x433390, hbr=0x2210075d) returned 1 [0104.956] DeleteObject (ho=0x2210075d) returned 1 [0104.956] RestoreDC (hdc=0xc0109db, nSavedDC=-1) returned 1 [0104.956] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.956] GdipReleaseDC (graphics=0x1c46d570, hdc=0xc0109db) returned 0x0 [0104.956] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0104.956] CoTaskMemAlloc (cb=0x13) returned 0x633e60 [0104.957] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0104.957] CoTaskMemFree (pv=0x633e60) [0104.957] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x433410) returned 0x0 [0104.957] GdipSetStringFormatAlign (format=0x1c475d60, align=0x1) returned 0x0 [0104.957] GdipSetStringFormatLineAlign (format=0x1c475d60, align=0x1) returned 0x0 [0104.957] GdipSetStringFormatHotkeyPrefix (format=0x1c475d60, hotkeyPrefix=2) returned 0x0 [0104.957] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x433480) returned 0x0 [0104.957] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x433390, stringFormat=0x1c475d60, brush=0x1c46cce0) returned 0x0 [0104.957] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.957] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0104.957] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.957] GdipDeleteStringFormat (format=0x1c475d60) returned 0x0 [0104.957] GetFocus () returned 0xa01fa [0104.958] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0104.958] CoTaskMemAlloc (cb=0x13) returned 0x633780 [0104.958] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0104.958] CoTaskMemFree (pv=0x633780) [0104.958] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x433770) returned 0x0 [0104.958] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0104.959] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.959] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0104.959] GdipCreateRegion (region=0x433240) returned 0x0 [0104.959] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0104.959] GdipCreateMatrix (matrix=0x433240) returned 0x0 [0104.959] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471730) returned 0x0 [0104.959] GdipIsMatrixIdentity (matrix=0x1c471730, result=0x4332a0) returned 0x0 [0104.959] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32bed0 [0104.959] GdipGetMatrixElements (matrix=0x1c471730, matrixOut=0x1f32bed0) returned 0x0 [0104.959] LocalFree (hMem=0x1f32bed0) returned 0x0 [0104.959] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32bed0 [0104.959] GdipGetMatrixElements (matrix=0x1c471730, matrixOut=0x1f32bed0) returned 0x0 [0104.959] LocalFree (hMem=0x1f32bed0) returned 0x0 [0104.959] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.959] GdipDeleteMatrix (matrix=0x1c471730) returned 0x0 [0104.959] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x4332f0) returned 0x0 [0104.959] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x4332b0) returned 0x0 [0104.959] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x4332b0) returned 0x0 [0104.959] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.959] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0104.960] GdipGetDC (graphics=0x1c46d570, hdc=0x433320) returned 0x0 [0104.960] GetCurrentObject (hdc=0xc0109db, type=0x1) returned 0x1b00017 [0104.960] GetCurrentObject (hdc=0xc0109db, type=0x2) returned 0x1900010 [0104.960] GetCurrentObject (hdc=0xc0109db, type=0x7) returned 0x2905055a [0104.960] GetCurrentObject (hdc=0xc0109db, type=0x6) returned 0x18a0048 [0104.960] SaveDC (hdc=0xc0109db) returned 1 [0104.960] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x620405d8 [0104.960] GetClipRgn (hdc=0xc0109db, hrgn=0x620405d8) returned 0 [0104.960] SelectClipRgn (hdc=0xc0109db, hrgn=0x680406cc) returned 2 [0104.960] DeleteObject (ho=0x620405d8) returned 1 [0104.960] DeleteObject (ho=0x680406cc) returned 1 [0104.960] OffsetViewportOrgEx (in: hdc=0xc0109db, x=0, y=0, lppt=0x25bff38 | out: lppt=0x25bff38) returned 1 [0104.960] GetROP2 (hdc=0xc0109db) returned 13 [0104.960] GetBkMode (hdc=0xc0109db) returned 2 [0104.960] SetBkMode (hdc=0xc0109db, mode=1) returned 2 [0104.960] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0xb300988 [0104.960] SelectObject (hdc=0xc0109db, h=0xb300988) returned 0x1b00017 [0104.960] MoveToEx (in: hdc=0xc0109db, x=123, y=1, lppt=0x25bffa0 | out: lppt=0x25bffa0) returned 1 [0104.960] LineTo (hdc=0xc0109db, x=1, y=1) returned 1 [0104.961] SetBkMode (hdc=0xc0109db, mode=2) returned 1 [0104.961] MoveToEx (in: hdc=0xc0109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.961] GetROP2 (hdc=0xc0109db) returned 13 [0104.961] GetBkMode (hdc=0xc0109db) returned 2 [0104.961] SetBkMode (hdc=0xc0109db, mode=1) returned 2 [0104.961] SelectObject (hdc=0xc0109db, h=0xb300988) returned 0xb300988 [0104.961] MoveToEx (in: hdc=0xc0109db, x=1, y=1, lppt=0x25bffb8 | out: lppt=0x25bffb8) returned 1 [0104.961] LineTo (hdc=0xc0109db, x=1, y=34) returned 1 [0104.961] SetBkMode (hdc=0xc0109db, mode=2) returned 1 [0104.961] MoveToEx (in: hdc=0xc0109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.961] SelectObject (hdc=0xc0109db, h=0x1b00017) returned 0xb300988 [0104.961] DeleteObject (ho=0xb300988) returned 1 [0104.961] GetROP2 (hdc=0xc0109db) returned 13 [0104.961] GetBkMode (hdc=0xc0109db) returned 2 [0104.961] SetBkMode (hdc=0xc0109db, mode=1) returned 2 [0104.961] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x33009dc [0104.961] SelectObject (hdc=0xc0109db, h=0x33009dc) returned 0x1b00017 [0104.961] MoveToEx (in: hdc=0xc0109db, x=1, y=34, lppt=0x25c0020 | out: lppt=0x25c0020) returned 1 [0104.961] LineTo (hdc=0xc0109db, x=123, y=34) returned 1 [0104.961] SetBkMode (hdc=0xc0109db, mode=2) returned 1 [0104.961] MoveToEx (in: hdc=0xc0109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.962] GetROP2 (hdc=0xc0109db) returned 13 [0104.962] GetBkMode (hdc=0xc0109db) returned 2 [0104.962] SetBkMode (hdc=0xc0109db, mode=1) returned 2 [0104.962] SelectObject (hdc=0xc0109db, h=0x33009dc) returned 0x33009dc [0104.962] MoveToEx (in: hdc=0xc0109db, x=123, y=34, lppt=0x25c0038 | out: lppt=0x25c0038) returned 1 [0104.962] LineTo (hdc=0xc0109db, x=123, y=0) returned 1 [0104.962] SetBkMode (hdc=0xc0109db, mode=2) returned 1 [0104.962] MoveToEx (in: hdc=0xc0109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.962] SelectObject (hdc=0xc0109db, h=0x1b00017) returned 0x33009dc [0104.962] DeleteObject (ho=0x33009dc) returned 1 [0104.962] GetROP2 (hdc=0xc0109db) returned 13 [0104.962] GetBkMode (hdc=0xc0109db) returned 2 [0104.962] SetBkMode (hdc=0xc0109db, mode=1) returned 2 [0104.962] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xc300988 [0104.962] SelectObject (hdc=0xc0109db, h=0xc300988) returned 0x1b00017 [0104.962] MoveToEx (in: hdc=0xc0109db, x=122, y=2, lppt=0x25c00a0 | out: lppt=0x25c00a0) returned 1 [0104.962] LineTo (hdc=0xc0109db, x=2, y=2) returned 1 [0104.962] SetBkMode (hdc=0xc0109db, mode=2) returned 1 [0104.962] MoveToEx (in: hdc=0xc0109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.962] GetROP2 (hdc=0xc0109db) returned 13 [0104.962] GetBkMode (hdc=0xc0109db) returned 2 [0104.963] SetBkMode (hdc=0xc0109db, mode=1) returned 2 [0104.963] SelectObject (hdc=0xc0109db, h=0xc300988) returned 0xc300988 [0104.963] MoveToEx (in: hdc=0xc0109db, x=2, y=2, lppt=0x25c00b8 | out: lppt=0x25c00b8) returned 1 [0104.963] LineTo (hdc=0xc0109db, x=2, y=33) returned 1 [0104.963] SetBkMode (hdc=0xc0109db, mode=2) returned 1 [0104.963] MoveToEx (in: hdc=0xc0109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.963] SelectObject (hdc=0xc0109db, h=0x1b00017) returned 0xc300988 [0104.963] DeleteObject (ho=0xc300988) returned 1 [0104.963] GetROP2 (hdc=0xc0109db) returned 13 [0104.963] GetBkMode (hdc=0xc0109db) returned 2 [0104.963] SetBkMode (hdc=0xc0109db, mode=1) returned 2 [0104.963] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x43009dc [0104.963] SelectObject (hdc=0xc0109db, h=0x43009dc) returned 0x1b00017 [0104.963] MoveToEx (in: hdc=0xc0109db, x=2, y=33, lppt=0x25c0120 | out: lppt=0x25c0120) returned 1 [0104.963] LineTo (hdc=0xc0109db, x=122, y=33) returned 1 [0104.963] SetBkMode (hdc=0xc0109db, mode=2) returned 1 [0104.963] MoveToEx (in: hdc=0xc0109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.963] GetROP2 (hdc=0xc0109db) returned 13 [0104.963] GetBkMode (hdc=0xc0109db) returned 2 [0104.963] SetBkMode (hdc=0xc0109db, mode=1) returned 2 [0104.963] SelectObject (hdc=0xc0109db, h=0x43009dc) returned 0x43009dc [0104.963] MoveToEx (in: hdc=0xc0109db, x=122, y=33, lppt=0x25c0138 | out: lppt=0x25c0138) returned 1 [0104.963] LineTo (hdc=0xc0109db, x=122, y=1) returned 1 [0104.964] SetBkMode (hdc=0xc0109db, mode=2) returned 1 [0104.964] MoveToEx (in: hdc=0xc0109db, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0104.964] SelectObject (hdc=0xc0109db, h=0x1b00017) returned 0x43009dc [0104.964] DeleteObject (ho=0x43009dc) returned 1 [0104.964] RestoreDC (hdc=0xc0109db, nSavedDC=-1) returned 1 [0104.964] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.964] GdipReleaseDC (graphics=0x1c46d570, hdc=0xc0109db) returned 0x0 [0104.964] GdipGetDC (graphics=0x1c46d570, hdc=0x433aa0) returned 0x0 [0104.964] BitBlt (hdc=0x3010951, x=0, y=0, cx=125, cy=36, hdcSrc=0xc0109db, x1=0, y1=0, rop=0xcc0020) returned 1 [0104.965] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.965] GdipReleaseDC (graphics=0x1c46d570, hdc=0xc0109db) returned 0x0 [0104.965] SelectPalette (hdc=0x3010951, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0104.965] SelectObject (hdc=0xc0109db, h=0x185000f) returned 0x2905055a [0104.965] DeleteDC (hdc=0xc0109db) returned 1 [0104.965] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0104.965] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0104.965] EndPaint (hWnd=0xa01fa, lpPaint=0x433ba8) returned 1 [0104.965] MapWindowPoints (in: hWndFrom=0xa01fa, hWndTo=0x0, lpPoints=0x25c0190, cPoints=0x1 | out: lpPoints=0x25c0190) returned 39715228 [0104.965] WindowFromPoint (Point=0x266000001c6) returned 0xa01fa [0104.965] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x84, wParam=0x0, lParam=0x26601c6) returned 0x1 [0104.965] NotifyWinEvent (event=0x800a, hwnd=0xa01fa, idObject=-4, idChild=0) [0104.965] NotifyWinEvent (event=0x800c, hwnd=0xa01fa, idObject=-4, idChild=0) [0104.965] SetWindowPos (hWnd=0x8016e, hWndInsertAfter=0xfffffffffffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0104.966] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x434480) returned 0x0 [0104.966] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x434480) returned 0x0 [0105.049] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x5f8e40 [0105.049] RtlMoveMemory (in: Destination=0x5f8e40, Source=0x2594d08, Length=0x70 | out: Destination=0x5f8e40) [0105.049] ShellExecuteExW (in: pExecInfo=0x25c1f90*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25c1f90*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="https://www.facebook.com/profile.php?id=100027091457754", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0105.122] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x2a1, wParam=0x0, lParam=0x8002a) returned 0x0 [0105.140] GetKeyState (nVirtKey=1) returned 0 [0105.140] GetKeyState (nVirtKey=2) returned 0 [0105.140] GetKeyState (nVirtKey=4) returned 0 [0105.140] GetKeyState (nVirtKey=5) returned 0 [0105.140] GetKeyState (nVirtKey=6) returned 0 [0105.145] GetKeyState (nVirtKey=1) returned 0 [0105.145] GetKeyState (nVirtKey=2) returned 0 [0105.145] GetKeyState (nVirtKey=4) returned 0 [0105.145] GetKeyState (nVirtKey=5) returned 0 [0105.145] GetKeyState (nVirtKey=6) returned 0 [0105.150] GetKeyState (nVirtKey=1) returned 0 [0105.150] GetKeyState (nVirtKey=2) returned 0 [0105.150] GetKeyState (nVirtKey=4) returned 0 [0105.150] GetKeyState (nVirtKey=5) returned 0 [0105.150] GetKeyState (nVirtKey=6) returned 0 [0106.296] GetKeyState (nVirtKey=1) returned 0 [0106.296] GetKeyState (nVirtKey=2) returned 0 [0106.296] GetKeyState (nVirtKey=4) returned 0 [0106.296] GetKeyState (nVirtKey=5) returned 0 [0106.296] GetKeyState (nVirtKey=6) returned 0 [0106.298] GetKeyState (nVirtKey=1) returned 0 [0106.298] GetKeyState (nVirtKey=2) returned 0 [0106.298] GetKeyState (nVirtKey=4) returned 0 [0106.298] GetKeyState (nVirtKey=5) returned 0 [0106.298] GetKeyState (nVirtKey=6) returned 0 [0106.299] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0106.299] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0106.299] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x433758 | out: lpPaint=0x433758) returned 0x80109a9 [0106.299] SelectPalette (hdc=0x80109a9, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0106.299] CreateCompatibleDC (hdc=0x80109a9) returned 0x70109f3 [0106.299] SelectObject (hdc=0x70109f3, h=0x2905055a) returned 0x185000f [0106.299] GdipCreateFromHDC (hdc=0x70109f3, graphics=0x433560) returned 0x0 [0106.300] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0106.300] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0106.300] GdipCreateMatrix (matrix=0x433690) returned 0x0 [0106.300] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4712f0) returned 0x0 [0106.300] GdipIsMatrixIdentity (matrix=0x1c4712f0, result=0x4336f0) returned 0x0 [0106.300] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c250 [0106.300] GdipGetMatrixElements (matrix=0x1c4712f0, matrixOut=0x1f32c250) returned 0x0 [0106.300] LocalFree (hMem=0x1f32c250) returned 0x0 [0106.300] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.300] GdipDeleteMatrix (matrix=0x1c4712f0) returned 0x0 [0106.300] GdipCreateRegion (region=0x433690) returned 0x0 [0106.300] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0106.300] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x4336c0) returned 0x0 [0106.300] GdipSaveGraphics (graphics=0x1c46d570, state=0x433790) returned 0x0 [0106.300] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd6d0dbd) returned 0x0 [0106.300] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.300] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0106.300] GdipGetDC (graphics=0x1c46d570, hdc=0x432b80) returned 0x0 [0106.301] GetCurrentObject (hdc=0x70109f3, type=0x1) returned 0x1b00017 [0106.301] GetCurrentObject (hdc=0x70109f3, type=0x2) returned 0x1900010 [0106.301] GetCurrentObject (hdc=0x70109f3, type=0x7) returned 0x2905055a [0106.301] GetCurrentObject (hdc=0x70109f3, type=0x6) returned 0x18a0048 [0106.301] SaveDC (hdc=0x70109f3) returned 1 [0106.301] GetNearestColor (hdc=0x70109f3, color=0xf0f0f0) returned 0xf0f0f0 [0106.301] GetNearestColor (hdc=0x70109f3, color=0xa0a0a0) returned 0xa0a0a0 [0106.301] GetNearestColor (hdc=0x70109f3, color=0x696969) returned 0x696969 [0106.301] GetNearestColor (hdc=0x70109f3, color=0xa0a0a0) returned 0xa0a0a0 [0106.301] GetNearestColor (hdc=0x70109f3, color=0x0) returned 0x0 [0106.301] GetNearestColor (hdc=0x70109f3, color=0xffffff) returned 0xffffff [0106.301] GetNearestColor (hdc=0x70109f3, color=0xe5e5e5) returned 0xe5e5e5 [0106.301] GetNearestColor (hdc=0x70109f3, color=0xd8d8d8) returned 0xd8d8d8 [0106.302] GetNearestColor (hdc=0x70109f3, color=0x0) returned 0x0 [0106.302] RestoreDC (hdc=0x70109f3, nSavedDC=-1) returned 1 [0106.302] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.302] GdipReleaseDC (graphics=0x1c46d570, hdc=0x70109f3) returned 0x0 [0106.302] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0106.302] CoTaskMemAlloc (cb=0x13) returned 0x1f2f24a0 [0106.303] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0106.303] CoTaskMemFree (pv=0x1f2f24a0) [0106.303] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x433270) returned 0x0 [0106.303] GdipSetStringFormatAlign (format=0x1c475d60, align=0x1) returned 0x0 [0106.303] GdipSetStringFormatLineAlign (format=0x1c475d60, align=0x1) returned 0x0 [0106.303] GdipSetStringFormatHotkeyPrefix (format=0x1c475d60, hotkeyPrefix=2) returned 0x0 [0106.303] GdipGetStringFormatFlags (format=0x1c475d60, flags=0x4332a0) returned 0x0 [0106.303] GdipGetStringFormatTrimming (format=0x1c475d60, trimming=0x4332a0) returned 0x0 [0106.303] GdipGetStringFormatHotkeyPrefix (format=0x1c475d60, hotkeyPrefix=0x4332a0) returned 0x0 [0106.303] GdipGetFontSize (font=0x1c475d60, size=0x4332a0) returned 0x0 [0106.303] GdipGetFontStyle (font=0x1c475d60, style=0x4332a0) returned 0x0 [0106.303] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.303] GdipDeleteStringFormat (format=0x1c475d60) returned 0x0 [0106.304] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0106.304] CoTaskMemAlloc (cb=0x13) returned 0x1f2f26e0 [0106.304] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0106.304] CoTaskMemFree (pv=0x1f2f26e0) [0106.304] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x432f30) returned 0x0 [0106.305] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x432f40) returned 0x0 [0106.305] GdipSetStringFormatFlags (format=0x1c475f20, flags=0) returned 0x0 [0106.305] GdipSetStringFormatTrimming (format=0x1c475f20, trimming=0x1) returned 0x0 [0106.305] GdipSetStringFormatHotkeyPrefix (format=0x1c475f20, hotkeyPrefix=2) returned 0x0 [0106.305] GdipSetStringFormatAlign (format=0x1c475f20, align=0x1) returned 0x0 [0106.305] GdipSetStringFormatLineAlign (format=0x1c475f20, align=0x1) returned 0x0 [0106.305] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x432e58, stringFormat=0x1c475f20, boundingBox=0x432e48, codepointsFitted=0x432e44, linesFilled=0x432e40) returned 0x0 [0106.305] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.305] GdipDeleteStringFormat (format=0x1c475f20) returned 0x0 [0106.305] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.305] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0106.306] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0106.306] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2500 [0106.306] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0106.306] CoTaskMemFree (pv=0x1f2f2500) [0106.306] GdipCreateRegion (region=0x432ea0) returned 0x0 [0106.306] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0106.306] GdipCreateMatrix (matrix=0x432ea0) returned 0x0 [0106.307] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471330) returned 0x0 [0106.307] GdipIsMatrixIdentity (matrix=0x1c471330, result=0x432f00) returned 0x0 [0106.307] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c4d0 [0106.307] GdipGetMatrixElements (matrix=0x1c471330, matrixOut=0x1f32c4d0) returned 0x0 [0106.307] LocalFree (hMem=0x1f32c4d0) returned 0x0 [0106.307] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c6d0 [0106.307] GdipGetMatrixElements (matrix=0x1c471330, matrixOut=0x1f32c6d0) returned 0x0 [0106.307] LocalFree (hMem=0x1f32c6d0) returned 0x0 [0106.307] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.307] GdipDeleteMatrix (matrix=0x1c471330) returned 0x0 [0106.307] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x432f50) returned 0x0 [0106.307] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x432f10) returned 0x0 [0106.307] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x432f10) returned 0x0 [0106.307] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.307] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0106.307] GdipGetDC (graphics=0x1c46d570, hdc=0x432f80) returned 0x0 [0106.307] GetCurrentObject (hdc=0x70109f3, type=0x1) returned 0x1b00017 [0106.307] GetCurrentObject (hdc=0x70109f3, type=0x2) returned 0x1900010 [0106.307] GetCurrentObject (hdc=0x70109f3, type=0x7) returned 0x2905055a [0106.308] GetCurrentObject (hdc=0x70109f3, type=0x6) returned 0x18a0048 [0106.308] SaveDC (hdc=0x70109f3) returned 1 [0106.308] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x690406cc [0106.308] GetClipRgn (hdc=0x70109f3, hrgn=0x690406cc) returned 0 [0106.308] SelectClipRgn (hdc=0x70109f3, hrgn=0x630405d8) returned 2 [0106.308] DeleteObject (ho=0x690406cc) returned 1 [0106.308] DeleteObject (ho=0x630405d8) returned 1 [0106.308] OffsetViewportOrgEx (in: hdc=0x70109f3, x=0, y=0, lppt=0x25c2d38 | out: lppt=0x25c2d38) returned 1 [0106.308] GetNearestColor (hdc=0x70109f3, color=0xf0f0f0) returned 0xf0f0f0 [0106.308] CreateSolidBrush (color=0xf0f0f0) returned 0x2310075d [0106.308] FillRect (hDC=0x70109f3, lprc=0x432f50, hbr=0x2310075d) returned 1 [0106.308] DeleteObject (ho=0x2310075d) returned 1 [0106.308] RestoreDC (hdc=0x70109f3, nSavedDC=-1) returned 1 [0106.309] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.309] GdipReleaseDC (graphics=0x1c46d570, hdc=0x70109f3) returned 0x0 [0106.309] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0106.309] CoTaskMemAlloc (cb=0x13) returned 0x1f2f29c0 [0106.310] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0106.310] CoTaskMemFree (pv=0x1f2f29c0) [0106.310] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x432fd0) returned 0x0 [0106.310] GdipSetStringFormatAlign (format=0x1c475a50, align=0x1) returned 0x0 [0106.310] GdipSetStringFormatLineAlign (format=0x1c475a50, align=0x1) returned 0x0 [0106.310] GdipSetStringFormatHotkeyPrefix (format=0x1c475a50, hotkeyPrefix=2) returned 0x0 [0106.310] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x433040) returned 0x0 [0106.310] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x432f50, stringFormat=0x1c475a50, brush=0x1c46cce0) returned 0x0 [0106.310] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.310] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0106.310] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.310] GdipDeleteStringFormat (format=0x1c475a50) returned 0x0 [0106.310] GetFocus () returned 0xa01fa [0106.311] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0106.311] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2680 [0106.311] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0106.311] CoTaskMemFree (pv=0x1f2f2680) [0106.311] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x433330) returned 0x0 [0106.312] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0106.312] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.312] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0106.312] GdipCreateRegion (region=0x432e00) returned 0x0 [0106.312] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0106.312] GdipCreateMatrix (matrix=0x432e00) returned 0x0 [0106.312] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4713b0) returned 0x0 [0106.312] GdipIsMatrixIdentity (matrix=0x1c4713b0, result=0x432e60) returned 0x0 [0106.312] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32be90 [0106.312] GdipGetMatrixElements (matrix=0x1c4713b0, matrixOut=0x1f32be90) returned 0x0 [0106.312] LocalFree (hMem=0x1f32be90) returned 0x0 [0106.312] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c810 [0106.312] GdipGetMatrixElements (matrix=0x1c4713b0, matrixOut=0x1f32c810) returned 0x0 [0106.312] LocalFree (hMem=0x1f32c810) returned 0x0 [0106.312] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.312] GdipDeleteMatrix (matrix=0x1c4713b0) returned 0x0 [0106.312] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x432eb0) returned 0x0 [0106.312] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x432e70) returned 0x0 [0106.313] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x432e70) returned 0x0 [0106.313] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.313] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0106.313] GdipGetDC (graphics=0x1c46d570, hdc=0x432ee0) returned 0x0 [0106.313] GetCurrentObject (hdc=0x70109f3, type=0x1) returned 0x1b00017 [0106.313] GetCurrentObject (hdc=0x70109f3, type=0x2) returned 0x1900010 [0106.313] GetCurrentObject (hdc=0x70109f3, type=0x7) returned 0x2905055a [0106.314] GetCurrentObject (hdc=0x70109f3, type=0x6) returned 0x18a0048 [0106.314] SaveDC (hdc=0x70109f3) returned 1 [0106.314] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x640405d8 [0106.314] GetClipRgn (hdc=0x70109f3, hrgn=0x640405d8) returned 0 [0106.315] SelectClipRgn (hdc=0x70109f3, hrgn=0x6a0406cc) returned 2 [0106.315] DeleteObject (ho=0x640405d8) returned 1 [0106.315] DeleteObject (ho=0x6a0406cc) returned 1 [0106.315] OffsetViewportOrgEx (in: hdc=0x70109f3, x=0, y=0, lppt=0x25c32d8 | out: lppt=0x25c32d8) returned 1 [0106.315] GetROP2 (hdc=0x70109f3) returned 13 [0106.315] GetBkMode (hdc=0x70109f3) returned 2 [0106.315] SetBkMode (hdc=0x70109f3, mode=1) returned 2 [0106.315] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x13009f7 [0106.315] SelectObject (hdc=0x70109f3, h=0x13009f7) returned 0x1b00017 [0106.315] MoveToEx (in: hdc=0x70109f3, x=123, y=1, lppt=0x25c3340 | out: lppt=0x25c3340) returned 1 [0106.315] LineTo (hdc=0x70109f3, x=1, y=1) returned 1 [0106.315] SetBkMode (hdc=0x70109f3, mode=2) returned 1 [0106.315] MoveToEx (in: hdc=0x70109f3, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0106.315] GetROP2 (hdc=0x70109f3) returned 13 [0106.315] GetBkMode (hdc=0x70109f3) returned 2 [0106.315] SetBkMode (hdc=0x70109f3, mode=1) returned 2 [0106.315] SelectObject (hdc=0x70109f3, h=0x13009f7) returned 0x13009f7 [0106.316] MoveToEx (in: hdc=0x70109f3, x=1, y=1, lppt=0x25c3358 | out: lppt=0x25c3358) returned 1 [0106.316] LineTo (hdc=0x70109f3, x=1, y=34) returned 1 [0106.316] SetBkMode (hdc=0x70109f3, mode=2) returned 1 [0106.316] MoveToEx (in: hdc=0x70109f3, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0106.316] SelectObject (hdc=0x70109f3, h=0x1b00017) returned 0x13009f7 [0106.316] DeleteObject (ho=0x13009f7) returned 1 [0106.316] GetROP2 (hdc=0x70109f3) returned 13 [0106.316] GetBkMode (hdc=0x70109f3) returned 2 [0106.316] SetBkMode (hdc=0x70109f3, mode=1) returned 2 [0106.316] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x13009f8 [0106.316] SelectObject (hdc=0x70109f3, h=0x13009f8) returned 0x1b00017 [0106.316] MoveToEx (in: hdc=0x70109f3, x=1, y=34, lppt=0x25c33c0 | out: lppt=0x25c33c0) returned 1 [0106.316] LineTo (hdc=0x70109f3, x=123, y=34) returned 1 [0106.316] SetBkMode (hdc=0x70109f3, mode=2) returned 1 [0106.316] MoveToEx (in: hdc=0x70109f3, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0106.316] GetROP2 (hdc=0x70109f3) returned 13 [0106.316] GetBkMode (hdc=0x70109f3) returned 2 [0106.316] SetBkMode (hdc=0x70109f3, mode=1) returned 2 [0106.317] SelectObject (hdc=0x70109f3, h=0x13009f8) returned 0x13009f8 [0106.317] MoveToEx (in: hdc=0x70109f3, x=123, y=34, lppt=0x25c33d8 | out: lppt=0x25c33d8) returned 1 [0106.317] LineTo (hdc=0x70109f3, x=123, y=0) returned 1 [0106.317] SetBkMode (hdc=0x70109f3, mode=2) returned 1 [0106.317] MoveToEx (in: hdc=0x70109f3, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0106.317] SelectObject (hdc=0x70109f3, h=0x1b00017) returned 0x13009f8 [0106.317] DeleteObject (ho=0x13009f8) returned 1 [0106.317] GetROP2 (hdc=0x70109f3) returned 13 [0106.317] GetBkMode (hdc=0x70109f3) returned 2 [0106.317] SetBkMode (hdc=0x70109f3, mode=1) returned 2 [0106.317] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x23009f7 [0106.317] SelectObject (hdc=0x70109f3, h=0x23009f7) returned 0x1b00017 [0106.317] MoveToEx (in: hdc=0x70109f3, x=122, y=2, lppt=0x25c3440 | out: lppt=0x25c3440) returned 1 [0106.317] LineTo (hdc=0x70109f3, x=2, y=2) returned 1 [0106.317] SetBkMode (hdc=0x70109f3, mode=2) returned 1 [0106.317] MoveToEx (in: hdc=0x70109f3, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0106.317] GetROP2 (hdc=0x70109f3) returned 13 [0106.318] GetBkMode (hdc=0x70109f3) returned 2 [0106.318] SetBkMode (hdc=0x70109f3, mode=1) returned 2 [0106.318] SelectObject (hdc=0x70109f3, h=0x23009f7) returned 0x23009f7 [0106.318] MoveToEx (in: hdc=0x70109f3, x=2, y=2, lppt=0x25c3458 | out: lppt=0x25c3458) returned 1 [0106.318] LineTo (hdc=0x70109f3, x=2, y=33) returned 1 [0106.318] SetBkMode (hdc=0x70109f3, mode=2) returned 1 [0106.318] MoveToEx (in: hdc=0x70109f3, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0106.318] SelectObject (hdc=0x70109f3, h=0x1b00017) returned 0x23009f7 [0106.318] DeleteObject (ho=0x23009f7) returned 1 [0106.318] GetROP2 (hdc=0x70109f3) returned 13 [0106.318] GetBkMode (hdc=0x70109f3) returned 2 [0106.318] SetBkMode (hdc=0x70109f3, mode=1) returned 2 [0106.318] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x23009f8 [0106.318] SelectObject (hdc=0x70109f3, h=0x23009f8) returned 0x1b00017 [0106.318] MoveToEx (in: hdc=0x70109f3, x=2, y=33, lppt=0x25c34c0 | out: lppt=0x25c34c0) returned 1 [0106.318] LineTo (hdc=0x70109f3, x=122, y=33) returned 1 [0106.318] SetBkMode (hdc=0x70109f3, mode=2) returned 1 [0106.318] MoveToEx (in: hdc=0x70109f3, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0106.319] GetROP2 (hdc=0x70109f3) returned 13 [0106.319] GetBkMode (hdc=0x70109f3) returned 2 [0106.319] SetBkMode (hdc=0x70109f3, mode=1) returned 2 [0106.319] SelectObject (hdc=0x70109f3, h=0x23009f8) returned 0x23009f8 [0106.319] MoveToEx (in: hdc=0x70109f3, x=122, y=33, lppt=0x25c34d8 | out: lppt=0x25c34d8) returned 1 [0106.319] LineTo (hdc=0x70109f3, x=122, y=1) returned 1 [0106.319] SetBkMode (hdc=0x70109f3, mode=2) returned 1 [0106.319] MoveToEx (in: hdc=0x70109f3, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0106.319] SelectObject (hdc=0x70109f3, h=0x1b00017) returned 0x23009f8 [0106.319] DeleteObject (ho=0x23009f8) returned 1 [0106.319] RestoreDC (hdc=0x70109f3, nSavedDC=-1) returned 1 [0106.319] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.319] GdipReleaseDC (graphics=0x1c46d570, hdc=0x70109f3) returned 0x0 [0106.319] GdipGetDC (graphics=0x1c46d570, hdc=0x433660) returned 0x0 [0106.319] BitBlt (hdc=0x80109a9, x=0, y=0, cx=125, cy=36, hdcSrc=0x70109f3, x1=0, y1=0, rop=0xcc0020) returned 1 [0106.321] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.321] GdipReleaseDC (graphics=0x1c46d570, hdc=0x70109f3) returned 0x0 [0106.321] SelectPalette (hdc=0x80109a9, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0106.323] SelectObject (hdc=0x70109f3, h=0x185000f) returned 0x2905055a [0106.324] DeleteDC (hdc=0x70109f3) returned 1 [0106.324] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0106.324] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0106.324] EndPaint (hWnd=0xa01fa, lpPaint=0x433768) returned 1 [0108.624] LocalFree (hMem=0x5f8e40) returned 0x0 [0108.624] GetCapture () returned 0xa01fa [0108.626] ReleaseCapture () returned 1 [0108.626] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0108.627] LocalFree (hMem=0x5f9c40) returned 0x0 [0108.627] GetCapture () returned 0x0 [0108.627] LocalFree (hMem=0x5f9ac0) returned 0x0 [0108.627] GetCapture () returned 0x0 [0108.627] LocalFree (hMem=0x5f8cc0) returned 0x0 [0108.627] GetCapture () returned 0x0 [0108.627] LocalFree (hMem=0x5f94c0) returned 0x0 [0108.628] GetCapture () returned 0x0 [0108.628] LocalFree (hMem=0x5f9b40) returned 0x0 [0108.628] GetCapture () returned 0x0 [0108.628] LocalFree (hMem=0x5f8840) returned 0x0 [0108.628] GetCapture () returned 0x0 [0108.628] LocalFree (hMem=0x5f8c40) returned 0x0 [0108.628] GetCapture () returned 0x0 [0108.629] LocalFree (hMem=0x5f86c0) returned 0x0 [0108.629] GetCapture () returned 0x0 [0108.632] LocalFree (hMem=0x5f9540) returned 0x0 [0108.632] GetCapture () returned 0x0 [0108.632] LocalFree (hMem=0x5f88c0) returned 0x0 [0108.632] GetCapture () returned 0x0 [0108.633] LocalFree (hMem=0x5f84c0) returned 0x0 [0108.633] GetCapture () returned 0x0 [0108.633] LocalFree (hMem=0x5f7fc0) returned 0x0 [0108.633] GetCapture () returned 0x0 [0108.633] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0108.634] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0108.634] WaitMessage () returned 1 [0110.114] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.114] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0110.114] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.114] GetKeyState (nVirtKey=16) returned 0 [0110.114] GetKeyState (nVirtKey=17) returned 0 [0110.114] GetKeyState (nVirtKey=18) returned -127 [0110.115] SendMessageW (hWnd=0xa01fa, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0110.115] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0110.116] GetParent (hWnd=0x8016e) returned 0x0 [0110.116] SendMessageW (hWnd=0x8016e, Msg=0x127, wParam=0x20002, lParam=0x0) returned 0x0 [0110.116] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x127, wParam=0x20002, lParam=0x0) returned 0x0 [0110.130] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0110.130] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0110.130] GetStockObject (i=5) returned 0x1900015 [0110.131] GetStockObject (i=5) returned 0x1900015 [0110.131] GetDlgItem (hDlg=0x8016e, nIDDlgItem=655866) returned 0xa01fa [0110.131] SendMessageW (hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43c240) returned 0x0 [0110.131] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43c240) returned 0x0 [0110.131] RedrawWindow (hWnd=0xa01fa, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.131] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0110.131] GetStockObject (i=5) returned 0x1900015 [0110.131] GetDlgItem (hDlg=0x8016e, nIDDlgItem=131584) returned 0x20200 [0110.131] SendMessageW (hWnd=0x20200, Msg=0x202b, wParam=0x20200, lParam=0x43c250) returned 0x0 [0110.131] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x202b, wParam=0x20200, lParam=0x43c250) returned 0x0 [0110.132] RedrawWindow (hWnd=0x20200, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.132] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0110.132] GetStockObject (i=5) returned 0x1900015 [0110.132] GetDlgItem (hDlg=0x8016e, nIDDlgItem=262384) returned 0x400f0 [0110.132] SendMessageW (hWnd=0x400f0, Msg=0x202b, wParam=0x400f0, lParam=0x43c250) returned 0x0 [0110.132] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x202b, wParam=0x400f0, lParam=0x43c250) returned 0x0 [0110.132] RedrawWindow (hWnd=0x400f0, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.132] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0110.133] GetStockObject (i=5) returned 0x1900015 [0110.133] GetStockObject (i=5) returned 0x1900015 [0110.133] GetDlgItem (hDlg=0x8016e, nIDDlgItem=131592) returned 0x20208 [0110.133] SendMessageW (hWnd=0x20208, Msg=0x202b, wParam=0x20208, lParam=0x43c240) returned 0x0 [0110.133] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x202b, wParam=0x20208, lParam=0x43c240) returned 0x0 [0110.133] RedrawWindow (hWnd=0x20208, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.133] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0110.133] RedrawWindow (hWnd=0x2022e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.133] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0110.134] GetStockObject (i=5) returned 0x1900015 [0110.134] GetDlgItem (hDlg=0x8016e, nIDDlgItem=131632) returned 0x20230 [0110.134] SendMessageW (hWnd=0x20230, Msg=0x202b, wParam=0x20230, lParam=0x43c250) returned 0x0 [0110.134] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x202b, wParam=0x20230, lParam=0x43c250) returned 0x0 [0110.134] RedrawWindow (hWnd=0x20230, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.134] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0110.134] GetStockObject (i=5) returned 0x1900015 [0110.134] GetDlgItem (hDlg=0x8016e, nIDDlgItem=131618) returned 0x20222 [0110.134] SendMessageW (hWnd=0x20222, Msg=0x202b, wParam=0x20222, lParam=0x43c250) returned 0x0 [0110.134] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x202b, wParam=0x20222, lParam=0x43c250) returned 0x0 [0110.134] RedrawWindow (hWnd=0x20222, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.135] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0110.135] GetStockObject (i=5) returned 0x1900015 [0110.135] GetDlgItem (hDlg=0x8016e, nIDDlgItem=131620) returned 0x20224 [0110.135] SendMessageW (hWnd=0x20224, Msg=0x202b, wParam=0x20224, lParam=0x43c250) returned 0x0 [0110.135] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x202b, wParam=0x20224, lParam=0x43c250) returned 0x0 [0110.135] RedrawWindow (hWnd=0x20224, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.135] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0x128, wParam=0x20002, lParam=0x0) returned 0x0 [0110.135] RedrawWindow (hWnd=0x2021e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.135] RedrawWindow (hWnd=0x8016e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.150] GetKeyState (nVirtKey=16) returned 0 [0110.150] GetKeyState (nVirtKey=17) returned 0 [0110.150] GetKeyState (nVirtKey=18) returned -127 [0110.165] TranslateMessage (lpMsg=0x43e5e0) returned 1 [0110.165] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0110.165] GetKeyState (nVirtKey=16) returned 0 [0110.165] GetKeyState (nVirtKey=17) returned 0 [0110.165] GetKeyState (nVirtKey=18) returned -127 [0110.165] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x104, wParam=0x12, lParam=0x20380001) returned 0x0 [0110.165] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.165] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0110.174] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0110.174] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.174] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43e440) returned 0x0 [0110.175] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43de70 | out: lpwndpl=0x43de70) returned 1 [0110.175] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x47, wParam=0x0, lParam=0x43e440) returned 0x0 [0110.175] GetClientRect (in: hWnd=0x8016e, lpRect=0x43dc10 | out: lpRect=0x43dc10) returned 1 [0110.175] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43dc10 | out: lpRect=0x43dc10) returned 1 [0110.176] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x47, wParam=0x0, lParam=0x43e440) returned 0x0 [0110.176] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0110.179] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x1c, wParam=0x0, lParam=0x7f8) returned 0x0 [0110.179] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x1c, wParam=0x0, lParam=0x7f8) returned 0x0 [0110.179] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x1c, wParam=0x0, lParam=0x7f8) returned 0x0 [0110.179] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0110.179] GetStockObject (i=5) returned 0x1900015 [0110.179] GetDlgItem (hDlg=0x8016e, nIDDlgItem=655866) returned 0xa01fa [0110.179] SendMessageW (hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43d840) returned 0x0 [0110.179] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43d840) returned 0x0 [0110.179] GetCapture () returned 0x0 [0110.180] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0110.180] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0110.180] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0110.180] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0110.180] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0110.180] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x43d9d8 | out: lpPaint=0x43d9d8) returned 0xa0108e8 [0110.180] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.181] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x14, wParam=0xa0108e8, lParam=0x0) returned 0x1 [0110.181] GetStockObject (i=5) returned 0x1900015 [0110.181] SelectPalette (hdc=0xa0108e8, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0110.181] CreateCompatibleDC (hdc=0xa0108e8) returned 0x8010a4e [0110.181] SelectObject (hdc=0x8010a4e, h=0x2905055a) returned 0x185000f [0110.181] GdipCreateFromHDC (hdc=0x8010a4e, graphics=0x43d7e0) returned 0x0 [0110.181] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0110.181] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0110.181] GdipCreateMatrix (matrix=0x43d910) returned 0x0 [0110.181] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471730) returned 0x0 [0110.181] GdipIsMatrixIdentity (matrix=0x1c471730, result=0x43d970) returned 0x0 [0110.181] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c390 [0110.182] GdipGetMatrixElements (matrix=0x1c471730, matrixOut=0x1f32c390) returned 0x0 [0110.182] LocalFree (hMem=0x1f32c390) returned 0x0 [0110.182] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.182] GdipDeleteMatrix (matrix=0x1c471730) returned 0x0 [0110.182] GdipCreateRegion (region=0x43d910) returned 0x0 [0110.182] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0110.182] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d940) returned 0x0 [0110.182] GdipSaveGraphics (graphics=0x1c46d570, state=0x43da10) returned 0x0 [0110.182] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd6a0dbd) returned 0x0 [0110.182] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.182] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0110.182] GdipGetDC (graphics=0x1c46d570, hdc=0x43ce00) returned 0x0 [0110.183] GetCurrentObject (hdc=0x8010a4e, type=0x1) returned 0x1b00017 [0110.183] GetCurrentObject (hdc=0x8010a4e, type=0x2) returned 0x1900010 [0110.183] GetCurrentObject (hdc=0x8010a4e, type=0x7) returned 0x2905055a [0110.183] GetCurrentObject (hdc=0x8010a4e, type=0x6) returned 0x18a0048 [0110.184] SaveDC (hdc=0x8010a4e) returned 1 [0110.184] GetNearestColor (hdc=0x8010a4e, color=0xf0f0f0) returned 0xf0f0f0 [0110.184] GetNearestColor (hdc=0x8010a4e, color=0xa0a0a0) returned 0xa0a0a0 [0110.184] GetNearestColor (hdc=0x8010a4e, color=0x696969) returned 0x696969 [0110.184] GetNearestColor (hdc=0x8010a4e, color=0xa0a0a0) returned 0xa0a0a0 [0110.184] GetNearestColor (hdc=0x8010a4e, color=0x0) returned 0x0 [0110.184] GetNearestColor (hdc=0x8010a4e, color=0xffffff) returned 0xffffff [0110.184] GetNearestColor (hdc=0x8010a4e, color=0xe5e5e5) returned 0xe5e5e5 [0110.185] GetNearestColor (hdc=0x8010a4e, color=0xd8d8d8) returned 0xd8d8d8 [0110.195] GetNearestColor (hdc=0x8010a4e, color=0x0) returned 0x0 [0110.195] RestoreDC (hdc=0x8010a4e, nSavedDC=-1) returned 1 [0110.195] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.196] GdipReleaseDC (graphics=0x1c46d570, hdc=0x8010a4e) returned 0x0 [0110.196] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0110.196] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3200 [0110.196] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0110.196] CoTaskMemFree (pv=0x1f2f3200) [0110.196] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d4f0) returned 0x0 [0110.196] GdipSetStringFormatAlign (format=0x1c476540, align=0x1) returned 0x0 [0110.196] GdipSetStringFormatLineAlign (format=0x1c476540, align=0x1) returned 0x0 [0110.197] GdipSetStringFormatHotkeyPrefix (format=0x1c476540, hotkeyPrefix=1) returned 0x0 [0110.197] GdipGetStringFormatFlags (format=0x1c476540, flags=0x43d520) returned 0x0 [0110.197] GdipGetStringFormatTrimming (format=0x1c476540, trimming=0x43d520) returned 0x0 [0110.197] GdipGetStringFormatHotkeyPrefix (format=0x1c476540, hotkeyPrefix=0x43d520) returned 0x0 [0110.197] GdipGetFontSize (font=0x1c476540, size=0x43d520) returned 0x0 [0110.197] GdipGetFontStyle (font=0x1c476540, style=0x43d520) returned 0x0 [0110.197] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.197] GdipDeleteStringFormat (format=0x1c476540) returned 0x0 [0110.197] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0110.197] CoTaskMemAlloc (cb=0x13) returned 0x1f2f31a0 [0110.197] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0110.197] CoTaskMemFree (pv=0x1f2f31a0) [0110.197] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43d1b0) returned 0x0 [0110.198] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d1c0) returned 0x0 [0110.198] GdipSetStringFormatFlags (format=0x1c475dd0, flags=0) returned 0x0 [0110.198] GdipSetStringFormatTrimming (format=0x1c475dd0, trimming=0x1) returned 0x0 [0110.198] GdipSetStringFormatHotkeyPrefix (format=0x1c475dd0, hotkeyPrefix=1) returned 0x0 [0110.198] GdipSetStringFormatAlign (format=0x1c475dd0, align=0x1) returned 0x0 [0110.198] GdipSetStringFormatLineAlign (format=0x1c475dd0, align=0x1) returned 0x0 [0110.198] GdipMeasureString (graphics=0x1c4688d0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43d0d8, stringFormat=0x1c475dd0, boundingBox=0x43d0c8, codepointsFitted=0x43d0c4, linesFilled=0x43d0c0) returned 0x0 [0110.198] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.198] GdipDeleteStringFormat (format=0x1c475dd0) returned 0x0 [0110.198] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.198] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0110.198] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0110.199] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2d40 [0110.199] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0110.199] CoTaskMemFree (pv=0x1f2f2d40) [0110.199] GdipCreateRegion (region=0x43d120) returned 0x0 [0110.199] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0110.199] GdipCreateMatrix (matrix=0x43d120) returned 0x0 [0110.199] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471770) returned 0x0 [0110.199] GdipIsMatrixIdentity (matrix=0x1c471770, result=0x43d180) returned 0x0 [0110.199] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c2d0 [0110.199] GdipGetMatrixElements (matrix=0x1c471770, matrixOut=0x1f32c2d0) returned 0x0 [0110.199] LocalFree (hMem=0x1f32c2d0) returned 0x0 [0110.199] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c910 [0110.200] GdipGetMatrixElements (matrix=0x1c471770, matrixOut=0x1f32c910) returned 0x0 [0110.200] LocalFree (hMem=0x1f32c910) returned 0x0 [0110.200] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.200] GdipDeleteMatrix (matrix=0x1c471770) returned 0x0 [0110.200] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d1d0) returned 0x0 [0110.200] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d190) returned 0x0 [0110.200] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43d190) returned 0x0 [0110.200] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.200] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0110.200] GdipGetDC (graphics=0x1c46d570, hdc=0x43d200) returned 0x0 [0110.200] GetCurrentObject (hdc=0x8010a4e, type=0x1) returned 0x1b00017 [0110.200] GetCurrentObject (hdc=0x8010a4e, type=0x2) returned 0x1900010 [0110.200] GetCurrentObject (hdc=0x8010a4e, type=0x7) returned 0x2905055a [0110.203] GetCurrentObject (hdc=0x8010a4e, type=0x6) returned 0x18a0048 [0110.203] SaveDC (hdc=0x8010a4e) returned 1 [0110.203] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6b0406cc [0110.203] GetClipRgn (hdc=0x8010a4e, hrgn=0x6b0406cc) returned 0 [0110.203] SelectClipRgn (hdc=0x8010a4e, hrgn=0x650405d8) returned 2 [0110.203] DeleteObject (ho=0x6b0406cc) returned 1 [0110.203] DeleteObject (ho=0x650405d8) returned 1 [0110.203] OffsetViewportOrgEx (in: hdc=0x8010a4e, x=0, y=0, lppt=0x25c46d0 | out: lppt=0x25c46d0) returned 1 [0110.203] GetNearestColor (hdc=0x8010a4e, color=0xf0f0f0) returned 0xf0f0f0 [0110.204] CreateSolidBrush (color=0xf0f0f0) returned 0x2410075d [0110.204] FillRect (hDC=0x8010a4e, lprc=0x43d1d0, hbr=0x2410075d) returned 1 [0110.204] DeleteObject (ho=0x2410075d) returned 1 [0110.204] RestoreDC (hdc=0x8010a4e, nSavedDC=-1) returned 1 [0110.204] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.204] GdipReleaseDC (graphics=0x1c46d570, hdc=0x8010a4e) returned 0x0 [0110.205] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0110.205] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3040 [0110.205] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0110.205] CoTaskMemFree (pv=0x1f2f3040) [0110.205] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d250) returned 0x0 [0110.205] GdipSetStringFormatAlign (format=0x1c475a50, align=0x1) returned 0x0 [0110.205] GdipSetStringFormatLineAlign (format=0x1c475a50, align=0x1) returned 0x0 [0110.205] GdipSetStringFormatHotkeyPrefix (format=0x1c475a50, hotkeyPrefix=1) returned 0x0 [0110.205] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x43d2c0) returned 0x0 [0110.205] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43d1d0, stringFormat=0x1c475a50, brush=0x1c46cce0) returned 0x0 [0110.206] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.206] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0110.206] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.206] GdipDeleteStringFormat (format=0x1c475a50) returned 0x0 [0110.206] GetFocus () returned 0x0 [0110.206] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0110.206] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2f60 [0110.207] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0110.207] CoTaskMemFree (pv=0x1f2f2f60) [0110.207] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x43d5b0) returned 0x0 [0110.207] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0110.207] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.207] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0110.207] GdipCreateRegion (region=0x43d080) returned 0x0 [0110.207] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0110.207] GdipCreateMatrix (matrix=0x43d080) returned 0x0 [0110.207] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4710b0) returned 0x0 [0110.207] GdipIsMatrixIdentity (matrix=0x1c4710b0, result=0x43d0e0) returned 0x0 [0110.207] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c910 [0110.207] GdipGetMatrixElements (matrix=0x1c4710b0, matrixOut=0x1f32c910) returned 0x0 [0110.207] LocalFree (hMem=0x1f32c910) returned 0x0 [0110.207] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c910 [0110.207] GdipGetMatrixElements (matrix=0x1c4710b0, matrixOut=0x1f32c910) returned 0x0 [0110.207] LocalFree (hMem=0x1f32c910) returned 0x0 [0110.207] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.207] GdipDeleteMatrix (matrix=0x1c4710b0) returned 0x0 [0110.208] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d130) returned 0x0 [0110.208] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d0f0) returned 0x0 [0110.208] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43d0f0) returned 0x0 [0110.208] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.208] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0110.208] GdipGetDC (graphics=0x1c46d570, hdc=0x43d160) returned 0x0 [0110.208] GetCurrentObject (hdc=0x8010a4e, type=0x1) returned 0x1b00017 [0110.208] GetCurrentObject (hdc=0x8010a4e, type=0x2) returned 0x1900010 [0110.208] GetCurrentObject (hdc=0x8010a4e, type=0x7) returned 0x2905055a [0110.208] GetCurrentObject (hdc=0x8010a4e, type=0x6) returned 0x18a0048 [0110.208] SaveDC (hdc=0x8010a4e) returned 1 [0110.208] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x660405d8 [0110.208] GetClipRgn (hdc=0x8010a4e, hrgn=0x660405d8) returned 0 [0110.208] SelectClipRgn (hdc=0x8010a4e, hrgn=0x6c0406cc) returned 2 [0110.208] DeleteObject (ho=0x660405d8) returned 1 [0110.208] DeleteObject (ho=0x6c0406cc) returned 1 [0110.208] OffsetViewportOrgEx (in: hdc=0x8010a4e, x=0, y=0, lppt=0x25c4c70 | out: lppt=0x25c4c70) returned 1 [0110.208] GetROP2 (hdc=0x8010a4e) returned 13 [0110.208] GetBkMode (hdc=0x8010a4e) returned 2 [0110.209] SetBkMode (hdc=0x8010a4e, mode=1) returned 2 [0110.209] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x14300a4c [0110.209] SelectObject (hdc=0x8010a4e, h=0x14300a4c) returned 0x1b00017 [0110.209] MoveToEx (in: hdc=0x8010a4e, x=123, y=1, lppt=0x25c4cd8 | out: lppt=0x25c4cd8) returned 1 [0110.209] LineTo (hdc=0x8010a4e, x=1, y=1) returned 1 [0110.209] SetBkMode (hdc=0x8010a4e, mode=2) returned 1 [0110.209] MoveToEx (in: hdc=0x8010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.209] GetROP2 (hdc=0x8010a4e) returned 13 [0110.209] GetBkMode (hdc=0x8010a4e) returned 2 [0110.209] SetBkMode (hdc=0x8010a4e, mode=1) returned 2 [0110.209] SelectObject (hdc=0x8010a4e, h=0x14300a4c) returned 0x14300a4c [0110.209] MoveToEx (in: hdc=0x8010a4e, x=1, y=1, lppt=0x25c4cf0 | out: lppt=0x25c4cf0) returned 1 [0110.209] LineTo (hdc=0x8010a4e, x=1, y=34) returned 1 [0110.209] SetBkMode (hdc=0x8010a4e, mode=2) returned 1 [0110.209] MoveToEx (in: hdc=0x8010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.209] SelectObject (hdc=0x8010a4e, h=0x1b00017) returned 0x14300a4c [0110.209] DeleteObject (ho=0x14300a4c) returned 1 [0110.209] GetROP2 (hdc=0x8010a4e) returned 13 [0110.209] GetBkMode (hdc=0x8010a4e) returned 2 [0110.210] SetBkMode (hdc=0x8010a4e, mode=1) returned 2 [0110.210] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x4300a50 [0110.210] SelectObject (hdc=0x8010a4e, h=0x4300a50) returned 0x1b00017 [0110.210] MoveToEx (in: hdc=0x8010a4e, x=1, y=34, lppt=0x25c4d58 | out: lppt=0x25c4d58) returned 1 [0110.210] LineTo (hdc=0x8010a4e, x=123, y=34) returned 1 [0110.210] SetBkMode (hdc=0x8010a4e, mode=2) returned 1 [0110.210] MoveToEx (in: hdc=0x8010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.210] GetROP2 (hdc=0x8010a4e) returned 13 [0110.210] GetBkMode (hdc=0x8010a4e) returned 2 [0110.210] SetBkMode (hdc=0x8010a4e, mode=1) returned 2 [0110.210] SelectObject (hdc=0x8010a4e, h=0x4300a50) returned 0x4300a50 [0110.210] MoveToEx (in: hdc=0x8010a4e, x=123, y=34, lppt=0x25c4d70 | out: lppt=0x25c4d70) returned 1 [0110.210] LineTo (hdc=0x8010a4e, x=123, y=0) returned 1 [0110.210] SetBkMode (hdc=0x8010a4e, mode=2) returned 1 [0110.210] MoveToEx (in: hdc=0x8010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.210] SelectObject (hdc=0x8010a4e, h=0x1b00017) returned 0x4300a50 [0110.210] DeleteObject (ho=0x4300a50) returned 1 [0110.210] GetROP2 (hdc=0x8010a4e) returned 13 [0110.210] GetBkMode (hdc=0x8010a4e) returned 2 [0110.211] SetBkMode (hdc=0x8010a4e, mode=1) returned 2 [0110.211] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x15300a4c [0110.211] SelectObject (hdc=0x8010a4e, h=0x15300a4c) returned 0x1b00017 [0110.211] MoveToEx (in: hdc=0x8010a4e, x=122, y=2, lppt=0x25c4dd8 | out: lppt=0x25c4dd8) returned 1 [0110.211] LineTo (hdc=0x8010a4e, x=2, y=2) returned 1 [0110.211] SetBkMode (hdc=0x8010a4e, mode=2) returned 1 [0110.211] MoveToEx (in: hdc=0x8010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.211] GetROP2 (hdc=0x8010a4e) returned 13 [0110.211] GetBkMode (hdc=0x8010a4e) returned 2 [0110.211] SetBkMode (hdc=0x8010a4e, mode=1) returned 2 [0110.211] SelectObject (hdc=0x8010a4e, h=0x15300a4c) returned 0x15300a4c [0110.211] MoveToEx (in: hdc=0x8010a4e, x=2, y=2, lppt=0x25c4df0 | out: lppt=0x25c4df0) returned 1 [0110.211] LineTo (hdc=0x8010a4e, x=2, y=33) returned 1 [0110.211] SetBkMode (hdc=0x8010a4e, mode=2) returned 1 [0110.211] MoveToEx (in: hdc=0x8010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.211] SelectObject (hdc=0x8010a4e, h=0x1b00017) returned 0x15300a4c [0110.211] DeleteObject (ho=0x15300a4c) returned 1 [0110.211] GetROP2 (hdc=0x8010a4e) returned 13 [0110.211] GetBkMode (hdc=0x8010a4e) returned 2 [0110.212] SetBkMode (hdc=0x8010a4e, mode=1) returned 2 [0110.212] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x5300a50 [0110.212] SelectObject (hdc=0x8010a4e, h=0x5300a50) returned 0x1b00017 [0110.212] MoveToEx (in: hdc=0x8010a4e, x=2, y=33, lppt=0x25c4e58 | out: lppt=0x25c4e58) returned 1 [0110.212] LineTo (hdc=0x8010a4e, x=122, y=33) returned 1 [0110.212] SetBkMode (hdc=0x8010a4e, mode=2) returned 1 [0110.212] MoveToEx (in: hdc=0x8010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.212] GetROP2 (hdc=0x8010a4e) returned 13 [0110.212] GetBkMode (hdc=0x8010a4e) returned 2 [0110.212] SetBkMode (hdc=0x8010a4e, mode=1) returned 2 [0110.212] SelectObject (hdc=0x8010a4e, h=0x5300a50) returned 0x5300a50 [0110.212] MoveToEx (in: hdc=0x8010a4e, x=122, y=33, lppt=0x25c4e70 | out: lppt=0x25c4e70) returned 1 [0110.212] LineTo (hdc=0x8010a4e, x=122, y=1) returned 1 [0110.212] SetBkMode (hdc=0x8010a4e, mode=2) returned 1 [0110.212] MoveToEx (in: hdc=0x8010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.212] SelectObject (hdc=0x8010a4e, h=0x1b00017) returned 0x5300a50 [0110.212] DeleteObject (ho=0x5300a50) returned 1 [0110.212] RestoreDC (hdc=0x8010a4e, nSavedDC=-1) returned 1 [0110.213] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.213] GdipReleaseDC (graphics=0x1c46d570, hdc=0x8010a4e) returned 0x0 [0110.213] GdipGetDC (graphics=0x1c46d570, hdc=0x43d8e0) returned 0x0 [0110.213] BitBlt (hdc=0xa0108e8, x=0, y=0, cx=125, cy=36, hdcSrc=0x8010a4e, x1=0, y1=0, rop=0xcc0020) returned 1 [0110.213] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.213] GdipReleaseDC (graphics=0x1c46d570, hdc=0x8010a4e) returned 0x0 [0110.213] SelectPalette (hdc=0xa0108e8, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0110.213] SelectObject (hdc=0x8010a4e, h=0x185000f) returned 0x2905055a [0110.213] DeleteDC (hdc=0x8010a4e) returned 1 [0110.213] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.213] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0110.213] EndPaint (hWnd=0xa01fa, lpPaint=0x43d9e8) returned 1 [0110.213] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.213] IsWindowUnicode (hWnd=0x20200) returned 1 [0110.214] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.214] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0110.214] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0110.214] BeginPaint (in: hWnd=0x20200, lpPaint=0x43d9d8 | out: lpPaint=0x43d9d8) returned 0xa0108e8 [0110.214] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.214] SelectPalette (hdc=0xa0108e8, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0110.214] CreateCompatibleDC (hdc=0xa0108e8) returned 0xb010a4e [0110.214] SelectObject (hdc=0xb010a4e, h=0x2905055a) returned 0x185000f [0110.214] GdipCreateFromHDC (hdc=0xb010a4e, graphics=0x43d7e0) returned 0x0 [0110.214] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0110.215] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=84, height=25, combineMode=0x0) returned 0x0 [0110.215] GdipCreateMatrix (matrix=0x43d910) returned 0x0 [0110.215] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4715b0) returned 0x0 [0110.215] GdipIsMatrixIdentity (matrix=0x1c4715b0, result=0x43d970) returned 0x0 [0110.215] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c890 [0110.215] GdipGetMatrixElements (matrix=0x1c4715b0, matrixOut=0x1f32c890) returned 0x0 [0110.215] LocalFree (hMem=0x1f32c890) returned 0x0 [0110.215] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.215] GdipDeleteMatrix (matrix=0x1c4715b0) returned 0x0 [0110.215] GdipCreateRegion (region=0x43d910) returned 0x0 [0110.215] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0110.215] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d940) returned 0x0 [0110.215] GdipSaveGraphics (graphics=0x1c46d570, state=0x43da10) returned 0x0 [0110.215] GetWindowTextLengthW (hWnd=0x20200) returned 7 [0110.215] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0110.215] GetSystemMetrics (nIndex=42) returned 0 [0110.215] CoTaskMemAlloc (cb=0x14) returned 0x1f2f3400 [0110.216] GetWindowTextW (in: hWnd=0x20200, lpString=0x1f2f3400, nMaxCount=8 | out: lpString="LHNIWSJ") returned 7 [0110.216] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xd, wParam=0x8, lParam=0x1f2f3400) returned 0x7 [0110.216] CoTaskMemFree (pv=0x1f2f3400) [0110.216] GetClientRect (in: hWnd=0x20200, lpRect=0x43d980 | out: lpRect=0x43d980) returned 1 [0110.216] GdipCreateRegion (region=0x43d400) returned 0x0 [0110.223] GdipGetClip (graphics=0x1c46d570, region=0x1c468be0) returned 0x0 [0110.223] GdipCreateMatrix (matrix=0x43d400) returned 0x0 [0110.223] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4714b0) returned 0x0 [0110.223] GdipIsMatrixIdentity (matrix=0x1c4714b0, result=0x43d460) returned 0x0 [0110.223] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32ca90 [0110.223] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f32ca90) returned 0x0 [0110.223] LocalFree (hMem=0x1f32ca90) returned 0x0 [0110.223] GdipCombineRegionRegion (region=0x1c468be0, region2=0x1c46a710, combineMode=0x1) returned 0x0 [0110.223] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32cad0 [0110.223] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f32cad0) returned 0x0 [0110.224] LocalFree (hMem=0x1f32cad0) returned 0x0 [0110.224] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.224] GdipDeleteMatrix (matrix=0x1c4714b0) returned 0x0 [0110.224] GdipIsInfiniteRegion (region=0x1c468be0, graphics=0x1c46d570, result=0x43d4b0) returned 0x0 [0110.224] GdipIsInfiniteRegion (region=0x1c468be0, graphics=0x1c46d570, result=0x43d470) returned 0x0 [0110.224] GdipGetRegionHRgn (region=0x1c468be0, graphics=0x1c46d570, hRgn=0x43d470) returned 0x0 [0110.224] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.224] GdipDeleteRegion (region=0x1c468be0) returned 0x0 [0110.224] GdipGetDC (graphics=0x1c46d570, hdc=0x43d4e0) returned 0x0 [0110.224] GetCurrentObject (hdc=0xb010a4e, type=0x1) returned 0x1b00017 [0110.224] GetCurrentObject (hdc=0xb010a4e, type=0x2) returned 0x1900010 [0110.224] GetCurrentObject (hdc=0xb010a4e, type=0x7) returned 0x2905055a [0110.224] GetCurrentObject (hdc=0xb010a4e, type=0x6) returned 0x18a0048 [0110.224] SaveDC (hdc=0xb010a4e) returned 1 [0110.224] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6d0406cc [0110.224] GetClipRgn (hdc=0xb010a4e, hrgn=0x6d0406cc) returned 0 [0110.225] SelectClipRgn (hdc=0xb010a4e, hrgn=0x670405d8) returned 2 [0110.225] DeleteObject (ho=0x6d0406cc) returned 1 [0110.225] DeleteObject (ho=0x670405d8) returned 1 [0110.225] OffsetViewportOrgEx (in: hdc=0xb010a4e, x=0, y=0, lppt=0x25c5450 | out: lppt=0x25c5450) returned 1 [0110.225] GetNearestColor (hdc=0xb010a4e, color=0x0) returned 0x0 [0110.225] CreateSolidBrush (color=0x0) returned 0x2510075d [0110.225] FillRect (hDC=0xb010a4e, lprc=0x43d4b0, hbr=0x2510075d) returned 1 [0110.225] DeleteObject (ho=0x2510075d) returned 1 [0110.225] RestoreDC (hdc=0xb010a4e, nSavedDC=-1) returned 1 [0110.225] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.225] GdipReleaseDC (graphics=0x1c46d570, hdc=0xb010a4e) returned 0x0 [0110.225] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd670dbd) returned 0x0 [0110.225] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.225] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0110.226] GetWindowTextLengthW (hWnd=0x20200) returned 7 [0110.226] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0110.226] GetSystemMetrics (nIndex=42) returned 0 [0110.226] CoTaskMemAlloc (cb=0x14) returned 0x1f2f3400 [0110.226] GetWindowTextW (in: hWnd=0x20200, lpString=0x1f2f3400, nMaxCount=8 | out: lpString="LHNIWSJ") returned 7 [0110.226] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20200, Msg=0xd, wParam=0x8, lParam=0x1f2f3400) returned 0x7 [0110.226] CoTaskMemFree (pv=0x1f2f3400) [0110.226] GdipGetDC (graphics=0x1c46d570, hdc=0x43d540) returned 0x0 [0110.226] GetCurrentObject (hdc=0xb010a4e, type=0x1) returned 0x1b00017 [0110.226] GetCurrentObject (hdc=0xb010a4e, type=0x2) returned 0x1900010 [0110.226] GetCurrentObject (hdc=0xb010a4e, type=0x7) returned 0x2905055a [0110.226] GetCurrentObject (hdc=0xb010a4e, type=0x6) returned 0x18a0048 [0110.226] SaveDC (hdc=0xb010a4e) returned 1 [0110.226] GetNearestColor (hdc=0xb010a4e, color=0x80) returned 0x80 [0110.226] RestoreDC (hdc=0xb010a4e, nSavedDC=-1) returned 1 [0110.226] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.226] GdipReleaseDC (graphics=0x1c46d570, hdc=0xb010a4e) returned 0x0 [0110.227] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d4d0) returned 0x0 [0110.227] GdipSetStringFormatAlign (format=0x1c4762a0, align=0x0) returned 0x0 [0110.227] GdipSetStringFormatLineAlign (format=0x1c4762a0, align=0x0) returned 0x0 [0110.227] GdipSetStringFormatHotkeyPrefix (format=0x1c4762a0, hotkeyPrefix=1) returned 0x0 [0110.227] GdipGetStringFormatFlags (format=0x1c4762a0, flags=0x43d4f0) returned 0x0 [0110.227] GdipSetStringFormatFlags (format=0x1c4762a0, flags=2048) returned 0x0 [0110.227] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x43d540) returned 0x0 [0110.227] GdipDrawString (graphics=0x1c46d570, string="LHNIWSJ", length=7, font=0x1c467850, layoutRect=0x43d450, stringFormat=0x1c4762a0, brush=0x1c46cce0) returned 0x0 [0110.227] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.227] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0110.227] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.227] GdipDeleteStringFormat (format=0x1c4762a0) returned 0x0 [0110.227] GdipGetDC (graphics=0x1c46d570, hdc=0x43d8e0) returned 0x0 [0110.227] BitBlt (hdc=0xa0108e8, x=0, y=0, cx=84, cy=25, hdcSrc=0xb010a4e, x1=0, y1=0, rop=0xcc0020) returned 1 [0110.228] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.228] GdipReleaseDC (graphics=0x1c46d570, hdc=0xb010a4e) returned 0x0 [0110.228] SelectPalette (hdc=0xa0108e8, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0110.228] SelectObject (hdc=0xb010a4e, h=0x185000f) returned 0x2905055a [0110.228] DeleteDC (hdc=0xb010a4e) returned 1 [0110.229] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.229] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0110.229] EndPaint (hWnd=0x20200, lpPaint=0x43d9e8) returned 1 [0110.229] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.229] IsWindowUnicode (hWnd=0x400f0) returned 1 [0110.229] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.229] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0110.229] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0110.229] BeginPaint (in: hWnd=0x400f0, lpPaint=0x43d9d8 | out: lpPaint=0x43d9d8) returned 0x4010a51 [0110.229] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.229] SelectPalette (hdc=0x4010a51, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0110.229] CreateCompatibleDC (hdc=0x4010a51) returned 0xe010a4e [0110.230] SelectObject (hdc=0xe010a4e, h=0x2905055a) returned 0x185000f [0110.230] GdipCreateFromHDC (hdc=0xe010a4e, graphics=0x43d7e0) returned 0x0 [0110.230] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0110.230] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=87, height=25, combineMode=0x0) returned 0x0 [0110.230] GdipCreateMatrix (matrix=0x43d910) returned 0x0 [0110.230] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4711f0) returned 0x0 [0110.230] GdipIsMatrixIdentity (matrix=0x1c4711f0, result=0x43d970) returned 0x0 [0110.230] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c750 [0110.230] GdipGetMatrixElements (matrix=0x1c4711f0, matrixOut=0x1f32c750) returned 0x0 [0110.230] LocalFree (hMem=0x1f32c750) returned 0x0 [0110.230] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.230] GdipDeleteMatrix (matrix=0x1c4711f0) returned 0x0 [0110.230] GdipCreateRegion (region=0x43d910) returned 0x0 [0110.230] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0110.230] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d940) returned 0x0 [0110.230] GdipSaveGraphics (graphics=0x1c46d570, state=0x43da10) returned 0x0 [0110.230] GetWindowTextLengthW (hWnd=0x400f0) returned 9 [0110.231] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9 [0110.231] GetSystemMetrics (nIndex=42) returned 0 [0110.231] CoTaskMemAlloc (cb=0x18) returned 0x1f2f2e00 [0110.231] GetWindowTextW (in: hWnd=0x400f0, lpString=0x1f2f2e00, nMaxCount=10 | out: lpString="Enter PIN") returned 9 [0110.231] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0xd, wParam=0xa, lParam=0x1f2f2e00) returned 0x9 [0110.231] CoTaskMemFree (pv=0x1f2f2e00) [0110.231] GetClientRect (in: hWnd=0x400f0, lpRect=0x43d980 | out: lpRect=0x43d980) returned 1 [0110.231] GdipCreateRegion (region=0x43d400) returned 0x0 [0110.231] GdipGetClip (graphics=0x1c46d570, region=0x1c468be0) returned 0x0 [0110.231] GdipCreateMatrix (matrix=0x43d400) returned 0x0 [0110.231] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4713b0) returned 0x0 [0110.231] GdipIsMatrixIdentity (matrix=0x1c4713b0, result=0x43d460) returned 0x0 [0110.231] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c890 [0110.231] GdipGetMatrixElements (matrix=0x1c4713b0, matrixOut=0x1f32c890) returned 0x0 [0110.231] LocalFree (hMem=0x1f32c890) returned 0x0 [0110.231] GdipCombineRegionRegion (region=0x1c468be0, region2=0x1c46a710, combineMode=0x1) returned 0x0 [0110.231] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c250 [0110.231] GdipGetMatrixElements (matrix=0x1c4713b0, matrixOut=0x1f32c250) returned 0x0 [0110.257] LocalFree (hMem=0x1f32c250) returned 0x0 [0110.257] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.257] GdipDeleteMatrix (matrix=0x1c4713b0) returned 0x0 [0110.257] GdipIsInfiniteRegion (region=0x1c468be0, graphics=0x1c46d570, result=0x43d4b0) returned 0x0 [0110.257] GdipIsInfiniteRegion (region=0x1c468be0, graphics=0x1c46d570, result=0x43d470) returned 0x0 [0110.257] GdipGetRegionHRgn (region=0x1c468be0, graphics=0x1c46d570, hRgn=0x43d470) returned 0x0 [0110.257] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.257] GdipDeleteRegion (region=0x1c468be0) returned 0x0 [0110.257] GdipGetDC (graphics=0x1c46d570, hdc=0x43d4e0) returned 0x0 [0110.257] GetCurrentObject (hdc=0xe010a4e, type=0x1) returned 0x1b00017 [0110.257] GetCurrentObject (hdc=0xe010a4e, type=0x2) returned 0x1900010 [0110.258] GetCurrentObject (hdc=0xe010a4e, type=0x7) returned 0x2905055a [0110.258] GetCurrentObject (hdc=0xe010a4e, type=0x6) returned 0x18a0048 [0110.258] SaveDC (hdc=0xe010a4e) returned 1 [0110.258] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x680405d8 [0110.258] GetClipRgn (hdc=0xe010a4e, hrgn=0x680405d8) returned 0 [0110.258] SelectClipRgn (hdc=0xe010a4e, hrgn=0x6e0406cc) returned 2 [0110.258] DeleteObject (ho=0x680405d8) returned 1 [0110.258] DeleteObject (ho=0x6e0406cc) returned 1 [0110.258] OffsetViewportOrgEx (in: hdc=0xe010a4e, x=0, y=0, lppt=0x25c5de8 | out: lppt=0x25c5de8) returned 1 [0110.258] GetNearestColor (hdc=0xe010a4e, color=0x0) returned 0x0 [0110.258] CreateSolidBrush (color=0x0) returned 0x2610075d [0110.258] FillRect (hDC=0xe010a4e, lprc=0x43d4b0, hbr=0x2610075d) returned 1 [0110.258] DeleteObject (ho=0x2610075d) returned 1 [0110.258] RestoreDC (hdc=0xe010a4e, nSavedDC=-1) returned 1 [0110.258] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.258] GdipReleaseDC (graphics=0x1c46d570, hdc=0xe010a4e) returned 0x0 [0110.258] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd650dbd) returned 0x0 [0110.259] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.259] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0110.259] GetWindowTextLengthW (hWnd=0x400f0) returned 9 [0110.259] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9 [0110.259] GetSystemMetrics (nIndex=42) returned 0 [0110.259] CoTaskMemAlloc (cb=0x18) returned 0x1f2f3200 [0110.259] GetWindowTextW (in: hWnd=0x400f0, lpString=0x1f2f3200, nMaxCount=10 | out: lpString="Enter PIN") returned 9 [0110.259] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x400f0, Msg=0xd, wParam=0xa, lParam=0x1f2f3200) returned 0x9 [0110.259] CoTaskMemFree (pv=0x1f2f3200) [0110.259] GdipGetDC (graphics=0x1c46d570, hdc=0x43d540) returned 0x0 [0110.259] GetCurrentObject (hdc=0xe010a4e, type=0x1) returned 0x1b00017 [0110.259] GetCurrentObject (hdc=0xe010a4e, type=0x2) returned 0x1900010 [0110.259] GetCurrentObject (hdc=0xe010a4e, type=0x7) returned 0x2905055a [0110.259] GetCurrentObject (hdc=0xe010a4e, type=0x6) returned 0x18a0048 [0110.259] SaveDC (hdc=0xe010a4e) returned 1 [0110.259] GetNearestColor (hdc=0xe010a4e, color=0x80) returned 0x80 [0110.259] RestoreDC (hdc=0xe010a4e, nSavedDC=-1) returned 1 [0110.259] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.259] GdipReleaseDC (graphics=0x1c46d570, hdc=0xe010a4e) returned 0x0 [0110.259] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d4d0) returned 0x0 [0110.260] GdipSetStringFormatAlign (format=0x1c476540, align=0x0) returned 0x0 [0110.260] GdipSetStringFormatLineAlign (format=0x1c476540, align=0x0) returned 0x0 [0110.260] GdipSetStringFormatHotkeyPrefix (format=0x1c476540, hotkeyPrefix=1) returned 0x0 [0110.260] GdipGetStringFormatFlags (format=0x1c476540, flags=0x43d4f0) returned 0x0 [0110.260] GdipSetStringFormatFlags (format=0x1c476540, flags=2048) returned 0x0 [0110.260] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x43d540) returned 0x0 [0110.260] GdipDrawString (graphics=0x1c46d570, string="Enter PIN", length=9, font=0x1c467810, layoutRect=0x43d450, stringFormat=0x1c476540, brush=0x1c46cce0) returned 0x0 [0110.260] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.260] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0110.260] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.260] GdipDeleteStringFormat (format=0x1c476540) returned 0x0 [0110.260] GdipGetDC (graphics=0x1c46d570, hdc=0x43d8e0) returned 0x0 [0110.260] BitBlt (hdc=0x4010a51, x=0, y=0, cx=87, cy=25, hdcSrc=0xe010a4e, x1=0, y1=0, rop=0xcc0020) returned 1 [0110.260] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.260] GdipReleaseDC (graphics=0x1c46d570, hdc=0xe010a4e) returned 0x0 [0110.260] SelectPalette (hdc=0x4010a51, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0110.260] SelectObject (hdc=0xe010a4e, h=0x185000f) returned 0x2905055a [0110.260] DeleteDC (hdc=0xe010a4e) returned 1 [0110.260] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.260] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0110.261] EndPaint (hWnd=0x400f0, lpPaint=0x43d9e8) returned 1 [0110.261] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.261] IsWindowUnicode (hWnd=0x20208) returned 1 [0110.261] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.261] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0110.261] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0110.261] BeginPaint (in: hWnd=0x20208, lpPaint=0x43d9d8 | out: lpPaint=0x43d9d8) returned 0x4010a51 [0110.261] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.261] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0x20208, Msg=0x14, wParam=0x4010a51, lParam=0x0) returned 0x1 [0110.261] GetStockObject (i=5) returned 0x1900015 [0110.261] SelectPalette (hdc=0x4010a51, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0110.261] CreateCompatibleDC (hdc=0x4010a51) returned 0x11010a4e [0110.261] SelectObject (hdc=0x11010a4e, h=0x2905055a) returned 0x185000f [0110.262] GdipCreateFromHDC (hdc=0x11010a4e, graphics=0x43d7e0) returned 0x0 [0110.262] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0110.262] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=38, combineMode=0x0) returned 0x0 [0110.262] GdipCreateMatrix (matrix=0x43d910) returned 0x0 [0110.262] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471170) returned 0x0 [0110.262] GdipIsMatrixIdentity (matrix=0x1c471170, result=0x43d970) returned 0x0 [0110.262] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c690 [0110.262] GdipGetMatrixElements (matrix=0x1c471170, matrixOut=0x1f32c690) returned 0x0 [0110.262] LocalFree (hMem=0x1f32c690) returned 0x0 [0110.262] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.262] GdipDeleteMatrix (matrix=0x1c471170) returned 0x0 [0110.262] GdipCreateRegion (region=0x43d910) returned 0x0 [0110.262] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0110.262] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d940) returned 0x0 [0110.262] GdipSaveGraphics (graphics=0x1c46d570, state=0x43da10) returned 0x0 [0110.262] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd630dbd) returned 0x0 [0110.262] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.262] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0110.268] GdipGetDC (graphics=0x1c46d570, hdc=0x43ce00) returned 0x0 [0110.268] GetCurrentObject (hdc=0x11010a4e, type=0x1) returned 0x1b00017 [0110.269] GetCurrentObject (hdc=0x11010a4e, type=0x2) returned 0x1900010 [0110.269] GetCurrentObject (hdc=0x11010a4e, type=0x7) returned 0x2905055a [0110.269] GetCurrentObject (hdc=0x11010a4e, type=0x6) returned 0x18a0048 [0110.269] SaveDC (hdc=0x11010a4e) returned 1 [0110.269] GetNearestColor (hdc=0x11010a4e, color=0xf0f0f0) returned 0xf0f0f0 [0110.269] GetNearestColor (hdc=0x11010a4e, color=0xa0a0a0) returned 0xa0a0a0 [0110.269] GetNearestColor (hdc=0x11010a4e, color=0x696969) returned 0x696969 [0110.269] GetNearestColor (hdc=0x11010a4e, color=0xa0a0a0) returned 0xa0a0a0 [0110.269] GetNearestColor (hdc=0x11010a4e, color=0x0) returned 0x0 [0110.269] GetNearestColor (hdc=0x11010a4e, color=0xffffff) returned 0xffffff [0110.269] GetNearestColor (hdc=0x11010a4e, color=0xe5e5e5) returned 0xe5e5e5 [0110.269] GetNearestColor (hdc=0x11010a4e, color=0xd8d8d8) returned 0xd8d8d8 [0110.269] GetNearestColor (hdc=0x11010a4e, color=0x0) returned 0x0 [0110.269] RestoreDC (hdc=0x11010a4e, nSavedDC=-1) returned 1 [0110.269] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.270] GdipReleaseDC (graphics=0x1c46d570, hdc=0x11010a4e) returned 0x0 [0110.270] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0110.270] CoTaskMemAlloc (cb=0x13) returned 0x1f2f30c0 [0110.270] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0110.270] CoTaskMemFree (pv=0x1f2f30c0) [0110.271] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d4f0) returned 0x0 [0110.271] GdipSetStringFormatAlign (format=0x1c476150, align=0x1) returned 0x0 [0110.271] GdipSetStringFormatLineAlign (format=0x1c476150, align=0x1) returned 0x0 [0110.271] GdipSetStringFormatHotkeyPrefix (format=0x1c476150, hotkeyPrefix=1) returned 0x0 [0110.271] GdipGetStringFormatFlags (format=0x1c476150, flags=0x43d520) returned 0x0 [0110.271] GdipGetStringFormatTrimming (format=0x1c476150, trimming=0x43d520) returned 0x0 [0110.271] GdipGetStringFormatHotkeyPrefix (format=0x1c476150, hotkeyPrefix=0x43d520) returned 0x0 [0110.271] GdipGetFontSize (font=0x1c476150, size=0x43d520) returned 0x0 [0110.271] GdipGetFontStyle (font=0x1c476150, style=0x43d520) returned 0x0 [0110.271] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.271] GdipDeleteStringFormat (format=0x1c476150) returned 0x0 [0110.271] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0110.271] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3200 [0110.272] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0110.272] CoTaskMemFree (pv=0x1f2f3200) [0110.272] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43d1b0) returned 0x0 [0110.272] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d1c0) returned 0x0 [0110.272] GdipSetStringFormatFlags (format=0x1c4762a0, flags=0) returned 0x0 [0110.272] GdipSetStringFormatTrimming (format=0x1c4762a0, trimming=0x1) returned 0x0 [0110.272] GdipSetStringFormatHotkeyPrefix (format=0x1c4762a0, hotkeyPrefix=1) returned 0x0 [0110.272] GdipSetStringFormatAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0110.272] GdipSetStringFormatLineAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0110.272] GdipMeasureString (graphics=0x1c4688d0, string="Decryption", length=10, font=0x1c4677d0, layoutRect=0x43d0d8, stringFormat=0x1c4762a0, boundingBox=0x43d0c8, codepointsFitted=0x43d0c4, linesFilled=0x43d0c0) returned 0x0 [0110.272] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.272] GdipDeleteStringFormat (format=0x1c4762a0) returned 0x0 [0110.272] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.272] GdipDeleteGraphics (graphics=0x1c4688d0) returned 0x0 [0110.273] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0110.273] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2e00 [0110.273] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0110.273] CoTaskMemFree (pv=0x1f2f2e00) [0110.273] GdipCreateRegion (region=0x43d120) returned 0x0 [0110.273] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0110.273] GdipCreateMatrix (matrix=0x43d120) returned 0x0 [0110.273] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471270) returned 0x0 [0110.274] GdipIsMatrixIdentity (matrix=0x1c471270, result=0x43d180) returned 0x0 [0110.274] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c4d0 [0110.274] GdipGetMatrixElements (matrix=0x1c471270, matrixOut=0x1f32c4d0) returned 0x0 [0110.274] LocalFree (hMem=0x1f32c4d0) returned 0x0 [0110.274] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c3d0 [0110.274] GdipGetMatrixElements (matrix=0x1c471270, matrixOut=0x1f32c3d0) returned 0x0 [0110.274] LocalFree (hMem=0x1f32c3d0) returned 0x0 [0110.274] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.274] GdipDeleteMatrix (matrix=0x1c471270) returned 0x0 [0110.274] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d1d0) returned 0x0 [0110.274] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d190) returned 0x0 [0110.274] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43d190) returned 0x0 [0110.274] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.274] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0110.274] GdipGetDC (graphics=0x1c46d570, hdc=0x43d200) returned 0x0 [0110.274] GetCurrentObject (hdc=0x11010a4e, type=0x1) returned 0x1b00017 [0110.274] GetCurrentObject (hdc=0x11010a4e, type=0x2) returned 0x1900010 [0110.274] GetCurrentObject (hdc=0x11010a4e, type=0x7) returned 0x2905055a [0110.274] GetCurrentObject (hdc=0x11010a4e, type=0x6) returned 0x18a0048 [0110.274] SaveDC (hdc=0x11010a4e) returned 1 [0110.275] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6f0406cc [0110.275] GetClipRgn (hdc=0x11010a4e, hrgn=0x6f0406cc) returned 0 [0110.275] SelectClipRgn (hdc=0x11010a4e, hrgn=0x690405d8) returned 2 [0110.275] DeleteObject (ho=0x6f0406cc) returned 1 [0110.275] DeleteObject (ho=0x690405d8) returned 1 [0110.275] OffsetViewportOrgEx (in: hdc=0x11010a4e, x=0, y=0, lppt=0x25c6e00 | out: lppt=0x25c6e00) returned 1 [0110.275] GetNearestColor (hdc=0x11010a4e, color=0xf0f0f0) returned 0xf0f0f0 [0110.275] CreateSolidBrush (color=0xf0f0f0) returned 0x2710075d [0110.275] FillRect (hDC=0x11010a4e, lprc=0x43d1d0, hbr=0x2710075d) returned 1 [0110.275] DeleteObject (ho=0x2710075d) returned 1 [0110.275] RestoreDC (hdc=0x11010a4e, nSavedDC=-1) returned 1 [0110.275] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.275] GdipReleaseDC (graphics=0x1c46d570, hdc=0x11010a4e) returned 0x0 [0110.276] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0110.276] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2dc0 [0110.276] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0110.276] CoTaskMemFree (pv=0x1f2f2dc0) [0110.276] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d250) returned 0x0 [0110.276] GdipSetStringFormatAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0110.276] GdipSetStringFormatLineAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0110.276] GdipSetStringFormatHotkeyPrefix (format=0x1c4762a0, hotkeyPrefix=1) returned 0x0 [0110.277] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x43d2c0) returned 0x0 [0110.277] GdipDrawString (graphics=0x1c46d570, string="Decryption", length=10, font=0x1c4677d0, layoutRect=0x43d1d0, stringFormat=0x1c4762a0, brush=0x1c46cce0) returned 0x0 [0110.277] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.277] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0110.277] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.277] GdipDeleteStringFormat (format=0x1c4762a0) returned 0x0 [0110.277] GetFocus () returned 0x0 [0110.277] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0110.278] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3360 [0110.278] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0110.278] CoTaskMemFree (pv=0x1f2f3360) [0110.278] GdipCreateRegion (region=0x43d080) returned 0x0 [0110.278] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0110.278] GdipCreateMatrix (matrix=0x43d080) returned 0x0 [0110.278] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4712f0) returned 0x0 [0110.278] GdipIsMatrixIdentity (matrix=0x1c4712f0, result=0x43d0e0) returned 0x0 [0110.278] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c450 [0110.278] GdipGetMatrixElements (matrix=0x1c4712f0, matrixOut=0x1f32c450) returned 0x0 [0110.278] LocalFree (hMem=0x1f32c450) returned 0x0 [0110.284] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c590 [0110.285] GdipGetMatrixElements (matrix=0x1c4712f0, matrixOut=0x1f32c590) returned 0x0 [0110.285] LocalFree (hMem=0x1f32c590) returned 0x0 [0110.285] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.285] GdipDeleteMatrix (matrix=0x1c4712f0) returned 0x0 [0110.285] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d130) returned 0x0 [0110.285] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d0f0) returned 0x0 [0110.285] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43d0f0) returned 0x0 [0110.285] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.285] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0110.285] GdipGetDC (graphics=0x1c46d570, hdc=0x43d160) returned 0x0 [0110.285] GetCurrentObject (hdc=0x11010a4e, type=0x1) returned 0x1b00017 [0110.285] GetCurrentObject (hdc=0x11010a4e, type=0x2) returned 0x1900010 [0110.285] GetCurrentObject (hdc=0x11010a4e, type=0x7) returned 0x2905055a [0110.285] GetCurrentObject (hdc=0x11010a4e, type=0x6) returned 0x18a0048 [0110.285] SaveDC (hdc=0x11010a4e) returned 1 [0110.285] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6a0405d8 [0110.285] GetClipRgn (hdc=0x11010a4e, hrgn=0x6a0405d8) returned 0 [0110.286] SelectClipRgn (hdc=0x11010a4e, hrgn=0x700406cc) returned 2 [0110.286] DeleteObject (ho=0x6a0405d8) returned 1 [0110.286] DeleteObject (ho=0x700406cc) returned 1 [0110.286] OffsetViewportOrgEx (in: hdc=0x11010a4e, x=0, y=0, lppt=0x25c7360 | out: lppt=0x25c7360) returned 1 [0110.286] GetROP2 (hdc=0x11010a4e) returned 13 [0110.286] GetBkMode (hdc=0x11010a4e) returned 2 [0110.286] SetBkMode (hdc=0x11010a4e, mode=1) returned 2 [0110.286] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x2b300996 [0110.286] SelectObject (hdc=0x11010a4e, h=0x2b300996) returned 0x1b00017 [0110.286] MoveToEx (in: hdc=0x11010a4e, x=124, y=0, lppt=0x25c73c8 | out: lppt=0x25c73c8) returned 1 [0110.286] LineTo (hdc=0x11010a4e, x=0, y=0) returned 1 [0110.286] SetBkMode (hdc=0x11010a4e, mode=2) returned 1 [0110.286] MoveToEx (in: hdc=0x11010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.286] GetROP2 (hdc=0x11010a4e) returned 13 [0110.286] GetBkMode (hdc=0x11010a4e) returned 2 [0110.286] SetBkMode (hdc=0x11010a4e, mode=1) returned 2 [0110.286] SelectObject (hdc=0x11010a4e, h=0x2b300996) returned 0x2b300996 [0110.286] MoveToEx (in: hdc=0x11010a4e, x=0, y=0, lppt=0x25c73e0 | out: lppt=0x25c73e0) returned 1 [0110.287] LineTo (hdc=0x11010a4e, x=0, y=37) returned 1 [0110.287] SetBkMode (hdc=0x11010a4e, mode=2) returned 1 [0110.287] MoveToEx (in: hdc=0x11010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.287] SelectObject (hdc=0x11010a4e, h=0x1b00017) returned 0x2b300996 [0110.287] DeleteObject (ho=0x2b300996) returned 1 [0110.287] GetROP2 (hdc=0x11010a4e) returned 13 [0110.287] GetBkMode (hdc=0x11010a4e) returned 2 [0110.287] SetBkMode (hdc=0x11010a4e, mode=1) returned 2 [0110.287] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xc3009df [0110.287] SelectObject (hdc=0x11010a4e, h=0xc3009df) returned 0x1b00017 [0110.287] MoveToEx (in: hdc=0x11010a4e, x=0, y=37, lppt=0x25c7448 | out: lppt=0x25c7448) returned 1 [0110.287] LineTo (hdc=0x11010a4e, x=124, y=37) returned 1 [0110.287] SetBkMode (hdc=0x11010a4e, mode=2) returned 1 [0110.287] MoveToEx (in: hdc=0x11010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.287] GetROP2 (hdc=0x11010a4e) returned 13 [0110.287] GetBkMode (hdc=0x11010a4e) returned 2 [0110.287] SetBkMode (hdc=0x11010a4e, mode=1) returned 2 [0110.287] SelectObject (hdc=0x11010a4e, h=0xc3009df) returned 0xc3009df [0110.287] MoveToEx (in: hdc=0x11010a4e, x=124, y=37, lppt=0x25c7460 | out: lppt=0x25c7460) returned 1 [0110.288] LineTo (hdc=0x11010a4e, x=124, y=-1) returned 1 [0110.288] SetBkMode (hdc=0x11010a4e, mode=2) returned 1 [0110.288] MoveToEx (in: hdc=0x11010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.288] SelectObject (hdc=0x11010a4e, h=0x1b00017) returned 0xc3009df [0110.288] DeleteObject (ho=0xc3009df) returned 1 [0110.288] GetROP2 (hdc=0x11010a4e) returned 13 [0110.288] GetBkMode (hdc=0x11010a4e) returned 2 [0110.288] SetBkMode (hdc=0x11010a4e, mode=1) returned 2 [0110.288] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x2c300996 [0110.288] SelectObject (hdc=0x11010a4e, h=0x2c300996) returned 0x1b00017 [0110.288] MoveToEx (in: hdc=0x11010a4e, x=123, y=1, lppt=0x25c74c8 | out: lppt=0x25c74c8) returned 1 [0110.288] LineTo (hdc=0x11010a4e, x=1, y=1) returned 1 [0110.288] SetBkMode (hdc=0x11010a4e, mode=2) returned 1 [0110.288] MoveToEx (in: hdc=0x11010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.288] GetROP2 (hdc=0x11010a4e) returned 13 [0110.288] GetBkMode (hdc=0x11010a4e) returned 2 [0110.288] SetBkMode (hdc=0x11010a4e, mode=1) returned 2 [0110.288] SelectObject (hdc=0x11010a4e, h=0x2c300996) returned 0x2c300996 [0110.288] MoveToEx (in: hdc=0x11010a4e, x=1, y=1, lppt=0x25c74e0 | out: lppt=0x25c74e0) returned 1 [0110.288] LineTo (hdc=0x11010a4e, x=1, y=36) returned 1 [0110.289] SetBkMode (hdc=0x11010a4e, mode=2) returned 1 [0110.289] MoveToEx (in: hdc=0x11010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.289] SelectObject (hdc=0x11010a4e, h=0x1b00017) returned 0x2c300996 [0110.289] DeleteObject (ho=0x2c300996) returned 1 [0110.289] GetROP2 (hdc=0x11010a4e) returned 13 [0110.289] GetBkMode (hdc=0x11010a4e) returned 2 [0110.289] SetBkMode (hdc=0x11010a4e, mode=1) returned 2 [0110.289] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xd3009df [0110.289] SelectObject (hdc=0x11010a4e, h=0xd3009df) returned 0x1b00017 [0110.289] MoveToEx (in: hdc=0x11010a4e, x=1, y=36, lppt=0x25c7548 | out: lppt=0x25c7548) returned 1 [0110.289] LineTo (hdc=0x11010a4e, x=123, y=36) returned 1 [0110.289] SetBkMode (hdc=0x11010a4e, mode=2) returned 1 [0110.289] MoveToEx (in: hdc=0x11010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.289] GetROP2 (hdc=0x11010a4e) returned 13 [0110.289] GetBkMode (hdc=0x11010a4e) returned 2 [0110.289] SetBkMode (hdc=0x11010a4e, mode=1) returned 2 [0110.289] SelectObject (hdc=0x11010a4e, h=0xd3009df) returned 0xd3009df [0110.289] MoveToEx (in: hdc=0x11010a4e, x=123, y=36, lppt=0x25c7560 | out: lppt=0x25c7560) returned 1 [0110.289] LineTo (hdc=0x11010a4e, x=123, y=0) returned 1 [0110.289] SetBkMode (hdc=0x11010a4e, mode=2) returned 1 [0110.290] MoveToEx (in: hdc=0x11010a4e, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0110.290] SelectObject (hdc=0x11010a4e, h=0x1b00017) returned 0xd3009df [0110.290] DeleteObject (ho=0xd3009df) returned 1 [0110.290] RestoreDC (hdc=0x11010a4e, nSavedDC=-1) returned 1 [0110.290] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.290] GdipReleaseDC (graphics=0x1c46d570, hdc=0x11010a4e) returned 0x0 [0110.290] GdipGetDC (graphics=0x1c46d570, hdc=0x43d8e0) returned 0x0 [0110.290] BitBlt (hdc=0x4010a51, x=0, y=0, cx=125, cy=38, hdcSrc=0x11010a4e, x1=0, y1=0, rop=0xcc0020) returned 1 [0110.292] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.292] GdipReleaseDC (graphics=0x1c46d570, hdc=0x11010a4e) returned 0x0 [0110.292] SelectPalette (hdc=0x4010a51, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0110.292] SelectObject (hdc=0x11010a4e, h=0x185000f) returned 0x2905055a [0110.292] DeleteDC (hdc=0x11010a4e) returned 1 [0110.292] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.292] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0110.292] EndPaint (hWnd=0x20208, lpPaint=0x43d9e8) returned 1 [0110.292] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.292] IsWindowUnicode (hWnd=0x2022e) returned 1 [0110.292] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.292] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0110.292] DispatchMessageW (lpMsg=0x43e5e0) returned 0x1 [0110.293] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x1 [0110.293] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.294] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413320, hWnd=0x2022e, Msg=0x14, wParam=0xa0108e8, lParam=0x0) returned 0x1 [0110.298] SetTextColor (hdc=0xa0108e8, color=0x0) returned 0x0 [0110.298] SetBkColor (hdc=0xa0108e8, color=0xffffff) returned 0xffffff [0110.298] SetTextColor (hdc=0xa0108e8, color=0x0) returned 0x0 [0110.299] SetBkColor (hdc=0xa0108e8, color=0xffffff) returned 0xffffff [0110.299] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.299] IsWindowUnicode (hWnd=0x20230) returned 1 [0110.299] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.299] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0110.299] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0110.299] BeginPaint (in: hWnd=0x20230, lpPaint=0x43d9d8 | out: lpPaint=0x43d9d8) returned 0xa0108e8 [0110.299] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.299] SelectPalette (hdc=0xa0108e8, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0110.300] CreateCompatibleDC (hdc=0xa0108e8) returned 0x16010a4e [0110.300] SelectObject (hdc=0x16010a4e, h=0x2905055a) returned 0x185000f [0110.300] GdipCreateFromHDC (hdc=0x16010a4e, graphics=0x43d7e0) returned 0x0 [0110.300] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0110.300] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=60, height=25, combineMode=0x0) returned 0x0 [0110.300] GdipCreateMatrix (matrix=0x43d910) returned 0x0 [0110.300] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471630) returned 0x0 [0110.300] GdipIsMatrixIdentity (matrix=0x1c471630, result=0x43d970) returned 0x0 [0110.300] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c250 [0110.300] GdipGetMatrixElements (matrix=0x1c471630, matrixOut=0x1f32c250) returned 0x0 [0110.300] LocalFree (hMem=0x1f32c250) returned 0x0 [0110.300] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.300] GdipDeleteMatrix (matrix=0x1c471630) returned 0x0 [0110.300] GdipCreateRegion (region=0x43d910) returned 0x0 [0110.300] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0110.301] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d940) returned 0x0 [0110.301] GdipSaveGraphics (graphics=0x1c46d570, state=0x43da10) returned 0x0 [0110.301] GetWindowTextLengthW (hWnd=0x20230) returned 6 [0110.301] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0110.301] GetSystemMetrics (nIndex=42) returned 0 [0110.301] CoTaskMemAlloc (cb=0x12) returned 0x1f2f30c0 [0110.301] GetWindowTextW (in: hWnd=0x20230, lpString=0x1f2f30c0, nMaxCount=7 | out: lpString="PIN = ") returned 6 [0110.301] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0xd, wParam=0x7, lParam=0x1f2f30c0) returned 0x6 [0110.301] CoTaskMemFree (pv=0x1f2f30c0) [0110.301] GetClientRect (in: hWnd=0x20230, lpRect=0x43d980 | out: lpRect=0x43d980) returned 1 [0110.301] GdipCreateRegion (region=0x43d400) returned 0x0 [0110.301] GdipGetClip (graphics=0x1c46d570, region=0x1c468be0) returned 0x0 [0110.301] GdipCreateMatrix (matrix=0x43d400) returned 0x0 [0110.301] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471330) returned 0x0 [0110.301] GdipIsMatrixIdentity (matrix=0x1c471330, result=0x43d460) returned 0x0 [0110.301] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32be90 [0110.301] GdipGetMatrixElements (matrix=0x1c471330, matrixOut=0x1f32be90) returned 0x0 [0110.301] LocalFree (hMem=0x1f32be90) returned 0x0 [0110.301] GdipCombineRegionRegion (region=0x1c468be0, region2=0x1c46a710, combineMode=0x1) returned 0x0 [0110.301] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c4d0 [0110.301] GdipGetMatrixElements (matrix=0x1c471330, matrixOut=0x1f32c4d0) returned 0x0 [0110.301] LocalFree (hMem=0x1f32c4d0) returned 0x0 [0110.301] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.302] GdipDeleteMatrix (matrix=0x1c471330) returned 0x0 [0110.302] GdipIsInfiniteRegion (region=0x1c468be0, graphics=0x1c46d570, result=0x43d4b0) returned 0x0 [0110.302] GdipIsInfiniteRegion (region=0x1c468be0, graphics=0x1c46d570, result=0x43d470) returned 0x0 [0110.302] GdipGetRegionHRgn (region=0x1c468be0, graphics=0x1c46d570, hRgn=0x43d470) returned 0x0 [0110.302] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.302] GdipDeleteRegion (region=0x1c468be0) returned 0x0 [0110.302] GdipGetDC (graphics=0x1c46d570, hdc=0x43d4e0) returned 0x0 [0110.302] GetCurrentObject (hdc=0x16010a4e, type=0x1) returned 0x1b00017 [0110.302] GetCurrentObject (hdc=0x16010a4e, type=0x2) returned 0x1900010 [0110.302] GetCurrentObject (hdc=0x16010a4e, type=0x7) returned 0x2905055a [0110.302] GetCurrentObject (hdc=0x16010a4e, type=0x6) returned 0x18a0048 [0110.302] SaveDC (hdc=0x16010a4e) returned 1 [0110.302] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x710406cc [0110.302] GetClipRgn (hdc=0x16010a4e, hrgn=0x710406cc) returned 0 [0110.302] SelectClipRgn (hdc=0x16010a4e, hrgn=0x6b0405d8) returned 2 [0110.302] DeleteObject (ho=0x710406cc) returned 1 [0110.302] DeleteObject (ho=0x6b0405d8) returned 1 [0110.303] OffsetViewportOrgEx (in: hdc=0x16010a4e, x=0, y=0, lppt=0x25c7b38 | out: lppt=0x25c7b38) returned 1 [0110.303] GetNearestColor (hdc=0x16010a4e, color=0x0) returned 0x0 [0110.303] CreateSolidBrush (color=0x0) returned 0x2810075d [0110.303] FillRect (hDC=0x16010a4e, lprc=0x43d4b0, hbr=0x2810075d) returned 1 [0110.303] DeleteObject (ho=0x2810075d) returned 1 [0110.303] RestoreDC (hdc=0x16010a4e, nSavedDC=-1) returned 1 [0110.303] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.303] GdipReleaseDC (graphics=0x1c46d570, hdc=0x16010a4e) returned 0x0 [0110.303] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd600dbd) returned 0x0 [0110.303] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.303] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0110.303] GetWindowTextLengthW (hWnd=0x20230) returned 6 [0110.303] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0110.303] GetSystemMetrics (nIndex=42) returned 0 [0110.303] CoTaskMemAlloc (cb=0x12) returned 0x1f2f30c0 [0110.303] GetWindowTextW (in: hWnd=0x20230, lpString=0x1f2f30c0, nMaxCount=7 | out: lpString="PIN = ") returned 6 [0110.303] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20230, Msg=0xd, wParam=0x7, lParam=0x1f2f30c0) returned 0x6 [0110.303] CoTaskMemFree (pv=0x1f2f30c0) [0110.303] GdipGetDC (graphics=0x1c46d570, hdc=0x43d540) returned 0x0 [0110.303] GetCurrentObject (hdc=0x16010a4e, type=0x1) returned 0x1b00017 [0110.303] GetCurrentObject (hdc=0x16010a4e, type=0x2) returned 0x1900010 [0110.304] GetCurrentObject (hdc=0x16010a4e, type=0x7) returned 0x2905055a [0110.304] GetCurrentObject (hdc=0x16010a4e, type=0x6) returned 0x18a0048 [0110.304] SaveDC (hdc=0x16010a4e) returned 1 [0110.304] GetNearestColor (hdc=0x16010a4e, color=0x80) returned 0x80 [0110.304] RestoreDC (hdc=0x16010a4e, nSavedDC=-1) returned 1 [0110.304] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.304] GdipReleaseDC (graphics=0x1c46d570, hdc=0x16010a4e) returned 0x0 [0110.304] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d4d0) returned 0x0 [0110.304] GdipSetStringFormatAlign (format=0x1c476000, align=0x0) returned 0x0 [0110.304] GdipSetStringFormatLineAlign (format=0x1c476000, align=0x0) returned 0x0 [0110.304] GdipSetStringFormatHotkeyPrefix (format=0x1c476000, hotkeyPrefix=1) returned 0x0 [0110.304] GdipGetStringFormatFlags (format=0x1c476000, flags=0x43d4f0) returned 0x0 [0110.304] GdipSetStringFormatFlags (format=0x1c476000, flags=2048) returned 0x0 [0110.304] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x43d540) returned 0x0 [0110.304] GdipDrawString (graphics=0x1c46d570, string="PIN = ", length=6, font=0x1c4618f0, layoutRect=0x43d450, stringFormat=0x1c476000, brush=0x1c46cce0) returned 0x0 [0110.304] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.305] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0110.305] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.305] GdipDeleteStringFormat (format=0x1c476000) returned 0x0 [0110.305] GdipGetDC (graphics=0x1c46d570, hdc=0x43d8e0) returned 0x0 [0110.305] BitBlt (hdc=0xa0108e8, x=0, y=0, cx=60, cy=25, hdcSrc=0x16010a4e, x1=0, y1=0, rop=0xcc0020) returned 1 [0110.305] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.305] GdipReleaseDC (graphics=0x1c46d570, hdc=0x16010a4e) returned 0x0 [0110.305] SelectPalette (hdc=0xa0108e8, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0110.305] SelectObject (hdc=0x16010a4e, h=0x185000f) returned 0x2905055a [0110.305] DeleteDC (hdc=0x16010a4e) returned 1 [0110.305] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.305] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0110.305] EndPaint (hWnd=0x20230, lpPaint=0x43d9e8) returned 1 [0110.305] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.306] IsWindowUnicode (hWnd=0x20222) returned 1 [0110.306] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.306] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0110.306] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0110.306] BeginPaint (in: hWnd=0x20222, lpPaint=0x43d9d8 | out: lpPaint=0x43d9d8) returned 0xa0108e8 [0110.306] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.306] SelectPalette (hdc=0xa0108e8, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0110.306] CreateCompatibleDC (hdc=0xa0108e8) returned 0x19010a4e [0110.306] GetObjectType (h=0xa0108e8) returned 0x3 [0110.306] CreateCompatibleBitmap (hdc=0xa0108e8, cx=1, cy=1) returned 0x80509e0 [0110.306] GetDIBits (in: hdc=0xa0108e8, hbm=0x80509e0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x43d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43d068) returned 1 [0110.307] GetDIBits (in: hdc=0xa0108e8, hbm=0x80509e0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x43d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43d068) returned 1 [0110.307] DeleteObject (ho=0x80509e0) returned 1 [0110.307] CreateDIBSection (in: hdc=0xa0108e8, lpbmi=0x43d240, usage=0x0, ppvBits=0x43d238, hSection=0x0, offset=0x0 | out: ppvBits=0x43d238) returned 0xe0509df [0110.307] SelectObject (hdc=0x19010a4e, h=0xe0509df) returned 0x185000f [0110.307] GdipCreateFromHDC (hdc=0x19010a4e, graphics=0x43d750) returned 0x0 [0110.307] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0110.307] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=348, height=63, combineMode=0x0) returned 0x0 [0110.307] GdipCreateMatrix (matrix=0x43d910) returned 0x0 [0110.307] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4713b0) returned 0x0 [0110.307] GdipIsMatrixIdentity (matrix=0x1c4713b0, result=0x43d970) returned 0x0 [0110.307] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c890 [0110.308] GdipGetMatrixElements (matrix=0x1c4713b0, matrixOut=0x1f32c890) returned 0x0 [0110.308] LocalFree (hMem=0x1f32c890) returned 0x0 [0110.308] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.308] GdipDeleteMatrix (matrix=0x1c4713b0) returned 0x0 [0110.308] GdipCreateRegion (region=0x43d910) returned 0x0 [0110.308] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0110.308] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d940) returned 0x0 [0110.308] GdipSaveGraphics (graphics=0x1c46d570, state=0x43da10) returned 0x0 [0110.308] GetWindowTextLengthW (hWnd=0x20222) returned 94 [0110.308] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5e [0110.308] GetSystemMetrics (nIndex=42) returned 0 [0110.308] CoTaskMemAlloc (cb=0xc2) returned 0x1f2f14c0 [0110.308] GetWindowTextW (in: hWnd=0x20222, lpString=0x1f2f14c0, nMaxCount=95 | out: lpString="Oooooops All your files on the desktop\r\nare encrypted To decrypt files enter PIN\r\nsee you soon") returned 94 [0110.308] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0xd, wParam=0x5f, lParam=0x1f2f14c0) returned 0x5e [0110.308] CoTaskMemFree (pv=0x1f2f14c0) [0110.308] GetClientRect (in: hWnd=0x20222, lpRect=0x43d980 | out: lpRect=0x43d980) returned 1 [0110.308] GdipCreateRegion (region=0x43d400) returned 0x0 [0110.308] GdipGetClip (graphics=0x1c46d570, region=0x1c468be0) returned 0x0 [0110.308] GdipCreateMatrix (matrix=0x43d400) returned 0x0 [0110.308] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4713f0) returned 0x0 [0110.309] GdipIsMatrixIdentity (matrix=0x1c4713f0, result=0x43d460) returned 0x0 [0110.309] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32bf50 [0110.309] GdipGetMatrixElements (matrix=0x1c4713f0, matrixOut=0x1f32bf50) returned 0x0 [0110.309] LocalFree (hMem=0x1f32bf50) returned 0x0 [0110.309] GdipCombineRegionRegion (region=0x1c468be0, region2=0x1c46a710, combineMode=0x1) returned 0x0 [0110.309] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32be50 [0110.309] GdipGetMatrixElements (matrix=0x1c4713f0, matrixOut=0x1f32be50) returned 0x0 [0110.309] LocalFree (hMem=0x1f32be50) returned 0x0 [0110.309] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.309] GdipDeleteMatrix (matrix=0x1c4713f0) returned 0x0 [0110.309] GdipIsInfiniteRegion (region=0x1c468be0, graphics=0x1c46d570, result=0x43d4b0) returned 0x0 [0110.309] GdipIsInfiniteRegion (region=0x1c468be0, graphics=0x1c46d570, result=0x43d470) returned 0x0 [0110.309] GdipGetRegionHRgn (region=0x1c468be0, graphics=0x1c46d570, hRgn=0x43d470) returned 0x0 [0110.309] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.309] GdipDeleteRegion (region=0x1c468be0) returned 0x0 [0110.309] GdipGetDC (graphics=0x1c46d570, hdc=0x43d4e0) returned 0x0 [0110.309] GetCurrentObject (hdc=0x19010a4e, type=0x1) returned 0x1b00017 [0110.309] GetCurrentObject (hdc=0x19010a4e, type=0x2) returned 0x1900010 [0110.309] GetCurrentObject (hdc=0x19010a4e, type=0x7) returned 0xe0509df [0110.309] GetCurrentObject (hdc=0x19010a4e, type=0x6) returned 0x18a0048 [0110.309] SaveDC (hdc=0x19010a4e) returned 1 [0110.309] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6c0405d8 [0110.310] GetClipRgn (hdc=0x19010a4e, hrgn=0x6c0405d8) returned 0 [0110.703] SelectClipRgn (hdc=0x19010a4e, hrgn=0x720406cc) returned 2 [0110.703] DeleteObject (ho=0x6c0405d8) returned 1 [0110.703] DeleteObject (ho=0x720406cc) returned 1 [0110.704] OffsetViewportOrgEx (in: hdc=0x19010a4e, x=0, y=0, lppt=0x25c9630 | out: lppt=0x25c9630) returned 1 [0110.704] GetNearestColor (hdc=0x19010a4e, color=0x0) returned 0x0 [0110.704] CreateSolidBrush (color=0x0) returned 0x2910075d [0110.704] FillRect (hDC=0x19010a4e, lprc=0x43d4b0, hbr=0x2910075d) returned 1 [0110.705] DeleteObject (ho=0x2910075d) returned 1 [0110.705] RestoreDC (hdc=0x19010a4e, nSavedDC=-1) returned 1 [0110.705] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.705] GdipReleaseDC (graphics=0x1c46d570, hdc=0x19010a4e) returned 0x0 [0110.705] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd5e0dbd) returned 0x0 [0110.705] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.705] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0110.705] GetWindowTextLengthW (hWnd=0x20222) returned 94 [0110.705] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5e [0110.705] GetSystemMetrics (nIndex=42) returned 0 [0110.705] CoTaskMemAlloc (cb=0xc2) returned 0x1f2f0f10 [0110.706] GetWindowTextW (in: hWnd=0x20222, lpString=0x1f2f0f10, nMaxCount=95 | out: lpString="Oooooops All your files on the desktop\r\nare encrypted To decrypt files enter PIN\r\nsee you soon") returned 94 [0110.706] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20222, Msg=0xd, wParam=0x5f, lParam=0x1f2f0f10) returned 0x5e [0110.706] CoTaskMemFree (pv=0x1f2f0f10) [0110.706] GdipGetDC (graphics=0x1c46d570, hdc=0x43d540) returned 0x0 [0110.706] GetCurrentObject (hdc=0x19010a4e, type=0x1) returned 0x1b00017 [0110.706] GetCurrentObject (hdc=0x19010a4e, type=0x2) returned 0x1900010 [0110.706] GetCurrentObject (hdc=0x19010a4e, type=0x7) returned 0xe0509df [0110.706] GetCurrentObject (hdc=0x19010a4e, type=0x6) returned 0x18a0048 [0110.706] SaveDC (hdc=0x19010a4e) returned 1 [0110.706] GetNearestColor (hdc=0x19010a4e, color=0x80) returned 0x80 [0110.706] RestoreDC (hdc=0x19010a4e, nSavedDC=-1) returned 1 [0110.706] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.706] GdipReleaseDC (graphics=0x1c46d570, hdc=0x19010a4e) returned 0x0 [0110.706] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d4d0) returned 0x0 [0110.706] GdipSetStringFormatAlign (format=0x1c476690, align=0x0) returned 0x0 [0110.706] GdipSetStringFormatLineAlign (format=0x1c476690, align=0x0) returned 0x0 [0110.706] GdipSetStringFormatHotkeyPrefix (format=0x1c476690, hotkeyPrefix=1) returned 0x0 [0110.706] GdipGetStringFormatFlags (format=0x1c476690, flags=0x43d4f0) returned 0x0 [0110.706] GdipSetStringFormatFlags (format=0x1c476690, flags=2048) returned 0x0 [0110.706] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x43d540) returned 0x0 [0110.707] GdipDrawString (graphics=0x1c46d570, string="Oooooops All your files on the desktop\r\nare encrypted To decrypt files enter PIN\r\nsee you soon", length=94, font=0x1c4618b0, layoutRect=0x43d450, stringFormat=0x1c476690, brush=0x1c46cce0) returned 0x0 [0110.707] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.707] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0110.707] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.707] GdipDeleteStringFormat (format=0x1c476690) returned 0x0 [0110.707] GdipGetDC (graphics=0x1c46d570, hdc=0x43d8e0) returned 0x0 [0110.707] BitBlt (hdc=0xa0108e8, x=0, y=0, cx=348, cy=63, hdcSrc=0x19010a4e, x1=0, y1=0, rop=0xcc0020) returned 1 [0110.709] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.709] GdipReleaseDC (graphics=0x1c46d570, hdc=0x19010a4e) returned 0x0 [0110.709] SelectPalette (hdc=0xa0108e8, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0110.709] SelectObject (hdc=0x19010a4e, h=0x185000f) returned 0xe0509df [0110.709] DeleteDC (hdc=0x19010a4e) returned 1 [0110.710] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.710] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0110.710] DeleteObject (ho=0xe0509df) returned 1 [0110.710] EndPaint (hWnd=0x20222, lpPaint=0x43d9e8) returned 1 [0110.710] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.710] IsWindowUnicode (hWnd=0x20224) returned 1 [0110.710] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.711] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0110.711] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0110.711] BeginPaint (in: hWnd=0x20224, lpPaint=0x43d9d8 | out: lpPaint=0x43d9d8) returned 0xa0108e8 [0110.711] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.711] SelectPalette (hdc=0xa0108e8, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0110.711] CreateCompatibleDC (hdc=0xa0108e8) returned 0xc0109e0 [0110.711] GetObjectType (h=0xa0108e8) returned 0x3 [0110.711] CreateCompatibleBitmap (hdc=0xa0108e8, cx=1, cy=1) returned 0xf0509df [0110.711] GetDIBits (in: hdc=0xa0108e8, hbm=0xf0509df, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x43d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43d068) returned 1 [0110.711] GetDIBits (in: hdc=0xa0108e8, hbm=0xf0509df, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x43d068, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43d068) returned 1 [0110.711] DeleteObject (ho=0xf0509df) returned 1 [0110.712] CreateDIBSection (in: hdc=0xa0108e8, lpbmi=0x43d240, usage=0x0, ppvBits=0x43d238, hSection=0x0, offset=0x0 | out: ppvBits=0x43d238) returned 0x1a050a4e [0110.712] SelectObject (hdc=0xc0109e0, h=0x1a050a4e) returned 0x185000f [0110.712] GdipCreateFromHDC (hdc=0xc0109e0, graphics=0x43d750) returned 0x0 [0110.712] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0110.712] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=338, height=77, combineMode=0x0) returned 0x0 [0110.712] GdipCreateMatrix (matrix=0x43d910) returned 0x0 [0110.712] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4714f0) returned 0x0 [0110.712] GdipIsMatrixIdentity (matrix=0x1c4714f0, result=0x43d970) returned 0x0 [0110.712] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c0d0 [0110.712] GdipGetMatrixElements (matrix=0x1c4714f0, matrixOut=0x1f32c0d0) returned 0x0 [0110.712] LocalFree (hMem=0x1f32c0d0) returned 0x0 [0110.712] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.712] GdipDeleteMatrix (matrix=0x1c4714f0) returned 0x0 [0110.712] GdipCreateRegion (region=0x43d910) returned 0x0 [0110.712] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0110.712] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d940) returned 0x0 [0110.713] GdipSaveGraphics (graphics=0x1c46d570, state=0x43da10) returned 0x0 [0110.713] GetWindowTextLengthW (hWnd=0x20224) returned 39 [0110.713] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x27 [0110.713] GetSystemMetrics (nIndex=42) returned 0 [0110.713] CoTaskMemAlloc (cb=0x54) returned 0x1f30feb0 [0110.713] GetWindowTextW (in: hWnd=0x20224, lpString=0x1f30feb0, nMaxCount=40 | out: lpString=" Welcome in\r\nDesktop Ransomware") returned 39 [0110.713] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0xd, wParam=0x28, lParam=0x1f30feb0) returned 0x27 [0110.713] CoTaskMemFree (pv=0x1f30feb0) [0110.713] GetClientRect (in: hWnd=0x20224, lpRect=0x43d980 | out: lpRect=0x43d980) returned 1 [0110.713] GdipCreateRegion (region=0x43d400) returned 0x0 [0110.713] GdipGetClip (graphics=0x1c46d570, region=0x1c472bb0) returned 0x0 [0110.713] GdipCreateMatrix (matrix=0x43d400) returned 0x0 [0110.713] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471070) returned 0x0 [0110.713] GdipIsMatrixIdentity (matrix=0x1c471070, result=0x43d460) returned 0x0 [0110.713] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c090 [0110.713] GdipGetMatrixElements (matrix=0x1c471070, matrixOut=0x1f32c090) returned 0x0 [0110.713] LocalFree (hMem=0x1f32c090) returned 0x0 [0110.713] GdipCombineRegionRegion (region=0x1c472bb0, region2=0x1c46a710, combineMode=0x1) returned 0x0 [0110.713] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c650 [0110.713] GdipGetMatrixElements (matrix=0x1c471070, matrixOut=0x1f32c650) returned 0x0 [0110.713] LocalFree (hMem=0x1f32c650) returned 0x0 [0110.713] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.713] GdipDeleteMatrix (matrix=0x1c471070) returned 0x0 [0110.713] GdipIsInfiniteRegion (region=0x1c472bb0, graphics=0x1c46d570, result=0x43d4b0) returned 0x0 [0110.714] GdipIsInfiniteRegion (region=0x1c472bb0, graphics=0x1c46d570, result=0x43d470) returned 0x0 [0110.714] GdipGetRegionHRgn (region=0x1c472bb0, graphics=0x1c46d570, hRgn=0x43d470) returned 0x0 [0110.714] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.714] GdipDeleteRegion (region=0x1c472bb0) returned 0x0 [0110.714] GdipGetDC (graphics=0x1c46d570, hdc=0x43d4e0) returned 0x0 [0110.714] GetCurrentObject (hdc=0xc0109e0, type=0x1) returned 0x1b00017 [0110.714] GetCurrentObject (hdc=0xc0109e0, type=0x2) returned 0x1900010 [0110.714] GetCurrentObject (hdc=0xc0109e0, type=0x7) returned 0x1a050a4e [0110.714] GetCurrentObject (hdc=0xc0109e0, type=0x6) returned 0x18a0048 [0110.714] SaveDC (hdc=0xc0109e0) returned 1 [0110.714] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x730406cc [0110.714] GetClipRgn (hdc=0xc0109e0, hrgn=0x730406cc) returned 0 [0110.714] SelectClipRgn (hdc=0xc0109e0, hrgn=0x6d0405d8) returned 2 [0110.714] DeleteObject (ho=0x730406cc) returned 1 [0110.714] DeleteObject (ho=0x6d0405d8) returned 1 [0110.714] OffsetViewportOrgEx (in: hdc=0xc0109e0, x=0, y=0, lppt=0x25cb170 | out: lppt=0x25cb170) returned 1 [0110.714] GetNearestColor (hdc=0xc0109e0, color=0x0) returned 0x0 [0110.714] CreateSolidBrush (color=0x0) returned 0x2a10075d [0110.714] FillRect (hDC=0xc0109e0, lprc=0x43d4b0, hbr=0x2a10075d) returned 1 [0110.716] DeleteObject (ho=0x2a10075d) returned 1 [0110.719] RestoreDC (hdc=0xc0109e0, nSavedDC=-1) returned 1 [0110.719] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.719] GdipReleaseDC (graphics=0x1c46d570, hdc=0xc0109e0) returned 0x0 [0110.719] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd5c0dbd) returned 0x0 [0110.719] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.719] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0110.719] GetWindowTextLengthW (hWnd=0x20224) returned 39 [0110.719] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x27 [0110.719] GetSystemMetrics (nIndex=42) returned 0 [0110.719] CoTaskMemAlloc (cb=0x54) returned 0x1f310090 [0110.719] GetWindowTextW (in: hWnd=0x20224, lpString=0x1f310090, nMaxCount=40 | out: lpString=" Welcome in\r\nDesktop Ransomware") returned 39 [0110.719] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413380, hWnd=0x20224, Msg=0xd, wParam=0x28, lParam=0x1f310090) returned 0x27 [0110.719] CoTaskMemFree (pv=0x1f310090) [0110.719] GdipGetDC (graphics=0x1c46d570, hdc=0x43d540) returned 0x0 [0110.719] GetCurrentObject (hdc=0xc0109e0, type=0x1) returned 0x1b00017 [0110.719] GetCurrentObject (hdc=0xc0109e0, type=0x2) returned 0x1900010 [0110.719] GetCurrentObject (hdc=0xc0109e0, type=0x7) returned 0x1a050a4e [0110.719] GetCurrentObject (hdc=0xc0109e0, type=0x6) returned 0x18a0048 [0110.720] SaveDC (hdc=0xc0109e0) returned 1 [0110.720] GetNearestColor (hdc=0xc0109e0, color=0x80) returned 0x80 [0110.720] RestoreDC (hdc=0xc0109e0, nSavedDC=-1) returned 1 [0110.720] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.720] GdipReleaseDC (graphics=0x1c46d570, hdc=0xc0109e0) returned 0x0 [0110.720] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d4d0) returned 0x0 [0110.720] GdipSetStringFormatAlign (format=0x1c475a50, align=0x0) returned 0x0 [0110.720] GdipSetStringFormatLineAlign (format=0x1c475a50, align=0x0) returned 0x0 [0110.720] GdipSetStringFormatHotkeyPrefix (format=0x1c475a50, hotkeyPrefix=1) returned 0x0 [0110.720] GdipGetStringFormatFlags (format=0x1c475a50, flags=0x43d4f0) returned 0x0 [0110.720] GdipSetStringFormatFlags (format=0x1c475a50, flags=2048) returned 0x0 [0110.720] GdipCreateSolidFill (color=0xffffffffff800000, brush=0x43d540) returned 0x0 [0110.720] GdipDrawString (graphics=0x1c46d570, string=" Welcome in\r\nDesktop Ransomware", length=39, font=0x1b2c34f0, layoutRect=0x43d450, stringFormat=0x1c475a50, brush=0x1c46cce0) returned 0x0 [0110.720] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.720] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0110.721] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.721] GdipDeleteStringFormat (format=0x1c475a50) returned 0x0 [0110.721] GdipGetDC (graphics=0x1c46d570, hdc=0x43d8e0) returned 0x0 [0110.721] BitBlt (hdc=0xa0108e8, x=0, y=0, cx=338, cy=77, hdcSrc=0xc0109e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0110.723] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.723] GdipReleaseDC (graphics=0x1c46d570, hdc=0xc0109e0) returned 0x0 [0110.723] SelectPalette (hdc=0xa0108e8, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0110.723] SelectObject (hdc=0xc0109e0, h=0x185000f) returned 0x1a050a4e [0110.723] DeleteDC (hdc=0xc0109e0) returned 1 [0110.723] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.723] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0110.723] DeleteObject (ho=0x1a050a4e) returned 1 [0110.724] EndPaint (hWnd=0x20224, lpPaint=0x43d9e8) returned 1 [0110.724] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.724] IsWindowUnicode (hWnd=0x2021e) returned 1 [0110.724] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.724] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0110.724] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0110.724] BeginPaint (in: hWnd=0x2021e, lpPaint=0x43da88 | out: lpPaint=0x43da88) returned 0xa0108e8 [0110.724] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0110.724] SelectPalette (hdc=0xa0108e8, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0110.725] CreateCompatibleDC (hdc=0xa0108e8) returned 0x130109df [0110.725] GetObjectType (h=0xa0108e8) returned 0x3 [0110.725] CreateCompatibleBitmap (hdc=0xa0108e8, cx=1, cy=1) returned 0x1d050a4e [0110.725] GetDIBits (in: hdc=0xa0108e8, hbm=0x1d050a4e, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x43d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43d118) returned 1 [0110.725] GetDIBits (in: hdc=0xa0108e8, hbm=0x1d050a4e, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x43d118, usage=0x0 | out: lpvBits=0x0, lpbmi=0x43d118) returned 1 [0110.725] DeleteObject (ho=0x1d050a4e) returned 1 [0110.725] CreateDIBSection (in: hdc=0xa0108e8, lpbmi=0x43d2f0, usage=0x0, ppvBits=0x43d2e8, hSection=0x0, offset=0x0 | out: ppvBits=0x43d2e8) returned 0xd0509e0 [0110.725] SelectObject (hdc=0x130109df, h=0xd0509e0) returned 0x185000f [0110.725] GdipCreateFromHDC (hdc=0x130109df, graphics=0x43d800) returned 0x0 [0110.726] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0110.726] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=639, height=426, combineMode=0x0) returned 0x0 [0110.726] GdipCreateMatrix (matrix=0x43d9c0) returned 0x0 [0110.726] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4711f0) returned 0x0 [0110.726] GdipIsMatrixIdentity (matrix=0x1c4711f0, result=0x43da20) returned 0x0 [0110.726] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c090 [0110.726] GdipGetMatrixElements (matrix=0x1c4711f0, matrixOut=0x1f32c090) returned 0x0 [0110.726] LocalFree (hMem=0x1f32c090) returned 0x0 [0110.726] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.726] GdipDeleteMatrix (matrix=0x1c4711f0) returned 0x0 [0110.726] GdipCreateRegion (region=0x43d9c0) returned 0x0 [0110.726] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0110.726] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d9f0) returned 0x0 [0110.726] GdipSaveGraphics (graphics=0x1c46d570, state=0x43dac0) returned 0x0 [0110.726] GetWindowTextLengthW (hWnd=0x2021e) returned 0 [0110.726] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0110.726] GetSystemMetrics (nIndex=42) returned 0 [0110.726] CoTaskMemAlloc (cb=0x6) returned 0x64e120 [0110.726] GetWindowTextW (in: hWnd=0x2021e, lpString=0x64e120, nMaxCount=1 | out: lpString="") returned 0 [0110.727] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0xd, wParam=0x1, lParam=0x64e120) returned 0x0 [0110.727] CoTaskMemFree (pv=0x64e120) [0110.727] GetClientRect (in: hWnd=0x2021e, lpRect=0x43da30 | out: lpRect=0x43da30) returned 1 [0110.727] GdipCreateRegion (region=0x43d4b0) returned 0x0 [0110.727] GdipGetClip (graphics=0x1c46d570, region=0x1c470ae0) returned 0x0 [0110.727] GdipCreateMatrix (matrix=0x43d4b0) returned 0x0 [0110.727] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4713b0) returned 0x0 [0110.727] GdipIsMatrixIdentity (matrix=0x1c4713b0, result=0x43d510) returned 0x0 [0110.727] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c250 [0110.727] GdipGetMatrixElements (matrix=0x1c4713b0, matrixOut=0x1f32c250) returned 0x0 [0110.727] LocalFree (hMem=0x1f32c250) returned 0x0 [0110.727] GdipCombineRegionRegion (region=0x1c470ae0, region2=0x1c46a710, combineMode=0x1) returned 0x0 [0110.727] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c390 [0110.727] GdipGetMatrixElements (matrix=0x1c4713b0, matrixOut=0x1f32c390) returned 0x0 [0110.727] LocalFree (hMem=0x1f32c390) returned 0x0 [0110.727] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.727] GdipDeleteMatrix (matrix=0x1c4713b0) returned 0x0 [0110.727] GdipIsInfiniteRegion (region=0x1c470ae0, graphics=0x1c46d570, result=0x43d560) returned 0x0 [0110.727] GdipIsInfiniteRegion (region=0x1c470ae0, graphics=0x1c46d570, result=0x43d520) returned 0x0 [0110.727] GdipGetRegionHRgn (region=0x1c470ae0, graphics=0x1c46d570, hRgn=0x43d520) returned 0x0 [0110.728] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.728] GdipDeleteRegion (region=0x1c470ae0) returned 0x0 [0110.728] GdipGetDC (graphics=0x1c46d570, hdc=0x43d590) returned 0x0 [0110.728] GetCurrentObject (hdc=0x130109df, type=0x1) returned 0x1b00017 [0110.728] GetCurrentObject (hdc=0x130109df, type=0x2) returned 0x1900010 [0110.728] GetCurrentObject (hdc=0x130109df, type=0x7) returned 0xd0509e0 [0110.728] GetCurrentObject (hdc=0x130109df, type=0x6) returned 0x18a0048 [0110.728] SaveDC (hdc=0x130109df) returned 1 [0110.728] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6e0405d8 [0110.728] GetClipRgn (hdc=0x130109df, hrgn=0x6e0405d8) returned 0 [0110.728] SelectClipRgn (hdc=0x130109df, hrgn=0x740406cc) returned 2 [0110.728] DeleteObject (ho=0x6e0405d8) returned 1 [0110.728] DeleteObject (ho=0x740406cc) returned 1 [0110.728] OffsetViewportOrgEx (in: hdc=0x130109df, x=0, y=0, lppt=0x25ccc18 | out: lppt=0x25ccc18) returned 1 [0110.728] GetNearestColor (hdc=0x130109df, color=0xf0f0f0) returned 0xf0f0f0 [0110.729] CreateSolidBrush (color=0xf0f0f0) returned 0x2b10075d [0110.729] FillRect (hDC=0x130109df, lprc=0x43d560, hbr=0x2b10075d) returned 1 [0110.808] DeleteObject (ho=0x2b10075d) returned 1 [0110.808] RestoreDC (hdc=0x130109df, nSavedDC=-1) returned 1 [0110.808] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.808] GdipReleaseDC (graphics=0x1c46d570, hdc=0x130109df) returned 0x0 [0110.808] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd5a0dbd) returned 0x0 [0110.808] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.808] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0110.808] GetWindowTextLengthW (hWnd=0x2021e) returned 0 [0110.809] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0110.809] GetSystemMetrics (nIndex=42) returned 0 [0110.809] CoTaskMemAlloc (cb=0x6) returned 0x64e200 [0110.809] GetWindowTextW (in: hWnd=0x2021e, lpString=0x64e200, nMaxCount=1 | out: lpString="") returned 0 [0110.809] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x2021e, Msg=0xd, wParam=0x1, lParam=0x64e200) returned 0x0 [0110.809] CoTaskMemFree (pv=0x64e200) [0110.809] GdipDrawImageRectI (graphics=0x1c46d570, image=0x1c4667f0, x=0, y=0, width=639, height=426) returned 0x0 [0110.911] GdipGetDC (graphics=0x1c46d570, hdc=0x43d990) returned 0x0 [0110.911] BitBlt (hdc=0xa0108e8, x=0, y=0, cx=639, cy=426, hdcSrc=0x130109df, x1=0, y1=0, rop=0xcc0020) returned 1 [0110.915] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.915] GdipReleaseDC (graphics=0x1c46d570, hdc=0x130109df) returned 0x0 [0110.915] SelectPalette (hdc=0xa0108e8, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0110.915] SelectObject (hdc=0x130109df, h=0x185000f) returned 0xd0509e0 [0110.915] DeleteDC (hdc=0x130109df) returned 1 [0110.915] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0110.916] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0110.916] DeleteObject (ho=0xd0509e0) returned 1 [0110.921] EndPaint (hWnd=0x2021e, lpPaint=0x43da98) returned 1 [0110.922] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.922] IsWindowUnicode (hWnd=0x40174) returned 1 [0110.922] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0110.922] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0110.922] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0110.922] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0110.922] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0110.922] WaitMessage () returned 1 [0133.393] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0133.393] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0133.393] WaitMessage () returned 1 [0133.393] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0133.393] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0133.394] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0133.394] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0133.394] WaitMessage () returned 1 [0133.420] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0133.420] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0133.420] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0133.420] WaitMessage () returned 1 [0135.322] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0135.322] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43e410) returned 0x0 [0135.322] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43e410) returned 0x0 [0135.323] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43de40 | out: lpwndpl=0x43de40) returned 1 [0135.323] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x47, wParam=0x0, lParam=0x43e410) returned 0x0 [0135.323] GetClientRect (in: hWnd=0x8016e, lpRect=0x43dbe0 | out: lpRect=0x43dbe0) returned 1 [0135.323] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43dbe0 | out: lpRect=0x43dbe0) returned 1 [0135.324] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x47, wParam=0x0, lParam=0x43e410) returned 0x0 [0135.324] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x1c, wParam=0x1, lParam=0xa1c) returned 0x0 [0135.324] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x1c, wParam=0x1, lParam=0xa1c) returned 0x0 [0135.324] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x1c, wParam=0x1, lParam=0xa1c) returned 0x0 [0135.324] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0135.326] GetFocus () returned 0x0 [0135.326] SetFocus (hWnd=0xa01fa) returned 0x0 [0135.326] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0135.327] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0135.327] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0135.327] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0135.327] GetStockObject (i=5) returned 0x1900015 [0135.328] GetDlgItem (hDlg=0x8016e, nIDDlgItem=655866) returned 0xa01fa [0135.328] SendMessageW (hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43d0c0) returned 0x0 [0135.328] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43d0c0) returned 0x0 [0135.328] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0135.328] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0135.328] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0135.328] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0135.328] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0135.328] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x43d9d8 | out: lpPaint=0x43d9d8) returned 0x1d010914 [0135.328] SelectPalette (hdc=0x1d010914, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0135.328] CreateCompatibleDC (hdc=0x1d010914) returned 0x4b010a38 [0135.328] SelectObject (hdc=0x4b010a38, h=0x2905055a) returned 0x185000f [0135.328] GdipCreateFromHDC (hdc=0x4b010a38, graphics=0x43d7e0) returned 0x0 [0135.329] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0135.329] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0135.329] GdipCreateMatrix (matrix=0x43d910) returned 0x0 [0135.329] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471230) returned 0x0 [0135.329] GdipIsMatrixIdentity (matrix=0x1c471230, result=0x43d970) returned 0x0 [0135.329] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c690 [0135.329] GdipGetMatrixElements (matrix=0x1c471230, matrixOut=0x1f32c690) returned 0x0 [0135.329] LocalFree (hMem=0x1f32c690) returned 0x0 [0135.330] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.330] GdipDeleteMatrix (matrix=0x1c471230) returned 0x0 [0135.330] GdipCreateRegion (region=0x43d910) returned 0x0 [0135.330] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0135.330] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d940) returned 0x0 [0135.330] GdipSaveGraphics (graphics=0x1c46d570, state=0x43da10) returned 0x0 [0135.330] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd580dbd) returned 0x0 [0135.330] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.330] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0135.330] GdipGetDC (graphics=0x1c46d570, hdc=0x43ce00) returned 0x0 [0135.330] GetCurrentObject (hdc=0x4b010a38, type=0x1) returned 0x1b00017 [0135.330] GetCurrentObject (hdc=0x4b010a38, type=0x2) returned 0x1900010 [0135.330] GetCurrentObject (hdc=0x4b010a38, type=0x7) returned 0x2905055a [0135.330] GetCurrentObject (hdc=0x4b010a38, type=0x6) returned 0x18a0048 [0135.330] SaveDC (hdc=0x4b010a38) returned 1 [0135.330] GetNearestColor (hdc=0x4b010a38, color=0xf0f0f0) returned 0xf0f0f0 [0135.330] GetNearestColor (hdc=0x4b010a38, color=0xa0a0a0) returned 0xa0a0a0 [0135.330] GetNearestColor (hdc=0x4b010a38, color=0x696969) returned 0x696969 [0135.330] GetNearestColor (hdc=0x4b010a38, color=0xa0a0a0) returned 0xa0a0a0 [0135.330] GetNearestColor (hdc=0x4b010a38, color=0x0) returned 0x0 [0135.331] GetNearestColor (hdc=0x4b010a38, color=0xffffff) returned 0xffffff [0135.331] GetNearestColor (hdc=0x4b010a38, color=0xe5e5e5) returned 0xe5e5e5 [0135.331] GetNearestColor (hdc=0x4b010a38, color=0xd8d8d8) returned 0xd8d8d8 [0135.331] GetNearestColor (hdc=0x4b010a38, color=0x0) returned 0x0 [0135.331] RestoreDC (hdc=0x4b010a38, nSavedDC=-1) returned 1 [0135.331] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.331] GdipReleaseDC (graphics=0x1c46d570, hdc=0x4b010a38) returned 0x0 [0135.331] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0135.331] CoTaskMemAlloc (cb=0x13) returned 0x1f2f30c0 [0135.332] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0135.332] CoTaskMemFree (pv=0x1f2f30c0) [0135.332] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d4f0) returned 0x0 [0135.332] GdipSetStringFormatAlign (format=0x1c476150, align=0x1) returned 0x0 [0135.332] GdipSetStringFormatLineAlign (format=0x1c476150, align=0x1) returned 0x0 [0135.332] GdipSetStringFormatHotkeyPrefix (format=0x1c476150, hotkeyPrefix=1) returned 0x0 [0135.332] GdipGetStringFormatFlags (format=0x1c476150, flags=0x43d520) returned 0x0 [0135.332] GdipGetStringFormatTrimming (format=0x1c476150, trimming=0x43d520) returned 0x0 [0135.332] GdipGetStringFormatHotkeyPrefix (format=0x1c476150, hotkeyPrefix=0x43d520) returned 0x0 [0135.332] GdipGetFontSize (font=0x1c476150, size=0x43d520) returned 0x0 [0135.332] GdipGetFontStyle (font=0x1c476150, style=0x43d520) returned 0x0 [0135.332] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.332] GdipDeleteStringFormat (format=0x1c476150) returned 0x0 [0135.332] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0135.332] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3200 [0135.333] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0135.333] CoTaskMemFree (pv=0x1f2f3200) [0135.333] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43d1b0) returned 0x0 [0135.333] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d1c0) returned 0x0 [0135.333] GdipSetStringFormatFlags (format=0x1c4762a0, flags=0) returned 0x0 [0135.333] GdipSetStringFormatTrimming (format=0x1c4762a0, trimming=0x1) returned 0x0 [0135.333] GdipSetStringFormatHotkeyPrefix (format=0x1c4762a0, hotkeyPrefix=1) returned 0x0 [0135.333] GdipSetStringFormatAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0135.333] GdipSetStringFormatLineAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0135.333] GdipMeasureString (graphics=0x1c4701b0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43d0d8, stringFormat=0x1c4762a0, boundingBox=0x43d0c8, codepointsFitted=0x43d0c4, linesFilled=0x43d0c0) returned 0x0 [0135.333] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.333] GdipDeleteStringFormat (format=0x1c4762a0) returned 0x0 [0135.333] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.333] GdipDeleteGraphics (graphics=0x1c4701b0) returned 0x0 [0135.334] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0135.334] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2e00 [0135.334] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0135.334] CoTaskMemFree (pv=0x1f2f2e00) [0135.334] GdipCreateRegion (region=0x43d120) returned 0x0 [0135.334] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0135.334] GdipCreateMatrix (matrix=0x43d120) returned 0x0 [0135.334] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471270) returned 0x0 [0135.334] GdipIsMatrixIdentity (matrix=0x1c471270, result=0x43d180) returned 0x0 [0135.334] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c4d0 [0135.334] GdipGetMatrixElements (matrix=0x1c471270, matrixOut=0x1f32c4d0) returned 0x0 [0135.334] LocalFree (hMem=0x1f32c4d0) returned 0x0 [0135.334] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c3d0 [0135.334] GdipGetMatrixElements (matrix=0x1c471270, matrixOut=0x1f32c3d0) returned 0x0 [0135.334] LocalFree (hMem=0x1f32c3d0) returned 0x0 [0135.334] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.335] GdipDeleteMatrix (matrix=0x1c471270) returned 0x0 [0135.335] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d1d0) returned 0x0 [0135.335] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d190) returned 0x0 [0135.335] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43d190) returned 0x0 [0135.335] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.335] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0135.335] GdipGetDC (graphics=0x1c46d570, hdc=0x43d200) returned 0x0 [0135.335] GetCurrentObject (hdc=0x4b010a38, type=0x1) returned 0x1b00017 [0135.335] GetCurrentObject (hdc=0x4b010a38, type=0x2) returned 0x1900010 [0135.335] GetCurrentObject (hdc=0x4b010a38, type=0x7) returned 0x2905055a [0135.335] GetCurrentObject (hdc=0x4b010a38, type=0x6) returned 0x18a0048 [0135.335] SaveDC (hdc=0x4b010a38) returned 1 [0135.335] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x750406cc [0135.335] GetClipRgn (hdc=0x4b010a38, hrgn=0x750406cc) returned 0 [0135.335] SelectClipRgn (hdc=0x4b010a38, hrgn=0x6f0405d8) returned 2 [0135.335] DeleteObject (ho=0x750406cc) returned 1 [0135.335] DeleteObject (ho=0x6f0405d8) returned 1 [0135.335] OffsetViewportOrgEx (in: hdc=0x4b010a38, x=0, y=0, lppt=0x25cda68 | out: lppt=0x25cda68) returned 1 [0135.335] GetNearestColor (hdc=0x4b010a38, color=0xf0f0f0) returned 0xf0f0f0 [0135.335] CreateSolidBrush (color=0xf0f0f0) returned 0x2c10075d [0135.335] FillRect (hDC=0x4b010a38, lprc=0x43d1d0, hbr=0x2c10075d) returned 1 [0135.336] DeleteObject (ho=0x2c10075d) returned 1 [0135.336] RestoreDC (hdc=0x4b010a38, nSavedDC=-1) returned 1 [0135.336] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.336] GdipReleaseDC (graphics=0x1c46d570, hdc=0x4b010a38) returned 0x0 [0135.336] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0135.336] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2dc0 [0135.336] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0135.336] CoTaskMemFree (pv=0x1f2f2dc0) [0135.336] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d250) returned 0x0 [0135.336] GdipSetStringFormatAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0135.336] GdipSetStringFormatLineAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0135.336] GdipSetStringFormatHotkeyPrefix (format=0x1c4762a0, hotkeyPrefix=1) returned 0x0 [0135.337] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x43d2c0) returned 0x0 [0135.337] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43d1d0, stringFormat=0x1c4762a0, brush=0x1c46cce0) returned 0x0 [0135.337] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.337] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0135.337] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.337] GdipDeleteStringFormat (format=0x1c4762a0) returned 0x0 [0135.337] GetFocus () returned 0xa01fa [0135.337] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0135.337] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2cc0 [0135.337] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0135.337] CoTaskMemFree (pv=0x1f2f2cc0) [0135.337] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x43d5b0) returned 0x0 [0135.337] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0135.337] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.338] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0135.338] GdipCreateRegion (region=0x43d080) returned 0x0 [0135.338] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0135.338] GdipCreateMatrix (matrix=0x43d080) returned 0x0 [0135.338] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471530) returned 0x0 [0135.338] GdipIsMatrixIdentity (matrix=0x1c471530, result=0x43d0e0) returned 0x0 [0135.338] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c910 [0135.338] GdipGetMatrixElements (matrix=0x1c471530, matrixOut=0x1f32c910) returned 0x0 [0135.338] LocalFree (hMem=0x1f32c910) returned 0x0 [0135.338] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c650 [0135.338] GdipGetMatrixElements (matrix=0x1c471530, matrixOut=0x1f32c650) returned 0x0 [0135.338] LocalFree (hMem=0x1f32c650) returned 0x0 [0135.338] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.338] GdipDeleteMatrix (matrix=0x1c471530) returned 0x0 [0135.338] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d130) returned 0x0 [0135.338] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d0f0) returned 0x0 [0135.338] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43d0f0) returned 0x0 [0135.338] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.338] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0135.338] GdipGetDC (graphics=0x1c46d570, hdc=0x43d160) returned 0x0 [0135.338] GetCurrentObject (hdc=0x4b010a38, type=0x1) returned 0x1b00017 [0135.338] GetCurrentObject (hdc=0x4b010a38, type=0x2) returned 0x1900010 [0135.338] GetCurrentObject (hdc=0x4b010a38, type=0x7) returned 0x2905055a [0135.338] GetCurrentObject (hdc=0x4b010a38, type=0x6) returned 0x18a0048 [0135.338] SaveDC (hdc=0x4b010a38) returned 1 [0135.339] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x700405d8 [0135.339] GetClipRgn (hdc=0x4b010a38, hrgn=0x700405d8) returned 0 [0135.339] SelectClipRgn (hdc=0x4b010a38, hrgn=0x760406cc) returned 2 [0135.339] DeleteObject (ho=0x700405d8) returned 1 [0135.339] DeleteObject (ho=0x760406cc) returned 1 [0135.339] OffsetViewportOrgEx (in: hdc=0x4b010a38, x=0, y=0, lppt=0x25ce008 | out: lppt=0x25ce008) returned 1 [0135.339] GetROP2 (hdc=0x4b010a38) returned 13 [0135.339] GetBkMode (hdc=0x4b010a38) returned 2 [0135.339] SetBkMode (hdc=0x4b010a38, mode=1) returned 2 [0135.339] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x38300853 [0135.339] SelectObject (hdc=0x4b010a38, h=0x38300853) returned 0x1b00017 [0135.339] MoveToEx (in: hdc=0x4b010a38, x=123, y=1, lppt=0x25ce070 | out: lppt=0x25ce070) returned 1 [0135.339] LineTo (hdc=0x4b010a38, x=1, y=1) returned 1 [0135.339] SetBkMode (hdc=0x4b010a38, mode=2) returned 1 [0135.339] MoveToEx (in: hdc=0x4b010a38, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0135.339] GetROP2 (hdc=0x4b010a38) returned 13 [0135.339] GetBkMode (hdc=0x4b010a38) returned 2 [0135.339] SetBkMode (hdc=0x4b010a38, mode=1) returned 2 [0135.339] SelectObject (hdc=0x4b010a38, h=0x38300853) returned 0x38300853 [0135.339] MoveToEx (in: hdc=0x4b010a38, x=1, y=1, lppt=0x25ce088 | out: lppt=0x25ce088) returned 1 [0135.339] LineTo (hdc=0x4b010a38, x=1, y=34) returned 1 [0135.340] SetBkMode (hdc=0x4b010a38, mode=2) returned 1 [0135.340] MoveToEx (in: hdc=0x4b010a38, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0135.340] SelectObject (hdc=0x4b010a38, h=0x1b00017) returned 0x38300853 [0135.340] DeleteObject (ho=0x38300853) returned 1 [0135.340] GetROP2 (hdc=0x4b010a38) returned 13 [0135.340] GetBkMode (hdc=0x4b010a38) returned 2 [0135.340] SetBkMode (hdc=0x4b010a38, mode=1) returned 2 [0135.340] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x26300953 [0135.340] SelectObject (hdc=0x4b010a38, h=0x26300953) returned 0x1b00017 [0135.340] MoveToEx (in: hdc=0x4b010a38, x=1, y=34, lppt=0x25ce0f0 | out: lppt=0x25ce0f0) returned 1 [0135.340] LineTo (hdc=0x4b010a38, x=123, y=34) returned 1 [0135.340] SetBkMode (hdc=0x4b010a38, mode=2) returned 1 [0135.340] MoveToEx (in: hdc=0x4b010a38, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0135.340] GetROP2 (hdc=0x4b010a38) returned 13 [0135.340] GetBkMode (hdc=0x4b010a38) returned 2 [0135.340] SetBkMode (hdc=0x4b010a38, mode=1) returned 2 [0135.340] SelectObject (hdc=0x4b010a38, h=0x26300953) returned 0x26300953 [0135.340] MoveToEx (in: hdc=0x4b010a38, x=123, y=34, lppt=0x25ce108 | out: lppt=0x25ce108) returned 1 [0135.340] LineTo (hdc=0x4b010a38, x=123, y=0) returned 1 [0135.340] SetBkMode (hdc=0x4b010a38, mode=2) returned 1 [0135.340] MoveToEx (in: hdc=0x4b010a38, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0135.340] SelectObject (hdc=0x4b010a38, h=0x1b00017) returned 0x26300953 [0135.340] DeleteObject (ho=0x26300953) returned 1 [0135.340] GetROP2 (hdc=0x4b010a38) returned 13 [0135.341] GetBkMode (hdc=0x4b010a38) returned 2 [0135.341] SetBkMode (hdc=0x4b010a38, mode=1) returned 2 [0135.341] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x39300853 [0135.341] SelectObject (hdc=0x4b010a38, h=0x39300853) returned 0x1b00017 [0135.341] MoveToEx (in: hdc=0x4b010a38, x=122, y=2, lppt=0x25ce170 | out: lppt=0x25ce170) returned 1 [0135.341] LineTo (hdc=0x4b010a38, x=2, y=2) returned 1 [0135.350] SetBkMode (hdc=0x4b010a38, mode=2) returned 1 [0135.350] MoveToEx (in: hdc=0x4b010a38, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0135.350] GetROP2 (hdc=0x4b010a38) returned 13 [0135.350] GetBkMode (hdc=0x4b010a38) returned 2 [0135.350] SetBkMode (hdc=0x4b010a38, mode=1) returned 2 [0135.350] SelectObject (hdc=0x4b010a38, h=0x39300853) returned 0x39300853 [0135.350] MoveToEx (in: hdc=0x4b010a38, x=2, y=2, lppt=0x25ce188 | out: lppt=0x25ce188) returned 1 [0135.350] LineTo (hdc=0x4b010a38, x=2, y=33) returned 1 [0135.350] SetBkMode (hdc=0x4b010a38, mode=2) returned 1 [0135.350] MoveToEx (in: hdc=0x4b010a38, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0135.350] SelectObject (hdc=0x4b010a38, h=0x1b00017) returned 0x39300853 [0135.350] DeleteObject (ho=0x39300853) returned 1 [0135.350] GetROP2 (hdc=0x4b010a38) returned 13 [0135.350] GetBkMode (hdc=0x4b010a38) returned 2 [0135.350] SetBkMode (hdc=0x4b010a38, mode=1) returned 2 [0135.350] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x27300953 [0135.350] SelectObject (hdc=0x4b010a38, h=0x27300953) returned 0x1b00017 [0135.350] MoveToEx (in: hdc=0x4b010a38, x=2, y=33, lppt=0x25ce1f0 | out: lppt=0x25ce1f0) returned 1 [0135.350] LineTo (hdc=0x4b010a38, x=122, y=33) returned 1 [0135.351] SetBkMode (hdc=0x4b010a38, mode=2) returned 1 [0135.351] MoveToEx (in: hdc=0x4b010a38, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0135.351] GetROP2 (hdc=0x4b010a38) returned 13 [0135.351] GetBkMode (hdc=0x4b010a38) returned 2 [0135.351] SetBkMode (hdc=0x4b010a38, mode=1) returned 2 [0135.351] SelectObject (hdc=0x4b010a38, h=0x27300953) returned 0x27300953 [0135.351] MoveToEx (in: hdc=0x4b010a38, x=122, y=33, lppt=0x25ce208 | out: lppt=0x25ce208) returned 1 [0135.351] LineTo (hdc=0x4b010a38, x=122, y=1) returned 1 [0135.351] SetBkMode (hdc=0x4b010a38, mode=2) returned 1 [0135.351] MoveToEx (in: hdc=0x4b010a38, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0135.351] SelectObject (hdc=0x4b010a38, h=0x1b00017) returned 0x27300953 [0135.351] DeleteObject (ho=0x27300953) returned 1 [0135.351] RestoreDC (hdc=0x4b010a38, nSavedDC=-1) returned 1 [0135.351] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.351] GdipReleaseDC (graphics=0x1c46d570, hdc=0x4b010a38) returned 0x0 [0135.351] GdipGetDC (graphics=0x1c46d570, hdc=0x43d8e0) returned 0x0 [0135.351] BitBlt (hdc=0x1d010914, x=0, y=0, cx=125, cy=36, hdcSrc=0x4b010a38, x1=0, y1=0, rop=0xcc0020) returned 1 [0135.351] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.351] GdipReleaseDC (graphics=0x1c46d570, hdc=0x4b010a38) returned 0x0 [0135.351] SelectPalette (hdc=0x1d010914, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0135.352] SelectObject (hdc=0x4b010a38, h=0x185000f) returned 0x2905055a [0135.352] DeleteDC (hdc=0x4b010a38) returned 1 [0135.352] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0135.352] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0135.352] EndPaint (hWnd=0xa01fa, lpPaint=0x43d9e8) returned 1 [0135.352] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0135.352] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0135.352] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0135.352] GetKeyState (nVirtKey=16) returned 0 [0135.352] GetKeyState (nVirtKey=17) returned 0 [0135.352] GetKeyState (nVirtKey=18) returned -127 [0135.352] TranslateMessage (lpMsg=0x43e5e0) returned 1 [0135.352] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0135.352] GetKeyState (nVirtKey=16) returned 0 [0135.352] GetKeyState (nVirtKey=17) returned 0 [0135.352] GetKeyState (nVirtKey=18) returned -127 [0135.353] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x105, wParam=0x1b, lParam=0xe0010001) returned 0x0 [0135.353] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0135.353] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0135.353] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0135.353] GetKeyState (nVirtKey=16) returned 0 [0135.353] GetKeyState (nVirtKey=17) returned 0 [0135.353] GetKeyState (nVirtKey=18) returned 1 [0135.353] TranslateMessage (lpMsg=0x43e5e0) returned 1 [0135.353] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0135.353] GetKeyState (nVirtKey=16) returned 0 [0135.353] GetKeyState (nVirtKey=17) returned 0 [0135.353] GetKeyState (nVirtKey=18) returned 1 [0135.353] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x101, wParam=0x12, lParam=0xc0380001) returned 0x0 [0135.354] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0135.354] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0135.354] WaitMessage () returned 1 [0135.641] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0135.641] IsWindowUnicode (hWnd=0x40174) returned 1 [0135.641] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0135.641] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0135.641] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0135.641] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0135.641] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0135.641] WaitMessage () returned 1 [0140.422] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0140.422] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0140.422] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0140.422] GetKeyState (nVirtKey=16) returned 0 [0140.422] GetKeyState (nVirtKey=17) returned 0 [0140.422] GetKeyState (nVirtKey=18) returned -128 [0140.422] SendMessageW (hWnd=0xa01fa, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x1 [0140.423] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x1 [0140.423] GetKeyState (nVirtKey=16) returned 0 [0140.423] GetKeyState (nVirtKey=17) returned 0 [0140.423] GetKeyState (nVirtKey=18) returned -128 [0140.423] TranslateMessage (lpMsg=0x43e5e0) returned 1 [0140.423] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0140.423] GetKeyState (nVirtKey=16) returned 0 [0140.423] GetKeyState (nVirtKey=17) returned 0 [0140.423] GetKeyState (nVirtKey=18) returned -128 [0140.423] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x104, wParam=0x12, lParam=0x20380001) returned 0x0 [0140.423] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0140.423] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0140.423] WaitMessage () returned 1 [0140.429] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0140.430] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0140.461] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0140.461] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43e410) returned 0x0 [0140.462] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43de40 | out: lpwndpl=0x43de40) returned 1 [0140.462] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x47, wParam=0x0, lParam=0x43e410) returned 0x0 [0140.462] GetClientRect (in: hWnd=0x8016e, lpRect=0x43dbe0 | out: lpRect=0x43dbe0) returned 1 [0140.462] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43dbe0 | out: lpRect=0x43dbe0) returned 1 [0140.463] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x47, wParam=0x0, lParam=0x43e410) returned 0x0 [0140.463] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0140.465] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x1c, wParam=0x0, lParam=0x7f8) returned 0x0 [0140.465] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x1c, wParam=0x0, lParam=0x7f8) returned 0x0 [0140.465] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x1c, wParam=0x0, lParam=0x7f8) returned 0x0 [0140.465] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0140.466] GetStockObject (i=5) returned 0x1900015 [0140.466] GetDlgItem (hDlg=0x8016e, nIDDlgItem=655866) returned 0xa01fa [0140.475] SendMessageW (hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43d810) returned 0x0 [0140.475] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43d810) returned 0x0 [0140.475] GetCapture () returned 0x0 [0140.476] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0140.476] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0140.476] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0140.476] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0140.476] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0140.476] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0140.476] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0140.476] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0140.477] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x43d9d8 | out: lpPaint=0x43d9d8) returned 0x1d010914 [0140.477] SelectPalette (hdc=0x1d010914, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0140.477] CreateCompatibleDC (hdc=0x1d010914) returned 0x2b010a3d [0140.477] SelectObject (hdc=0x2b010a3d, h=0x2905055a) returned 0x185000f [0140.477] GdipCreateFromHDC (hdc=0x2b010a3d, graphics=0x43d7e0) returned 0x0 [0140.477] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0140.477] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0140.477] GdipCreateMatrix (matrix=0x43d910) returned 0x0 [0140.477] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471630) returned 0x0 [0140.477] GdipIsMatrixIdentity (matrix=0x1c471630, result=0x43d970) returned 0x0 [0140.477] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c250 [0140.477] GdipGetMatrixElements (matrix=0x1c471630, matrixOut=0x1f32c250) returned 0x0 [0140.477] LocalFree (hMem=0x1f32c250) returned 0x0 [0140.477] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.477] GdipDeleteMatrix (matrix=0x1c471630) returned 0x0 [0140.477] GdipCreateRegion (region=0x43d910) returned 0x0 [0140.477] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0140.477] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d940) returned 0x0 [0140.477] GdipSaveGraphics (graphics=0x1c46d570, state=0x43da10) returned 0x0 [0140.478] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd550dbd) returned 0x0 [0140.478] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.478] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0140.478] GdipGetDC (graphics=0x1c46d570, hdc=0x43ce00) returned 0x0 [0140.478] GetCurrentObject (hdc=0x2b010a3d, type=0x1) returned 0x1b00017 [0140.478] GetCurrentObject (hdc=0x2b010a3d, type=0x2) returned 0x1900010 [0140.478] GetCurrentObject (hdc=0x2b010a3d, type=0x7) returned 0x2905055a [0140.478] GetCurrentObject (hdc=0x2b010a3d, type=0x6) returned 0x18a0048 [0140.478] SaveDC (hdc=0x2b010a3d) returned 1 [0140.478] GetNearestColor (hdc=0x2b010a3d, color=0xf0f0f0) returned 0xf0f0f0 [0140.478] GetNearestColor (hdc=0x2b010a3d, color=0xa0a0a0) returned 0xa0a0a0 [0140.478] GetNearestColor (hdc=0x2b010a3d, color=0x696969) returned 0x696969 [0140.478] GetNearestColor (hdc=0x2b010a3d, color=0xa0a0a0) returned 0xa0a0a0 [0140.478] GetNearestColor (hdc=0x2b010a3d, color=0x0) returned 0x0 [0140.478] GetNearestColor (hdc=0x2b010a3d, color=0xffffff) returned 0xffffff [0140.478] GetNearestColor (hdc=0x2b010a3d, color=0xe5e5e5) returned 0xe5e5e5 [0140.478] GetNearestColor (hdc=0x2b010a3d, color=0xd8d8d8) returned 0xd8d8d8 [0140.478] GetNearestColor (hdc=0x2b010a3d, color=0x0) returned 0x0 [0140.478] RestoreDC (hdc=0x2b010a3d, nSavedDC=-1) returned 1 [0140.479] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.479] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b010a3d) returned 0x0 [0140.479] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0140.479] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3000 [0140.479] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0140.479] CoTaskMemFree (pv=0x1f2f3000) [0140.479] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d4f0) returned 0x0 [0140.480] GdipSetStringFormatAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0140.480] GdipSetStringFormatLineAlign (format=0x1c4762a0, align=0x1) returned 0x0 [0140.480] GdipSetStringFormatHotkeyPrefix (format=0x1c4762a0, hotkeyPrefix=1) returned 0x0 [0140.480] GdipGetStringFormatFlags (format=0x1c4762a0, flags=0x43d520) returned 0x0 [0140.480] GdipGetStringFormatTrimming (format=0x1c4762a0, trimming=0x43d520) returned 0x0 [0140.480] GdipGetStringFormatHotkeyPrefix (format=0x1c4762a0, hotkeyPrefix=0x43d520) returned 0x0 [0140.480] GdipGetFontSize (font=0x1c4762a0, size=0x43d520) returned 0x0 [0140.480] GdipGetFontStyle (font=0x1c4762a0, style=0x43d520) returned 0x0 [0140.480] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.480] GdipDeleteStringFormat (format=0x1c4762a0) returned 0x0 [0140.480] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0140.480] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2dc0 [0140.480] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0140.480] CoTaskMemFree (pv=0x1f2f2dc0) [0140.480] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43d1b0) returned 0x0 [0140.481] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d1c0) returned 0x0 [0140.481] GdipSetStringFormatFlags (format=0x1c475a50, flags=0) returned 0x0 [0140.481] GdipSetStringFormatTrimming (format=0x1c475a50, trimming=0x1) returned 0x0 [0140.481] GdipSetStringFormatHotkeyPrefix (format=0x1c475a50, hotkeyPrefix=1) returned 0x0 [0140.481] GdipSetStringFormatAlign (format=0x1c475a50, align=0x1) returned 0x0 [0140.481] GdipSetStringFormatLineAlign (format=0x1c475a50, align=0x1) returned 0x0 [0140.481] GdipMeasureString (graphics=0x1c4701b0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43d0d8, stringFormat=0x1c475a50, boundingBox=0x43d0c8, codepointsFitted=0x43d0c4, linesFilled=0x43d0c0) returned 0x0 [0140.481] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.481] GdipDeleteStringFormat (format=0x1c475a50) returned 0x0 [0140.481] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.481] GdipDeleteGraphics (graphics=0x1c4701b0) returned 0x0 [0140.481] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0140.485] CoTaskMemAlloc (cb=0x13) returned 0x1f2f32c0 [0140.485] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0140.485] CoTaskMemFree (pv=0x1f2f32c0) [0140.485] GdipCreateRegion (region=0x43d120) returned 0x0 [0140.485] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0140.485] GdipCreateMatrix (matrix=0x43d120) returned 0x0 [0140.485] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4714b0) returned 0x0 [0140.485] GdipIsMatrixIdentity (matrix=0x1c4714b0, result=0x43d180) returned 0x0 [0140.485] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c090 [0140.485] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f32c090) returned 0x0 [0140.485] LocalFree (hMem=0x1f32c090) returned 0x0 [0140.485] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c410 [0140.485] GdipGetMatrixElements (matrix=0x1c4714b0, matrixOut=0x1f32c410) returned 0x0 [0140.485] LocalFree (hMem=0x1f32c410) returned 0x0 [0140.485] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.486] GdipDeleteMatrix (matrix=0x1c4714b0) returned 0x0 [0140.486] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d1d0) returned 0x0 [0140.486] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d190) returned 0x0 [0140.486] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43d190) returned 0x0 [0140.486] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.486] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0140.486] GdipGetDC (graphics=0x1c46d570, hdc=0x43d200) returned 0x0 [0140.486] GetCurrentObject (hdc=0x2b010a3d, type=0x1) returned 0x1b00017 [0140.486] GetCurrentObject (hdc=0x2b010a3d, type=0x2) returned 0x1900010 [0140.486] GetCurrentObject (hdc=0x2b010a3d, type=0x7) returned 0x2905055a [0140.486] GetCurrentObject (hdc=0x2b010a3d, type=0x6) returned 0x18a0048 [0140.486] SaveDC (hdc=0x2b010a3d) returned 1 [0140.486] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x770406cc [0140.486] GetClipRgn (hdc=0x2b010a3d, hrgn=0x770406cc) returned 0 [0140.486] SelectClipRgn (hdc=0x2b010a3d, hrgn=0x710405d8) returned 2 [0140.486] DeleteObject (ho=0x770406cc) returned 1 [0140.486] DeleteObject (ho=0x710405d8) returned 1 [0140.486] OffsetViewportOrgEx (in: hdc=0x2b010a3d, x=0, y=0, lppt=0x25cf0c8 | out: lppt=0x25cf0c8) returned 1 [0140.486] GetNearestColor (hdc=0x2b010a3d, color=0xf0f0f0) returned 0xf0f0f0 [0140.486] CreateSolidBrush (color=0xf0f0f0) returned 0x2d10075d [0140.486] FillRect (hDC=0x2b010a3d, lprc=0x43d1d0, hbr=0x2d10075d) returned 1 [0140.487] DeleteObject (ho=0x2d10075d) returned 1 [0140.487] RestoreDC (hdc=0x2b010a3d, nSavedDC=-1) returned 1 [0140.487] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.487] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b010a3d) returned 0x0 [0140.487] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0140.487] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3000 [0140.487] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0140.487] CoTaskMemFree (pv=0x1f2f3000) [0140.488] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d250) returned 0x0 [0140.488] GdipSetStringFormatAlign (format=0x1c475c10, align=0x1) returned 0x0 [0140.488] GdipSetStringFormatLineAlign (format=0x1c475c10, align=0x1) returned 0x0 [0140.488] GdipSetStringFormatHotkeyPrefix (format=0x1c475c10, hotkeyPrefix=1) returned 0x0 [0140.488] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x43d2c0) returned 0x0 [0140.488] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43d1d0, stringFormat=0x1c475c10, brush=0x1c46cce0) returned 0x0 [0140.488] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.488] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0140.488] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.488] GdipDeleteStringFormat (format=0x1c475c10) returned 0x0 [0140.488] GetFocus () returned 0x0 [0140.488] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0140.488] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3400 [0140.489] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0140.489] CoTaskMemFree (pv=0x1f2f3400) [0140.489] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x43d5b0) returned 0x0 [0140.489] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0140.489] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.489] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0140.489] GdipCreateRegion (region=0x43d080) returned 0x0 [0140.489] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0140.489] GdipCreateMatrix (matrix=0x43d080) returned 0x0 [0140.489] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471730) returned 0x0 [0140.489] GdipIsMatrixIdentity (matrix=0x1c471730, result=0x43d0e0) returned 0x0 [0140.489] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c590 [0140.489] GdipGetMatrixElements (matrix=0x1c471730, matrixOut=0x1f32c590) returned 0x0 [0140.489] LocalFree (hMem=0x1f32c590) returned 0x0 [0140.489] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c390 [0140.489] GdipGetMatrixElements (matrix=0x1c471730, matrixOut=0x1f32c390) returned 0x0 [0140.489] LocalFree (hMem=0x1f32c390) returned 0x0 [0140.490] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.490] GdipDeleteMatrix (matrix=0x1c471730) returned 0x0 [0140.490] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d130) returned 0x0 [0140.490] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d0f0) returned 0x0 [0140.490] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43d0f0) returned 0x0 [0140.490] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.490] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0140.490] GdipGetDC (graphics=0x1c46d570, hdc=0x43d160) returned 0x0 [0140.490] GetCurrentObject (hdc=0x2b010a3d, type=0x1) returned 0x1b00017 [0140.490] GetCurrentObject (hdc=0x2b010a3d, type=0x2) returned 0x1900010 [0140.490] GetCurrentObject (hdc=0x2b010a3d, type=0x7) returned 0x2905055a [0140.490] GetCurrentObject (hdc=0x2b010a3d, type=0x6) returned 0x18a0048 [0140.490] SaveDC (hdc=0x2b010a3d) returned 1 [0140.490] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x720405d8 [0140.490] GetClipRgn (hdc=0x2b010a3d, hrgn=0x720405d8) returned 0 [0140.490] SelectClipRgn (hdc=0x2b010a3d, hrgn=0x780406cc) returned 2 [0140.490] DeleteObject (ho=0x720405d8) returned 1 [0140.490] DeleteObject (ho=0x780406cc) returned 1 [0140.490] OffsetViewportOrgEx (in: hdc=0x2b010a3d, x=0, y=0, lppt=0x25cf668 | out: lppt=0x25cf668) returned 1 [0140.491] GetROP2 (hdc=0x2b010a3d) returned 13 [0140.491] GetBkMode (hdc=0x2b010a3d) returned 2 [0140.491] SetBkMode (hdc=0x2b010a3d, mode=1) returned 2 [0140.491] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0xffffffffc13009ca [0140.491] SelectObject (hdc=0x2b010a3d, h=0xffffffffc13009ca) returned 0x1b00017 [0140.491] MoveToEx (in: hdc=0x2b010a3d, x=123, y=1, lppt=0x25cf6d0 | out: lppt=0x25cf6d0) returned 1 [0140.491] LineTo (hdc=0x2b010a3d, x=1, y=1) returned 1 [0140.491] SetBkMode (hdc=0x2b010a3d, mode=2) returned 1 [0140.491] MoveToEx (in: hdc=0x2b010a3d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0140.491] GetROP2 (hdc=0x2b010a3d) returned 13 [0140.491] GetBkMode (hdc=0x2b010a3d) returned 2 [0140.491] SetBkMode (hdc=0x2b010a3d, mode=1) returned 2 [0140.491] SelectObject (hdc=0x2b010a3d, h=0xffffffffc13009ca) returned 0xffffffffc13009ca [0140.491] MoveToEx (in: hdc=0x2b010a3d, x=1, y=1, lppt=0x25cf6e8 | out: lppt=0x25cf6e8) returned 1 [0140.491] LineTo (hdc=0x2b010a3d, x=1, y=34) returned 1 [0140.491] SetBkMode (hdc=0x2b010a3d, mode=2) returned 1 [0140.491] MoveToEx (in: hdc=0x2b010a3d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0140.491] SelectObject (hdc=0x2b010a3d, h=0x1b00017) returned 0xffffffffc13009ca [0140.491] DeleteObject (ho=0xffffffffc13009ca) returned 1 [0140.491] GetROP2 (hdc=0x2b010a3d) returned 13 [0140.491] GetBkMode (hdc=0x2b010a3d) returned 2 [0140.491] SetBkMode (hdc=0x2b010a3d, mode=1) returned 2 [0140.491] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xffffffffca3009c6 [0140.491] SelectObject (hdc=0x2b010a3d, h=0xffffffffca3009c6) returned 0x1b00017 [0140.492] MoveToEx (in: hdc=0x2b010a3d, x=1, y=34, lppt=0x25cf750 | out: lppt=0x25cf750) returned 1 [0140.492] LineTo (hdc=0x2b010a3d, x=123, y=34) returned 1 [0140.492] SetBkMode (hdc=0x2b010a3d, mode=2) returned 1 [0140.492] MoveToEx (in: hdc=0x2b010a3d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0140.492] GetROP2 (hdc=0x2b010a3d) returned 13 [0140.492] GetBkMode (hdc=0x2b010a3d) returned 2 [0140.492] SetBkMode (hdc=0x2b010a3d, mode=1) returned 2 [0140.492] SelectObject (hdc=0x2b010a3d, h=0xffffffffca3009c6) returned 0xffffffffca3009c6 [0140.492] MoveToEx (in: hdc=0x2b010a3d, x=123, y=34, lppt=0x25cf768 | out: lppt=0x25cf768) returned 1 [0140.492] LineTo (hdc=0x2b010a3d, x=123, y=0) returned 1 [0140.492] SetBkMode (hdc=0x2b010a3d, mode=2) returned 1 [0140.492] MoveToEx (in: hdc=0x2b010a3d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0140.492] SelectObject (hdc=0x2b010a3d, h=0x1b00017) returned 0xffffffffca3009c6 [0140.492] DeleteObject (ho=0xffffffffca3009c6) returned 1 [0140.492] GetROP2 (hdc=0x2b010a3d) returned 13 [0140.492] GetBkMode (hdc=0x2b010a3d) returned 2 [0140.492] SetBkMode (hdc=0x2b010a3d, mode=1) returned 2 [0140.492] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xffffffffc23009ca [0140.492] SelectObject (hdc=0x2b010a3d, h=0xffffffffc23009ca) returned 0x1b00017 [0140.492] MoveToEx (in: hdc=0x2b010a3d, x=122, y=2, lppt=0x25cf7d0 | out: lppt=0x25cf7d0) returned 1 [0140.492] LineTo (hdc=0x2b010a3d, x=2, y=2) returned 1 [0140.492] SetBkMode (hdc=0x2b010a3d, mode=2) returned 1 [0140.492] MoveToEx (in: hdc=0x2b010a3d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0140.492] GetROP2 (hdc=0x2b010a3d) returned 13 [0140.492] GetBkMode (hdc=0x2b010a3d) returned 2 [0140.493] SetBkMode (hdc=0x2b010a3d, mode=1) returned 2 [0140.493] SelectObject (hdc=0x2b010a3d, h=0xffffffffc23009ca) returned 0xffffffffc23009ca [0140.493] MoveToEx (in: hdc=0x2b010a3d, x=2, y=2, lppt=0x25cf7e8 | out: lppt=0x25cf7e8) returned 1 [0140.493] LineTo (hdc=0x2b010a3d, x=2, y=33) returned 1 [0140.493] SetBkMode (hdc=0x2b010a3d, mode=2) returned 1 [0140.493] MoveToEx (in: hdc=0x2b010a3d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0140.493] SelectObject (hdc=0x2b010a3d, h=0x1b00017) returned 0xffffffffc23009ca [0140.493] DeleteObject (ho=0xffffffffc23009ca) returned 1 [0140.493] GetROP2 (hdc=0x2b010a3d) returned 13 [0140.493] GetBkMode (hdc=0x2b010a3d) returned 2 [0140.493] SetBkMode (hdc=0x2b010a3d, mode=1) returned 2 [0140.493] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xffffffffcb3009c6 [0140.493] SelectObject (hdc=0x2b010a3d, h=0xffffffffcb3009c6) returned 0x1b00017 [0140.493] MoveToEx (in: hdc=0x2b010a3d, x=2, y=33, lppt=0x25cf850 | out: lppt=0x25cf850) returned 1 [0140.493] LineTo (hdc=0x2b010a3d, x=122, y=33) returned 1 [0140.493] SetBkMode (hdc=0x2b010a3d, mode=2) returned 1 [0140.493] MoveToEx (in: hdc=0x2b010a3d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0140.493] GetROP2 (hdc=0x2b010a3d) returned 13 [0140.493] GetBkMode (hdc=0x2b010a3d) returned 2 [0140.493] SetBkMode (hdc=0x2b010a3d, mode=1) returned 2 [0140.493] SelectObject (hdc=0x2b010a3d, h=0xffffffffcb3009c6) returned 0xffffffffcb3009c6 [0140.493] MoveToEx (in: hdc=0x2b010a3d, x=122, y=33, lppt=0x25cf868 | out: lppt=0x25cf868) returned 1 [0140.493] LineTo (hdc=0x2b010a3d, x=122, y=1) returned 1 [0140.493] SetBkMode (hdc=0x2b010a3d, mode=2) returned 1 [0140.493] MoveToEx (in: hdc=0x2b010a3d, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0140.494] SelectObject (hdc=0x2b010a3d, h=0x1b00017) returned 0xffffffffcb3009c6 [0140.494] DeleteObject (ho=0xffffffffcb3009c6) returned 1 [0140.494] RestoreDC (hdc=0x2b010a3d, nSavedDC=-1) returned 1 [0140.494] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.494] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b010a3d) returned 0x0 [0140.494] GdipGetDC (graphics=0x1c46d570, hdc=0x43d8e0) returned 0x0 [0140.494] BitBlt (hdc=0x1d010914, x=0, y=0, cx=125, cy=36, hdcSrc=0x2b010a3d, x1=0, y1=0, rop=0xcc0020) returned 1 [0140.494] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.494] GdipReleaseDC (graphics=0x1c46d570, hdc=0x2b010a3d) returned 0x0 [0140.494] SelectPalette (hdc=0x1d010914, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0140.494] SelectObject (hdc=0x2b010a3d, h=0x185000f) returned 0x2905055a [0140.494] DeleteDC (hdc=0x2b010a3d) returned 1 [0140.494] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0140.494] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0140.494] EndPaint (hWnd=0xa01fa, lpPaint=0x43d9e8) returned 1 [0140.494] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0140.494] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0140.494] WaitMessage () returned 1 [0140.795] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0140.795] IsWindowUnicode (hWnd=0x40174) returned 1 [0140.795] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0140.795] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0140.795] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0140.795] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0140.795] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0140.795] WaitMessage () returned 1 [0165.902] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0165.903] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43e410) returned 0x0 [0165.903] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43e410) returned 0x0 [0165.904] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43de40 | out: lpwndpl=0x43de40) returned 1 [0165.904] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x47, wParam=0x0, lParam=0x43e410) returned 0x0 [0165.904] GetClientRect (in: hWnd=0x8016e, lpRect=0x43dbe0 | out: lpRect=0x43dbe0) returned 1 [0165.904] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43dbe0 | out: lpRect=0x43dbe0) returned 1 [0165.905] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x47, wParam=0x0, lParam=0x43e410) returned 0x0 [0165.905] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x1c, wParam=0x1, lParam=0xa1c) returned 0x0 [0165.906] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x1c, wParam=0x1, lParam=0xa1c) returned 0x0 [0165.906] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x1c, wParam=0x1, lParam=0xa1c) returned 0x0 [0165.906] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0165.907] GetFocus () returned 0x0 [0165.907] SetFocus (hWnd=0xa01fa) returned 0x0 [0165.908] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0165.909] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0165.910] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0165.910] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0165.910] GetStockObject (i=5) returned 0x1900015 [0165.910] GetDlgItem (hDlg=0x8016e, nIDDlgItem=655866) returned 0xa01fa [0165.910] SendMessageW (hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43d0c0) returned 0x0 [0165.910] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43d0c0) returned 0x0 [0165.910] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0165.911] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0165.911] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0165.911] GetKeyState (nVirtKey=16) returned 0 [0165.911] GetKeyState (nVirtKey=17) returned 0 [0165.911] GetKeyState (nVirtKey=18) returned -127 [0165.911] TranslateMessage (lpMsg=0x43e5e0) returned 1 [0165.911] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0165.911] GetKeyState (nVirtKey=16) returned 0 [0165.911] GetKeyState (nVirtKey=17) returned 0 [0165.911] GetKeyState (nVirtKey=18) returned -127 [0165.911] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x105, wParam=0x1b, lParam=0xe0010001) returned 0x0 [0165.911] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0165.911] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0165.911] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0165.912] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0165.912] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0165.912] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x43d9d8 | out: lpPaint=0x43d9d8) returned 0x35010a3b [0165.912] SelectPalette (hdc=0x35010a3b, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0165.912] CreateCompatibleDC (hdc=0x35010a3b) returned 0x4c010789 [0165.912] SelectObject (hdc=0x4c010789, h=0x2905055a) returned 0x185000f [0165.912] GdipCreateFromHDC (hdc=0x4c010789, graphics=0x43d7e0) returned 0x0 [0165.912] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0165.912] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0165.912] GdipCreateMatrix (matrix=0x43d910) returned 0x0 [0165.912] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471770) returned 0x0 [0165.912] GdipIsMatrixIdentity (matrix=0x1c471770, result=0x43d970) returned 0x0 [0165.912] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c890 [0165.913] GdipGetMatrixElements (matrix=0x1c471770, matrixOut=0x1f32c890) returned 0x0 [0165.913] LocalFree (hMem=0x1f32c890) returned 0x0 [0165.913] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.913] GdipDeleteMatrix (matrix=0x1c471770) returned 0x0 [0165.913] GdipCreateRegion (region=0x43d910) returned 0x0 [0165.913] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0165.913] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d940) returned 0x0 [0165.913] GdipSaveGraphics (graphics=0x1c46d570, state=0x43da10) returned 0x0 [0165.913] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd520dbd) returned 0x0 [0165.913] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.913] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0165.913] GdipGetDC (graphics=0x1c46d570, hdc=0x43ce00) returned 0x0 [0165.913] GetCurrentObject (hdc=0x4c010789, type=0x1) returned 0x1b00017 [0165.913] GetCurrentObject (hdc=0x4c010789, type=0x2) returned 0x1900010 [0165.913] GetCurrentObject (hdc=0x4c010789, type=0x7) returned 0x2905055a [0165.913] GetCurrentObject (hdc=0x4c010789, type=0x6) returned 0x18a0048 [0165.913] SaveDC (hdc=0x4c010789) returned 1 [0165.914] GetNearestColor (hdc=0x4c010789, color=0xf0f0f0) returned 0xf0f0f0 [0165.914] GetNearestColor (hdc=0x4c010789, color=0xa0a0a0) returned 0xa0a0a0 [0165.914] GetNearestColor (hdc=0x4c010789, color=0x696969) returned 0x696969 [0165.914] GetNearestColor (hdc=0x4c010789, color=0xa0a0a0) returned 0xa0a0a0 [0165.914] GetNearestColor (hdc=0x4c010789, color=0x0) returned 0x0 [0165.914] GetNearestColor (hdc=0x4c010789, color=0xffffff) returned 0xffffff [0165.914] GetNearestColor (hdc=0x4c010789, color=0xe5e5e5) returned 0xe5e5e5 [0165.914] GetNearestColor (hdc=0x4c010789, color=0xd8d8d8) returned 0xd8d8d8 [0165.914] GetNearestColor (hdc=0x4c010789, color=0x0) returned 0x0 [0165.914] RestoreDC (hdc=0x4c010789, nSavedDC=-1) returned 1 [0165.914] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.914] GdipReleaseDC (graphics=0x1c46d570, hdc=0x4c010789) returned 0x0 [0165.915] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0165.915] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2e00 [0165.915] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0165.915] CoTaskMemFree (pv=0x1f2f2e00) [0165.915] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d4f0) returned 0x0 [0165.915] GdipSetStringFormatAlign (format=0x1c476620, align=0x1) returned 0x0 [0165.915] GdipSetStringFormatLineAlign (format=0x1c476620, align=0x1) returned 0x0 [0165.916] GdipSetStringFormatHotkeyPrefix (format=0x1c476620, hotkeyPrefix=1) returned 0x0 [0165.916] GdipGetStringFormatFlags (format=0x1c476620, flags=0x43d520) returned 0x0 [0165.916] GdipGetStringFormatTrimming (format=0x1c476620, trimming=0x43d520) returned 0x0 [0165.916] GdipGetStringFormatHotkeyPrefix (format=0x1c476620, hotkeyPrefix=0x43d520) returned 0x0 [0165.916] GdipGetFontSize (font=0x1c476620, size=0x43d520) returned 0x0 [0165.916] GdipGetFontStyle (font=0x1c476620, style=0x43d520) returned 0x0 [0165.916] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.916] GdipDeleteStringFormat (format=0x1c476620) returned 0x0 [0165.916] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0165.916] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3320 [0165.917] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0165.917] CoTaskMemFree (pv=0x1f2f3320) [0165.917] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43d1b0) returned 0x0 [0165.917] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d1c0) returned 0x0 [0165.917] GdipSetStringFormatFlags (format=0x1c475f20, flags=0) returned 0x0 [0165.917] GdipSetStringFormatTrimming (format=0x1c475f20, trimming=0x1) returned 0x0 [0165.917] GdipSetStringFormatHotkeyPrefix (format=0x1c475f20, hotkeyPrefix=1) returned 0x0 [0165.917] GdipSetStringFormatAlign (format=0x1c475f20, align=0x1) returned 0x0 [0165.917] GdipSetStringFormatLineAlign (format=0x1c475f20, align=0x1) returned 0x0 [0165.917] GdipMeasureString (graphics=0x1c4701b0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43d0d8, stringFormat=0x1c475f20, boundingBox=0x43d0c8, codepointsFitted=0x43d0c4, linesFilled=0x43d0c0) returned 0x0 [0165.917] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.917] GdipDeleteStringFormat (format=0x1c475f20) returned 0x0 [0165.917] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.917] GdipDeleteGraphics (graphics=0x1c4701b0) returned 0x0 [0165.918] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0165.918] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3200 [0165.918] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0165.918] CoTaskMemFree (pv=0x1f2f3200) [0165.918] GdipCreateRegion (region=0x43d120) returned 0x0 [0165.918] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0165.918] GdipCreateMatrix (matrix=0x43d120) returned 0x0 [0165.919] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471530) returned 0x0 [0165.919] GdipIsMatrixIdentity (matrix=0x1c471530, result=0x43d180) returned 0x0 [0165.919] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c0d0 [0165.919] GdipGetMatrixElements (matrix=0x1c471530, matrixOut=0x1f32c0d0) returned 0x0 [0165.919] LocalFree (hMem=0x1f32c0d0) returned 0x0 [0165.919] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c890 [0165.919] GdipGetMatrixElements (matrix=0x1c471530, matrixOut=0x1f32c890) returned 0x0 [0165.919] LocalFree (hMem=0x1f32c890) returned 0x0 [0165.919] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.930] GdipDeleteMatrix (matrix=0x1c471530) returned 0x0 [0165.930] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d1d0) returned 0x0 [0165.930] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d190) returned 0x0 [0165.930] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43d190) returned 0x0 [0165.930] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.930] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0165.930] GdipGetDC (graphics=0x1c46d570, hdc=0x43d200) returned 0x0 [0165.930] GetCurrentObject (hdc=0x4c010789, type=0x1) returned 0x1b00017 [0165.930] GetCurrentObject (hdc=0x4c010789, type=0x2) returned 0x1900010 [0165.930] GetCurrentObject (hdc=0x4c010789, type=0x7) returned 0x2905055a [0165.930] GetCurrentObject (hdc=0x4c010789, type=0x6) returned 0x18a0048 [0165.930] SaveDC (hdc=0x4c010789) returned 1 [0165.930] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x790406cc [0165.931] GetClipRgn (hdc=0x4c010789, hrgn=0x790406cc) returned 0 [0165.931] SelectClipRgn (hdc=0x4c010789, hrgn=0x730405d8) returned 2 [0165.931] DeleteObject (ho=0x790406cc) returned 1 [0165.931] DeleteObject (ho=0x730405d8) returned 1 [0165.931] OffsetViewportOrgEx (in: hdc=0x4c010789, x=0, y=0, lppt=0x25d05a0 | out: lppt=0x25d05a0) returned 1 [0165.931] GetNearestColor (hdc=0x4c010789, color=0xf0f0f0) returned 0xf0f0f0 [0165.931] CreateSolidBrush (color=0xf0f0f0) returned 0x2e10075d [0165.931] FillRect (hDC=0x4c010789, lprc=0x43d1d0, hbr=0x2e10075d) returned 1 [0165.931] DeleteObject (ho=0x2e10075d) returned 1 [0165.931] RestoreDC (hdc=0x4c010789, nSavedDC=-1) returned 1 [0165.931] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.931] GdipReleaseDC (graphics=0x1c46d570, hdc=0x4c010789) returned 0x0 [0165.932] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0165.932] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2e80 [0165.932] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0165.932] CoTaskMemFree (pv=0x1f2f2e80) [0165.932] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d250) returned 0x0 [0165.932] GdipSetStringFormatAlign (format=0x1c475c10, align=0x1) returned 0x0 [0165.932] GdipSetStringFormatLineAlign (format=0x1c475c10, align=0x1) returned 0x0 [0165.932] GdipSetStringFormatHotkeyPrefix (format=0x1c475c10, hotkeyPrefix=1) returned 0x0 [0165.932] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x43d2c0) returned 0x0 [0165.933] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43d1d0, stringFormat=0x1c475c10, brush=0x1c46cce0) returned 0x0 [0165.933] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.933] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0165.933] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.933] GdipDeleteStringFormat (format=0x1c475c10) returned 0x0 [0165.933] GetFocus () returned 0xa01fa [0165.933] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0165.933] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2f80 [0165.934] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0165.934] CoTaskMemFree (pv=0x1f2f2f80) [0165.934] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x43d5b0) returned 0x0 [0165.934] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0165.934] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.934] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0165.934] GdipCreateRegion (region=0x43d080) returned 0x0 [0165.934] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0165.934] GdipCreateMatrix (matrix=0x43d080) returned 0x0 [0165.934] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4710f0) returned 0x0 [0165.934] GdipIsMatrixIdentity (matrix=0x1c4710f0, result=0x43d0e0) returned 0x0 [0165.934] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c750 [0165.934] GdipGetMatrixElements (matrix=0x1c4710f0, matrixOut=0x1f32c750) returned 0x0 [0165.934] LocalFree (hMem=0x1f32c750) returned 0x0 [0165.934] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32cbd0 [0165.934] GdipGetMatrixElements (matrix=0x1c4710f0, matrixOut=0x1f32cbd0) returned 0x0 [0165.935] LocalFree (hMem=0x1f32cbd0) returned 0x0 [0165.935] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.935] GdipDeleteMatrix (matrix=0x1c4710f0) returned 0x0 [0165.935] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d130) returned 0x0 [0165.935] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d0f0) returned 0x0 [0165.935] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43d0f0) returned 0x0 [0165.935] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.935] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0165.935] GdipGetDC (graphics=0x1c46d570, hdc=0x43d160) returned 0x0 [0165.935] GetCurrentObject (hdc=0x4c010789, type=0x1) returned 0x1b00017 [0165.935] GetCurrentObject (hdc=0x4c010789, type=0x2) returned 0x1900010 [0165.935] GetCurrentObject (hdc=0x4c010789, type=0x7) returned 0x2905055a [0165.935] GetCurrentObject (hdc=0x4c010789, type=0x6) returned 0x18a0048 [0165.936] SaveDC (hdc=0x4c010789) returned 1 [0165.936] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x740405d8 [0165.936] GetClipRgn (hdc=0x4c010789, hrgn=0x740405d8) returned 0 [0165.936] SelectClipRgn (hdc=0x4c010789, hrgn=0x7a0406cc) returned 2 [0165.936] DeleteObject (ho=0x740405d8) returned 1 [0165.936] DeleteObject (ho=0x7a0406cc) returned 1 [0165.936] OffsetViewportOrgEx (in: hdc=0x4c010789, x=0, y=0, lppt=0x25d0b40 | out: lppt=0x25d0b40) returned 1 [0165.936] GetROP2 (hdc=0x4c010789) returned 13 [0165.936] GetBkMode (hdc=0x4c010789) returned 2 [0165.936] SetBkMode (hdc=0x4c010789, mode=1) returned 2 [0165.936] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x74300623 [0165.936] SelectObject (hdc=0x4c010789, h=0x74300623) returned 0x1b00017 [0165.936] MoveToEx (in: hdc=0x4c010789, x=123, y=1, lppt=0x25d0ba8 | out: lppt=0x25d0ba8) returned 1 [0165.936] LineTo (hdc=0x4c010789, x=1, y=1) returned 1 [0165.936] SetBkMode (hdc=0x4c010789, mode=2) returned 1 [0165.936] MoveToEx (in: hdc=0x4c010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0165.936] GetROP2 (hdc=0x4c010789) returned 13 [0165.936] GetBkMode (hdc=0x4c010789) returned 2 [0165.937] SetBkMode (hdc=0x4c010789, mode=1) returned 2 [0165.937] SelectObject (hdc=0x4c010789, h=0x74300623) returned 0x74300623 [0165.937] MoveToEx (in: hdc=0x4c010789, x=1, y=1, lppt=0x25d0bc0 | out: lppt=0x25d0bc0) returned 1 [0165.937] LineTo (hdc=0x4c010789, x=1, y=34) returned 1 [0165.937] SetBkMode (hdc=0x4c010789, mode=2) returned 1 [0165.937] MoveToEx (in: hdc=0x4c010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0165.937] SelectObject (hdc=0x4c010789, h=0x1b00017) returned 0x74300623 [0165.937] DeleteObject (ho=0x74300623) returned 1 [0165.937] GetROP2 (hdc=0x4c010789) returned 13 [0165.937] GetBkMode (hdc=0x4c010789) returned 2 [0165.937] SetBkMode (hdc=0x4c010789, mode=1) returned 2 [0165.937] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x73300953 [0165.937] SelectObject (hdc=0x4c010789, h=0x73300953) returned 0x1b00017 [0165.937] MoveToEx (in: hdc=0x4c010789, x=1, y=34, lppt=0x25d0c28 | out: lppt=0x25d0c28) returned 1 [0165.937] LineTo (hdc=0x4c010789, x=123, y=34) returned 1 [0165.937] SetBkMode (hdc=0x4c010789, mode=2) returned 1 [0165.937] MoveToEx (in: hdc=0x4c010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0165.937] GetROP2 (hdc=0x4c010789) returned 13 [0165.938] GetBkMode (hdc=0x4c010789) returned 2 [0165.938] SetBkMode (hdc=0x4c010789, mode=1) returned 2 [0165.938] SelectObject (hdc=0x4c010789, h=0x73300953) returned 0x73300953 [0165.938] MoveToEx (in: hdc=0x4c010789, x=123, y=34, lppt=0x25d0c40 | out: lppt=0x25d0c40) returned 1 [0165.938] LineTo (hdc=0x4c010789, x=123, y=0) returned 1 [0165.938] SetBkMode (hdc=0x4c010789, mode=2) returned 1 [0165.938] MoveToEx (in: hdc=0x4c010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0165.938] SelectObject (hdc=0x4c010789, h=0x1b00017) returned 0x73300953 [0165.938] DeleteObject (ho=0x73300953) returned 1 [0165.938] GetROP2 (hdc=0x4c010789) returned 13 [0165.938] GetBkMode (hdc=0x4c010789) returned 2 [0165.938] SetBkMode (hdc=0x4c010789, mode=1) returned 2 [0165.938] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x75300623 [0165.938] SelectObject (hdc=0x4c010789, h=0x75300623) returned 0x1b00017 [0165.938] MoveToEx (in: hdc=0x4c010789, x=122, y=2, lppt=0x25d0ca8 | out: lppt=0x25d0ca8) returned 1 [0165.938] LineTo (hdc=0x4c010789, x=2, y=2) returned 1 [0165.938] SetBkMode (hdc=0x4c010789, mode=2) returned 1 [0165.938] MoveToEx (in: hdc=0x4c010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0165.938] GetROP2 (hdc=0x4c010789) returned 13 [0165.938] GetBkMode (hdc=0x4c010789) returned 2 [0165.939] SetBkMode (hdc=0x4c010789, mode=1) returned 2 [0165.939] SelectObject (hdc=0x4c010789, h=0x75300623) returned 0x75300623 [0165.939] MoveToEx (in: hdc=0x4c010789, x=2, y=2, lppt=0x25d0cc0 | out: lppt=0x25d0cc0) returned 1 [0165.939] LineTo (hdc=0x4c010789, x=2, y=33) returned 1 [0165.939] SetBkMode (hdc=0x4c010789, mode=2) returned 1 [0165.939] MoveToEx (in: hdc=0x4c010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0165.939] SelectObject (hdc=0x4c010789, h=0x1b00017) returned 0x75300623 [0165.939] DeleteObject (ho=0x75300623) returned 1 [0165.939] GetROP2 (hdc=0x4c010789) returned 13 [0165.939] GetBkMode (hdc=0x4c010789) returned 2 [0165.939] SetBkMode (hdc=0x4c010789, mode=1) returned 2 [0165.939] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x74300953 [0165.939] SelectObject (hdc=0x4c010789, h=0x74300953) returned 0x1b00017 [0165.939] MoveToEx (in: hdc=0x4c010789, x=2, y=33, lppt=0x25d0d28 | out: lppt=0x25d0d28) returned 1 [0165.939] LineTo (hdc=0x4c010789, x=122, y=33) returned 1 [0165.939] SetBkMode (hdc=0x4c010789, mode=2) returned 1 [0165.939] MoveToEx (in: hdc=0x4c010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0165.939] GetROP2 (hdc=0x4c010789) returned 13 [0165.939] GetBkMode (hdc=0x4c010789) returned 2 [0165.940] SetBkMode (hdc=0x4c010789, mode=1) returned 2 [0165.940] SelectObject (hdc=0x4c010789, h=0x74300953) returned 0x74300953 [0165.940] MoveToEx (in: hdc=0x4c010789, x=122, y=33, lppt=0x25d0d40 | out: lppt=0x25d0d40) returned 1 [0165.940] LineTo (hdc=0x4c010789, x=122, y=1) returned 1 [0165.940] SetBkMode (hdc=0x4c010789, mode=2) returned 1 [0165.940] MoveToEx (in: hdc=0x4c010789, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0165.940] SelectObject (hdc=0x4c010789, h=0x1b00017) returned 0x74300953 [0165.940] DeleteObject (ho=0x74300953) returned 1 [0165.940] RestoreDC (hdc=0x4c010789, nSavedDC=-1) returned 1 [0165.940] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.940] GdipReleaseDC (graphics=0x1c46d570, hdc=0x4c010789) returned 0x0 [0165.940] GdipGetDC (graphics=0x1c46d570, hdc=0x43d8e0) returned 0x0 [0165.940] BitBlt (hdc=0x35010a3b, x=0, y=0, cx=125, cy=36, hdcSrc=0x4c010789, x1=0, y1=0, rop=0xcc0020) returned 1 [0165.941] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.941] GdipReleaseDC (graphics=0x1c46d570, hdc=0x4c010789) returned 0x0 [0165.941] SelectPalette (hdc=0x35010a3b, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0165.941] SelectObject (hdc=0x4c010789, h=0x185000f) returned 0x2905055a [0165.941] DeleteDC (hdc=0x4c010789) returned 1 [0165.941] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0165.941] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0165.941] EndPaint (hWnd=0xa01fa, lpPaint=0x43d9e8) returned 1 [0165.941] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0165.941] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0165.941] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0165.942] GetKeyState (nVirtKey=16) returned 0 [0165.942] GetKeyState (nVirtKey=17) returned 0 [0165.942] GetKeyState (nVirtKey=18) returned 1 [0165.942] TranslateMessage (lpMsg=0x43e5e0) returned 1 [0165.942] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0165.942] GetKeyState (nVirtKey=16) returned 0 [0165.942] GetKeyState (nVirtKey=17) returned 0 [0165.942] GetKeyState (nVirtKey=18) returned 1 [0165.942] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x101, wParam=0x12, lParam=0xc0380001) returned 0x0 [0165.942] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0165.942] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0165.942] WaitMessage () returned 1 [0166.217] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0166.217] IsWindowUnicode (hWnd=0x40174) returned 1 [0166.217] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0166.217] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0166.217] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0166.218] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0166.218] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0166.218] WaitMessage () returned 1 [0170.984] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0170.984] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0170.984] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0170.984] GetKeyState (nVirtKey=16) returned 0 [0170.984] GetKeyState (nVirtKey=17) returned 0 [0170.984] GetKeyState (nVirtKey=18) returned -128 [0170.984] SendMessageW (hWnd=0xa01fa, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x1 [0170.984] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x1 [0170.984] GetKeyState (nVirtKey=16) returned 0 [0170.984] GetKeyState (nVirtKey=17) returned 0 [0170.984] GetKeyState (nVirtKey=18) returned -128 [0170.985] TranslateMessage (lpMsg=0x43e5e0) returned 1 [0170.985] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0170.985] GetKeyState (nVirtKey=16) returned 0 [0170.985] GetKeyState (nVirtKey=17) returned 0 [0170.985] GetKeyState (nVirtKey=18) returned -128 [0170.985] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x104, wParam=0x12, lParam=0x20380001) returned 0x0 [0170.986] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0170.986] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0170.986] WaitMessage () returned 1 [0170.994] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0170.994] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0171.035] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0171.035] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43e410) returned 0x0 [0171.036] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43de40 | out: lpwndpl=0x43de40) returned 1 [0171.036] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x47, wParam=0x0, lParam=0x43e410) returned 0x0 [0171.036] GetClientRect (in: hWnd=0x8016e, lpRect=0x43dbe0 | out: lpRect=0x43dbe0) returned 1 [0171.036] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43dbe0 | out: lpRect=0x43dbe0) returned 1 [0171.037] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x47, wParam=0x0, lParam=0x43e410) returned 0x0 [0171.037] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0171.039] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x1c, wParam=0x0, lParam=0x7f8) returned 0x0 [0171.039] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x1c, wParam=0x0, lParam=0x7f8) returned 0x0 [0171.039] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x1c, wParam=0x0, lParam=0x7f8) returned 0x0 [0171.040] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0171.040] GetStockObject (i=5) returned 0x1900015 [0171.040] GetDlgItem (hDlg=0x8016e, nIDDlgItem=655866) returned 0xa01fa [0171.040] SendMessageW (hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43d810) returned 0x0 [0171.040] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43d810) returned 0x0 [0171.040] GetCapture () returned 0x0 [0171.040] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0171.041] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0171.041] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0171.041] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0171.041] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0171.041] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0171.041] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0171.041] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0171.041] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x43d9d8 | out: lpPaint=0x43d9d8) returned 0x35010a3b [0171.041] SelectPalette (hdc=0x35010a3b, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0171.042] CreateCompatibleDC (hdc=0x35010a3b) returned 0xffffffffd1010997 [0171.042] SelectObject (hdc=0xffffffffd1010997, h=0x2905055a) returned 0x185000f [0171.042] GdipCreateFromHDC (hdc=0xffffffffd1010997, graphics=0x43d7e0) returned 0x0 [0171.042] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0171.042] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0171.042] GdipCreateMatrix (matrix=0x43d910) returned 0x0 [0171.042] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4715f0) returned 0x0 [0171.042] GdipIsMatrixIdentity (matrix=0x1c4715f0, result=0x43d970) returned 0x0 [0171.042] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32ca90 [0171.042] GdipGetMatrixElements (matrix=0x1c4715f0, matrixOut=0x1f32ca90) returned 0x0 [0171.042] LocalFree (hMem=0x1f32ca90) returned 0x0 [0171.042] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.042] GdipDeleteMatrix (matrix=0x1c4715f0) returned 0x0 [0171.042] GdipCreateRegion (region=0x43d910) returned 0x0 [0171.042] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0171.042] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d940) returned 0x0 [0171.042] GdipSaveGraphics (graphics=0x1c46d570, state=0x43da10) returned 0x0 [0171.043] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd4f0dbd) returned 0x0 [0171.043] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.043] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0171.043] GdipGetDC (graphics=0x1c46d570, hdc=0x43ce00) returned 0x0 [0171.043] GetCurrentObject (hdc=0xffffffffd1010997, type=0x1) returned 0x1b00017 [0171.043] GetCurrentObject (hdc=0xffffffffd1010997, type=0x2) returned 0x1900010 [0171.043] GetCurrentObject (hdc=0xffffffffd1010997, type=0x7) returned 0x2905055a [0171.043] GetCurrentObject (hdc=0xffffffffd1010997, type=0x6) returned 0x18a0048 [0171.043] SaveDC (hdc=0xffffffffd1010997) returned 1 [0171.043] GetNearestColor (hdc=0xffffffffd1010997, color=0xf0f0f0) returned 0xf0f0f0 [0171.043] GetNearestColor (hdc=0xffffffffd1010997, color=0xa0a0a0) returned 0xa0a0a0 [0171.043] GetNearestColor (hdc=0xffffffffd1010997, color=0x696969) returned 0x696969 [0171.043] GetNearestColor (hdc=0xffffffffd1010997, color=0xa0a0a0) returned 0xa0a0a0 [0171.043] GetNearestColor (hdc=0xffffffffd1010997, color=0x0) returned 0x0 [0171.043] GetNearestColor (hdc=0xffffffffd1010997, color=0xffffff) returned 0xffffff [0171.043] GetNearestColor (hdc=0xffffffffd1010997, color=0xe5e5e5) returned 0xe5e5e5 [0171.043] GetNearestColor (hdc=0xffffffffd1010997, color=0xd8d8d8) returned 0xd8d8d8 [0171.044] GetNearestColor (hdc=0xffffffffd1010997, color=0x0) returned 0x0 [0171.044] RestoreDC (hdc=0xffffffffd1010997, nSavedDC=-1) returned 1 [0171.044] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.044] GdipReleaseDC (graphics=0x1c46d570, hdc=0xffffffffd1010997) returned 0x0 [0171.044] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0171.056] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3040 [0171.056] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0171.056] CoTaskMemFree (pv=0x1f2f3040) [0171.057] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d4f0) returned 0x0 [0171.057] GdipSetStringFormatAlign (format=0x1c475f90, align=0x1) returned 0x0 [0171.057] GdipSetStringFormatLineAlign (format=0x1c475f90, align=0x1) returned 0x0 [0171.057] GdipSetStringFormatHotkeyPrefix (format=0x1c475f90, hotkeyPrefix=1) returned 0x0 [0171.057] GdipGetStringFormatFlags (format=0x1c475f90, flags=0x43d520) returned 0x0 [0171.057] GdipGetStringFormatTrimming (format=0x1c475f90, trimming=0x43d520) returned 0x0 [0171.057] GdipGetStringFormatHotkeyPrefix (format=0x1c475f90, hotkeyPrefix=0x43d520) returned 0x0 [0171.057] GdipGetFontSize (font=0x1c475f90, size=0x43d520) returned 0x0 [0171.057] GdipGetFontStyle (font=0x1c475f90, style=0x43d520) returned 0x0 [0171.057] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.057] GdipDeleteStringFormat (format=0x1c475f90) returned 0x0 [0171.058] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0171.058] CoTaskMemAlloc (cb=0x13) returned 0x1f2f32c0 [0171.058] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0171.058] CoTaskMemFree (pv=0x1f2f32c0) [0171.058] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43d1b0) returned 0x0 [0171.058] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d1c0) returned 0x0 [0171.058] GdipSetStringFormatFlags (format=0x1c475a50, flags=0) returned 0x0 [0171.059] GdipSetStringFormatTrimming (format=0x1c475a50, trimming=0x1) returned 0x0 [0171.059] GdipSetStringFormatHotkeyPrefix (format=0x1c475a50, hotkeyPrefix=1) returned 0x0 [0171.059] GdipSetStringFormatAlign (format=0x1c475a50, align=0x1) returned 0x0 [0171.059] GdipSetStringFormatLineAlign (format=0x1c475a50, align=0x1) returned 0x0 [0171.059] GdipMeasureString (graphics=0x1c4701b0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43d0d8, stringFormat=0x1c475a50, boundingBox=0x43d0c8, codepointsFitted=0x43d0c4, linesFilled=0x43d0c0) returned 0x0 [0171.059] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.059] GdipDeleteStringFormat (format=0x1c475a50) returned 0x0 [0171.059] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.059] GdipDeleteGraphics (graphics=0x1c4701b0) returned 0x0 [0171.059] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0171.059] CoTaskMemAlloc (cb=0x13) returned 0x1f2f3420 [0171.060] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0171.060] CoTaskMemFree (pv=0x1f2f3420) [0171.060] GdipCreateRegion (region=0x43d120) returned 0x0 [0171.060] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0171.060] GdipCreateMatrix (matrix=0x43d120) returned 0x0 [0171.060] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471430) returned 0x0 [0171.060] GdipIsMatrixIdentity (matrix=0x1c471430, result=0x43d180) returned 0x0 [0171.060] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c9d0 [0171.060] GdipGetMatrixElements (matrix=0x1c471430, matrixOut=0x1f32c9d0) returned 0x0 [0171.060] LocalFree (hMem=0x1f32c9d0) returned 0x0 [0171.061] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c650 [0171.061] GdipGetMatrixElements (matrix=0x1c471430, matrixOut=0x1f32c650) returned 0x0 [0171.061] LocalFree (hMem=0x1f32c650) returned 0x0 [0171.061] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.061] GdipDeleteMatrix (matrix=0x1c471430) returned 0x0 [0171.061] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d1d0) returned 0x0 [0171.061] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d190) returned 0x0 [0171.061] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43d190) returned 0x0 [0171.061] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.061] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0171.061] GdipGetDC (graphics=0x1c46d570, hdc=0x43d200) returned 0x0 [0171.061] GetCurrentObject (hdc=0xffffffffd1010997, type=0x1) returned 0x1b00017 [0171.061] GetCurrentObject (hdc=0xffffffffd1010997, type=0x2) returned 0x1900010 [0171.061] GetCurrentObject (hdc=0xffffffffd1010997, type=0x7) returned 0x2905055a [0171.061] GetCurrentObject (hdc=0xffffffffd1010997, type=0x6) returned 0x18a0048 [0171.061] SaveDC (hdc=0xffffffffd1010997) returned 1 [0171.061] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7b0406cc [0171.061] GetClipRgn (hdc=0xffffffffd1010997, hrgn=0x7b0406cc) returned 0 [0171.061] SelectClipRgn (hdc=0xffffffffd1010997, hrgn=0x750405d8) returned 2 [0171.062] DeleteObject (ho=0x7b0406cc) returned 1 [0171.062] DeleteObject (ho=0x750405d8) returned 1 [0171.062] OffsetViewportOrgEx (in: hdc=0xffffffffd1010997, x=0, y=0, lppt=0x25d1be8 | out: lppt=0x25d1be8) returned 1 [0171.062] GetNearestColor (hdc=0xffffffffd1010997, color=0xf0f0f0) returned 0xf0f0f0 [0171.062] CreateSolidBrush (color=0xf0f0f0) returned 0x2f10075d [0171.062] FillRect (hDC=0xffffffffd1010997, lprc=0x43d1d0, hbr=0x2f10075d) returned 1 [0171.062] DeleteObject (ho=0x2f10075d) returned 1 [0171.062] RestoreDC (hdc=0xffffffffd1010997, nSavedDC=-1) returned 1 [0171.062] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.062] GdipReleaseDC (graphics=0x1c46d570, hdc=0xffffffffd1010997) returned 0x0 [0171.063] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0171.063] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2e00 [0171.063] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0171.063] CoTaskMemFree (pv=0x1f2f2e00) [0171.063] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d250) returned 0x0 [0171.063] GdipSetStringFormatAlign (format=0x1c4760e0, align=0x1) returned 0x0 [0171.063] GdipSetStringFormatLineAlign (format=0x1c4760e0, align=0x1) returned 0x0 [0171.063] GdipSetStringFormatHotkeyPrefix (format=0x1c4760e0, hotkeyPrefix=1) returned 0x0 [0171.064] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x43d2c0) returned 0x0 [0171.064] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43d1d0, stringFormat=0x1c4760e0, brush=0x1c46cce0) returned 0x0 [0171.064] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.064] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0171.064] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.064] GdipDeleteStringFormat (format=0x1c4760e0) returned 0x0 [0171.064] GetFocus () returned 0x0 [0171.065] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0171.065] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2dc0 [0171.065] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0171.065] CoTaskMemFree (pv=0x1f2f2dc0) [0171.065] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x43d5b0) returned 0x0 [0171.065] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0171.065] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.066] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0171.066] GdipCreateRegion (region=0x43d080) returned 0x0 [0171.066] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0171.066] GdipCreateMatrix (matrix=0x43d080) returned 0x0 [0171.066] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4711f0) returned 0x0 [0171.066] GdipIsMatrixIdentity (matrix=0x1c4711f0, result=0x43d0e0) returned 0x0 [0171.066] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32be50 [0171.066] GdipGetMatrixElements (matrix=0x1c4711f0, matrixOut=0x1f32be50) returned 0x0 [0171.066] LocalFree (hMem=0x1f32be50) returned 0x0 [0171.066] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c910 [0171.066] GdipGetMatrixElements (matrix=0x1c4711f0, matrixOut=0x1f32c910) returned 0x0 [0171.066] LocalFree (hMem=0x1f32c910) returned 0x0 [0171.066] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.066] GdipDeleteMatrix (matrix=0x1c4711f0) returned 0x0 [0171.066] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d130) returned 0x0 [0171.066] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d0f0) returned 0x0 [0171.066] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43d0f0) returned 0x0 [0171.066] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.066] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0171.067] GdipGetDC (graphics=0x1c46d570, hdc=0x43d160) returned 0x0 [0171.067] GetCurrentObject (hdc=0xffffffffd1010997, type=0x1) returned 0x1b00017 [0171.067] GetCurrentObject (hdc=0xffffffffd1010997, type=0x2) returned 0x1900010 [0171.067] GetCurrentObject (hdc=0xffffffffd1010997, type=0x7) returned 0x2905055a [0171.067] GetCurrentObject (hdc=0xffffffffd1010997, type=0x6) returned 0x18a0048 [0171.068] SaveDC (hdc=0xffffffffd1010997) returned 1 [0171.068] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x760405d8 [0171.068] GetClipRgn (hdc=0xffffffffd1010997, hrgn=0x760405d8) returned 0 [0171.068] SelectClipRgn (hdc=0xffffffffd1010997, hrgn=0x7c0406cc) returned 2 [0171.068] DeleteObject (ho=0x760405d8) returned 1 [0171.068] DeleteObject (ho=0x7c0406cc) returned 1 [0171.068] OffsetViewportOrgEx (in: hdc=0xffffffffd1010997, x=0, y=0, lppt=0x25d2188 | out: lppt=0x25d2188) returned 1 [0171.068] GetROP2 (hdc=0xffffffffd1010997) returned 13 [0171.068] GetBkMode (hdc=0xffffffffd1010997) returned 2 [0171.068] SetBkMode (hdc=0xffffffffd1010997, mode=1) returned 2 [0171.068] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0x3300853 [0171.068] SelectObject (hdc=0xffffffffd1010997, h=0x3300853) returned 0x1b00017 [0171.068] MoveToEx (in: hdc=0xffffffffd1010997, x=123, y=1, lppt=0x25d21f0 | out: lppt=0x25d21f0) returned 1 [0171.069] LineTo (hdc=0xffffffffd1010997, x=1, y=1) returned 1 [0171.069] SetBkMode (hdc=0xffffffffd1010997, mode=2) returned 1 [0171.069] MoveToEx (in: hdc=0xffffffffd1010997, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0171.069] GetROP2 (hdc=0xffffffffd1010997) returned 13 [0171.069] GetBkMode (hdc=0xffffffffd1010997) returned 2 [0171.069] SetBkMode (hdc=0xffffffffd1010997, mode=1) returned 2 [0171.069] SelectObject (hdc=0xffffffffd1010997, h=0x3300853) returned 0x3300853 [0171.069] MoveToEx (in: hdc=0xffffffffd1010997, x=1, y=1, lppt=0x25d2208 | out: lppt=0x25d2208) returned 1 [0171.069] LineTo (hdc=0xffffffffd1010997, x=1, y=34) returned 1 [0171.069] SetBkMode (hdc=0xffffffffd1010997, mode=2) returned 1 [0171.069] MoveToEx (in: hdc=0xffffffffd1010997, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0171.069] SelectObject (hdc=0xffffffffd1010997, h=0x1b00017) returned 0x3300853 [0171.069] DeleteObject (ho=0x3300853) returned 1 [0171.069] GetROP2 (hdc=0xffffffffd1010997) returned 13 [0171.069] GetBkMode (hdc=0xffffffffd1010997) returned 2 [0171.069] SetBkMode (hdc=0xffffffffd1010997, mode=1) returned 2 [0171.069] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0x253009fd [0171.069] SelectObject (hdc=0xffffffffd1010997, h=0x253009fd) returned 0x1b00017 [0171.069] MoveToEx (in: hdc=0xffffffffd1010997, x=1, y=34, lppt=0x25d2270 | out: lppt=0x25d2270) returned 1 [0171.070] LineTo (hdc=0xffffffffd1010997, x=123, y=34) returned 1 [0171.070] SetBkMode (hdc=0xffffffffd1010997, mode=2) returned 1 [0171.070] MoveToEx (in: hdc=0xffffffffd1010997, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0171.070] GetROP2 (hdc=0xffffffffd1010997) returned 13 [0171.070] GetBkMode (hdc=0xffffffffd1010997) returned 2 [0171.070] SetBkMode (hdc=0xffffffffd1010997, mode=1) returned 2 [0171.070] SelectObject (hdc=0xffffffffd1010997, h=0x253009fd) returned 0x253009fd [0171.070] MoveToEx (in: hdc=0xffffffffd1010997, x=123, y=34, lppt=0x25d2288 | out: lppt=0x25d2288) returned 1 [0171.070] LineTo (hdc=0xffffffffd1010997, x=123, y=0) returned 1 [0171.070] SetBkMode (hdc=0xffffffffd1010997, mode=2) returned 1 [0171.070] MoveToEx (in: hdc=0xffffffffd1010997, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0171.070] SelectObject (hdc=0xffffffffd1010997, h=0x1b00017) returned 0x253009fd [0171.070] DeleteObject (ho=0x253009fd) returned 1 [0171.070] GetROP2 (hdc=0xffffffffd1010997) returned 13 [0171.070] GetBkMode (hdc=0xffffffffd1010997) returned 2 [0171.070] SetBkMode (hdc=0xffffffffd1010997, mode=1) returned 2 [0171.070] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x4300853 [0171.070] SelectObject (hdc=0xffffffffd1010997, h=0x4300853) returned 0x1b00017 [0171.071] MoveToEx (in: hdc=0xffffffffd1010997, x=122, y=2, lppt=0x25d22f0 | out: lppt=0x25d22f0) returned 1 [0171.071] LineTo (hdc=0xffffffffd1010997, x=2, y=2) returned 1 [0171.071] SetBkMode (hdc=0xffffffffd1010997, mode=2) returned 1 [0171.071] MoveToEx (in: hdc=0xffffffffd1010997, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0171.071] GetROP2 (hdc=0xffffffffd1010997) returned 13 [0171.071] GetBkMode (hdc=0xffffffffd1010997) returned 2 [0171.071] SetBkMode (hdc=0xffffffffd1010997, mode=1) returned 2 [0171.071] SelectObject (hdc=0xffffffffd1010997, h=0x4300853) returned 0x4300853 [0171.071] MoveToEx (in: hdc=0xffffffffd1010997, x=2, y=2, lppt=0x25d2308 | out: lppt=0x25d2308) returned 1 [0171.071] LineTo (hdc=0xffffffffd1010997, x=2, y=33) returned 1 [0171.071] SetBkMode (hdc=0xffffffffd1010997, mode=2) returned 1 [0171.071] MoveToEx (in: hdc=0xffffffffd1010997, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0171.071] SelectObject (hdc=0xffffffffd1010997, h=0x1b00017) returned 0x4300853 [0171.071] DeleteObject (ho=0x4300853) returned 1 [0171.071] GetROP2 (hdc=0xffffffffd1010997) returned 13 [0171.071] GetBkMode (hdc=0xffffffffd1010997) returned 2 [0171.071] SetBkMode (hdc=0xffffffffd1010997, mode=1) returned 2 [0171.071] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x263009fd [0171.071] SelectObject (hdc=0xffffffffd1010997, h=0x263009fd) returned 0x1b00017 [0171.072] MoveToEx (in: hdc=0xffffffffd1010997, x=2, y=33, lppt=0x25d2370 | out: lppt=0x25d2370) returned 1 [0171.072] LineTo (hdc=0xffffffffd1010997, x=122, y=33) returned 1 [0171.072] SetBkMode (hdc=0xffffffffd1010997, mode=2) returned 1 [0171.072] MoveToEx (in: hdc=0xffffffffd1010997, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0171.072] GetROP2 (hdc=0xffffffffd1010997) returned 13 [0171.072] GetBkMode (hdc=0xffffffffd1010997) returned 2 [0171.072] SetBkMode (hdc=0xffffffffd1010997, mode=1) returned 2 [0171.072] SelectObject (hdc=0xffffffffd1010997, h=0x263009fd) returned 0x263009fd [0171.072] MoveToEx (in: hdc=0xffffffffd1010997, x=122, y=33, lppt=0x25d2388 | out: lppt=0x25d2388) returned 1 [0171.072] LineTo (hdc=0xffffffffd1010997, x=122, y=1) returned 1 [0171.072] SetBkMode (hdc=0xffffffffd1010997, mode=2) returned 1 [0171.072] MoveToEx (in: hdc=0xffffffffd1010997, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0171.072] SelectObject (hdc=0xffffffffd1010997, h=0x1b00017) returned 0x263009fd [0171.072] DeleteObject (ho=0x263009fd) returned 1 [0171.072] RestoreDC (hdc=0xffffffffd1010997, nSavedDC=-1) returned 1 [0171.072] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.072] GdipReleaseDC (graphics=0x1c46d570, hdc=0xffffffffd1010997) returned 0x0 [0171.072] GdipGetDC (graphics=0x1c46d570, hdc=0x43d8e0) returned 0x0 [0171.073] BitBlt (hdc=0x35010a3b, x=0, y=0, cx=125, cy=36, hdcSrc=0xffffffffd1010997, x1=0, y1=0, rop=0xcc0020) returned 1 [0171.073] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.073] GdipReleaseDC (graphics=0x1c46d570, hdc=0xffffffffd1010997) returned 0x0 [0171.073] SelectPalette (hdc=0x35010a3b, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0171.073] SelectObject (hdc=0xffffffffd1010997, h=0x185000f) returned 0x2905055a [0171.073] DeleteDC (hdc=0xffffffffd1010997) returned 1 [0171.073] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0171.073] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0171.073] EndPaint (hWnd=0xa01fa, lpPaint=0x43d9e8) returned 1 [0171.073] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0171.073] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0171.073] WaitMessage () returned 1 [0171.341] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0171.341] IsWindowUnicode (hWnd=0x40174) returned 1 [0171.341] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0171.342] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0171.342] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0171.342] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0171.342] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0171.342] WaitMessage () returned 1 [0196.571] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0196.571] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x46, wParam=0x0, lParam=0x43e410) returned 0x0 [0196.571] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x46, wParam=0x0, lParam=0x43e410) returned 0x0 [0196.572] GetWindowPlacement (in: hWnd=0x8016e, lpwndpl=0x43de40 | out: lpwndpl=0x43de40) returned 1 [0196.572] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x47, wParam=0x0, lParam=0x43e410) returned 0x0 [0196.572] GetClientRect (in: hWnd=0x8016e, lpRect=0x43dbe0 | out: lpRect=0x43dbe0) returned 1 [0196.572] GetWindowRect (in: hWnd=0x8016e, lpRect=0x43dbe0 | out: lpRect=0x43dbe0) returned 1 [0196.573] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x47, wParam=0x0, lParam=0x43e410) returned 0x0 [0196.573] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x1c, wParam=0x1, lParam=0xa1c) returned 0x0 [0196.573] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x60076, Msg=0x1c, wParam=0x1, lParam=0xa1c) returned 0x0 [0196.573] NtdllDefWindowProc_W (hWnd=0x20232, Msg=0x1c, wParam=0x1, lParam=0xa1c) returned 0x0 [0196.573] CallWindowProcW (lpPrevWndFunc=0x7ff8ee413240, hWnd=0x8016e, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0196.575] GetFocus () returned 0x0 [0196.575] SetFocus (hWnd=0xa01fa) returned 0x0 [0196.575] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0196.576] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0196.576] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0196.576] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0196.576] GetStockObject (i=5) returned 0x1900015 [0196.576] GetDlgItem (hDlg=0x8016e, nIDDlgItem=655866) returned 0xa01fa [0196.577] SendMessageW (hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43d0c0) returned 0x0 [0196.577] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x202b, wParam=0xa01fa, lParam=0x43d0c0) returned 0x0 [0196.577] InvalidateRect (hWnd=0xa01fa, lpRect=0x0, bErase=0) returned 1 [0196.577] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0196.577] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0196.577] GetKeyState (nVirtKey=16) returned 0 [0196.577] GetKeyState (nVirtKey=17) returned 0 [0196.577] GetKeyState (nVirtKey=18) returned -127 [0196.577] TranslateMessage (lpMsg=0x43e5e0) returned 1 [0196.577] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0196.577] GetKeyState (nVirtKey=16) returned 0 [0196.577] GetKeyState (nVirtKey=17) returned 0 [0196.577] GetKeyState (nVirtKey=18) returned -127 [0196.577] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x105, wParam=0x1b, lParam=0xe0010001) returned 0x0 [0196.578] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0196.578] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0196.578] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0196.578] GetKeyState (nVirtKey=16) returned 0 [0196.578] GetKeyState (nVirtKey=17) returned 0 [0196.578] GetKeyState (nVirtKey=18) returned 1 [0196.578] TranslateMessage (lpMsg=0x43e5e0) returned 1 [0196.578] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0196.578] GetKeyState (nVirtKey=16) returned 0 [0196.578] GetKeyState (nVirtKey=17) returned 0 [0196.578] GetKeyState (nVirtKey=18) returned 1 [0196.578] CallWindowProcW (lpPrevWndFunc=0x7ff8ee4132a0, hWnd=0xa01fa, Msg=0x101, wParam=0x12, lParam=0xc0380001) returned 0x0 [0196.578] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0196.578] IsWindowUnicode (hWnd=0xa01fa) returned 1 [0196.578] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0196.578] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0196.578] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0196.578] BeginPaint (in: hWnd=0xa01fa, lpPaint=0x43d9d8 | out: lpPaint=0x43d9d8) returned 0x35010a3b [0196.578] SelectPalette (hdc=0x35010a3b, hPal=0x2e0801b6, bForceBkgd=1) returned 0x188000b [0196.579] CreateCompatibleDC (hdc=0x35010a3b) returned 0x680109fd [0196.579] SelectObject (hdc=0x680109fd, h=0x2905055a) returned 0x185000f [0196.579] GdipCreateFromHDC (hdc=0x680109fd, graphics=0x43d7e0) returned 0x0 [0196.579] GdipTranslateWorldTransform (graphics=0x1c46d570, dx=0x0, dy=0x7ff8d374ba78, order=0x0) returned 0x0 [0196.579] GdipSetClipRectI (graphics=0x1c46d570, x=0, y=0, width=125, height=36, combineMode=0x0) returned 0x0 [0196.579] GdipCreateMatrix (matrix=0x43d910) returned 0x0 [0196.579] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c4713b0) returned 0x0 [0196.579] GdipIsMatrixIdentity (matrix=0x1c4713b0, result=0x43d970) returned 0x0 [0196.579] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c250 [0196.579] GdipGetMatrixElements (matrix=0x1c4713b0, matrixOut=0x1f32c250) returned 0x0 [0196.579] LocalFree (hMem=0x1f32c250) returned 0x0 [0196.579] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.579] GdipDeleteMatrix (matrix=0x1c4713b0) returned 0x0 [0196.579] GdipCreateRegion (region=0x43d910) returned 0x0 [0196.579] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0196.579] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d940) returned 0x0 [0196.579] GdipSaveGraphics (graphics=0x1c46d570, state=0x43da10) returned 0x0 [0196.579] GdipRestoreGraphics (graphics=0x1c46d570, state=0xfffffffffd4c0dbd) returned 0x0 [0196.579] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.579] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0196.580] GdipGetDC (graphics=0x1c46d570, hdc=0x43ce00) returned 0x0 [0196.580] GetCurrentObject (hdc=0x680109fd, type=0x1) returned 0x1b00017 [0196.580] GetCurrentObject (hdc=0x680109fd, type=0x2) returned 0x1900010 [0196.580] GetCurrentObject (hdc=0x680109fd, type=0x7) returned 0x2905055a [0196.580] GetCurrentObject (hdc=0x680109fd, type=0x6) returned 0x18a0048 [0196.580] SaveDC (hdc=0x680109fd) returned 1 [0196.580] GetNearestColor (hdc=0x680109fd, color=0xf0f0f0) returned 0xf0f0f0 [0196.580] GetNearestColor (hdc=0x680109fd, color=0xa0a0a0) returned 0xa0a0a0 [0196.580] GetNearestColor (hdc=0x680109fd, color=0x696969) returned 0x696969 [0196.580] GetNearestColor (hdc=0x680109fd, color=0xa0a0a0) returned 0xa0a0a0 [0196.580] GetNearestColor (hdc=0x680109fd, color=0x0) returned 0x0 [0196.580] GetNearestColor (hdc=0x680109fd, color=0xffffff) returned 0xffffff [0196.580] GetNearestColor (hdc=0x680109fd, color=0xe5e5e5) returned 0xe5e5e5 [0196.580] GetNearestColor (hdc=0x680109fd, color=0xd8d8d8) returned 0xd8d8d8 [0196.580] GetNearestColor (hdc=0x680109fd, color=0x0) returned 0x0 [0196.580] RestoreDC (hdc=0x680109fd, nSavedDC=-1) returned 1 [0196.580] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.580] GdipReleaseDC (graphics=0x1c46d570, hdc=0x680109fd) returned 0x0 [0196.581] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0196.581] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2780 [0196.581] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0196.581] CoTaskMemFree (pv=0x1f2f2780) [0196.581] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d4f0) returned 0x0 [0196.581] GdipSetStringFormatAlign (format=0x1c476620, align=0x1) returned 0x0 [0196.581] GdipSetStringFormatLineAlign (format=0x1c476620, align=0x1) returned 0x0 [0196.581] GdipSetStringFormatHotkeyPrefix (format=0x1c476620, hotkeyPrefix=1) returned 0x0 [0196.581] GdipGetStringFormatFlags (format=0x1c476620, flags=0x43d520) returned 0x0 [0196.581] GdipGetStringFormatTrimming (format=0x1c476620, trimming=0x43d520) returned 0x0 [0196.581] GdipGetStringFormatHotkeyPrefix (format=0x1c476620, hotkeyPrefix=0x43d520) returned 0x0 [0196.581] GdipGetFontSize (font=0x1c476620, size=0x43d520) returned 0x0 [0196.582] GdipGetFontStyle (font=0x1c476620, style=0x43d520) returned 0x0 [0196.582] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.582] GdipDeleteStringFormat (format=0x1c476620) returned 0x0 [0196.582] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0196.582] CoTaskMemAlloc (cb=0x13) returned 0x1f2f28e0 [0196.582] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0196.582] CoTaskMemFree (pv=0x1f2f28e0) [0196.582] GdipCreateFromHDC (hdc=0x6c010559, graphics=0x43d1b0) returned 0x0 [0196.582] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d1c0) returned 0x0 [0196.582] GdipSetStringFormatFlags (format=0x1c475f20, flags=0) returned 0x0 [0196.582] GdipSetStringFormatTrimming (format=0x1c475f20, trimming=0x1) returned 0x0 [0196.582] GdipSetStringFormatHotkeyPrefix (format=0x1c475f20, hotkeyPrefix=1) returned 0x0 [0196.582] GdipSetStringFormatAlign (format=0x1c475f20, align=0x1) returned 0x0 [0196.583] GdipSetStringFormatLineAlign (format=0x1c475f20, align=0x1) returned 0x0 [0196.583] GdipMeasureString (graphics=0x1c4701b0, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43d0d8, stringFormat=0x1c475f20, boundingBox=0x43d0c8, codepointsFitted=0x43d0c4, linesFilled=0x43d0c0) returned 0x0 [0196.583] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.583] GdipDeleteStringFormat (format=0x1c475f20) returned 0x0 [0196.583] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.583] GdipDeleteGraphics (graphics=0x1c4701b0) returned 0x0 [0196.583] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0196.583] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2600 [0196.583] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0196.583] CoTaskMemFree (pv=0x1f2f2600) [0196.583] GdipCreateRegion (region=0x43d120) returned 0x0 [0196.583] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0196.583] GdipCreateMatrix (matrix=0x43d120) returned 0x0 [0196.583] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471670) returned 0x0 [0196.583] GdipIsMatrixIdentity (matrix=0x1c471670, result=0x43d180) returned 0x0 [0196.583] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c550 [0196.583] GdipGetMatrixElements (matrix=0x1c471670, matrixOut=0x1f32c550) returned 0x0 [0196.584] LocalFree (hMem=0x1f32c550) returned 0x0 [0196.584] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32c790 [0196.584] GdipGetMatrixElements (matrix=0x1c471670, matrixOut=0x1f32c790) returned 0x0 [0196.584] LocalFree (hMem=0x1f32c790) returned 0x0 [0196.584] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.584] GdipDeleteMatrix (matrix=0x1c471670) returned 0x0 [0196.584] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d1d0) returned 0x0 [0196.584] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d190) returned 0x0 [0196.584] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43d190) returned 0x0 [0196.584] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.584] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0196.584] GdipGetDC (graphics=0x1c46d570, hdc=0x43d200) returned 0x0 [0196.584] GetCurrentObject (hdc=0x680109fd, type=0x1) returned 0x1b00017 [0196.584] GetCurrentObject (hdc=0x680109fd, type=0x2) returned 0x1900010 [0196.584] GetCurrentObject (hdc=0x680109fd, type=0x7) returned 0x2905055a [0196.584] GetCurrentObject (hdc=0x680109fd, type=0x6) returned 0x18a0048 [0196.584] SaveDC (hdc=0x680109fd) returned 1 [0196.584] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7d0406cc [0196.584] GetClipRgn (hdc=0x680109fd, hrgn=0x7d0406cc) returned 0 [0196.584] SelectClipRgn (hdc=0x680109fd, hrgn=0x770405d8) returned 2 [0196.584] DeleteObject (ho=0x7d0406cc) returned 1 [0196.584] DeleteObject (ho=0x770405d8) returned 1 [0196.584] OffsetViewportOrgEx (in: hdc=0x680109fd, x=0, y=0, lppt=0x25d30d8 | out: lppt=0x25d30d8) returned 1 [0196.585] GetNearestColor (hdc=0x680109fd, color=0xf0f0f0) returned 0xf0f0f0 [0196.585] CreateSolidBrush (color=0xf0f0f0) returned 0x3010075d [0196.585] FillRect (hDC=0x680109fd, lprc=0x43d1d0, hbr=0x3010075d) returned 1 [0196.585] DeleteObject (ho=0x3010075d) returned 1 [0196.585] RestoreDC (hdc=0x680109fd, nSavedDC=-1) returned 1 [0196.585] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.585] GdipReleaseDC (graphics=0x1c46d570, hdc=0x680109fd) returned 0x0 [0196.585] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0196.585] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2a60 [0196.585] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0196.585] CoTaskMemFree (pv=0x1f2f2a60) [0196.585] GdipCreateStringFormat (formatAttributes=0, language=0x0, format=0x43d250) returned 0x0 [0196.585] GdipSetStringFormatAlign (format=0x1c476690, align=0x1) returned 0x0 [0196.585] GdipSetStringFormatLineAlign (format=0x1c476690, align=0x1) returned 0x0 [0196.586] GdipSetStringFormatHotkeyPrefix (format=0x1c476690, hotkeyPrefix=1) returned 0x0 [0196.586] GdipCreateSolidFill (color=0xffffffffff000000, brush=0x43d2c0) returned 0x0 [0196.586] GdipDrawString (graphics=0x1c46d570, string="Get PIN", length=7, font=0x1c467890, layoutRect=0x43d1d0, stringFormat=0x1c476690, brush=0x1c46cce0) returned 0x0 [0196.586] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.586] GdipDeleteBrush (brush=0x1c46cce0) returned 0x0 [0196.586] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.586] GdipDeleteStringFormat (format=0x1c476690) returned 0x0 [0196.586] GetFocus () returned 0xa01fa [0196.586] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff8d18c0000 [0196.586] CoTaskMemAlloc (cb=0x13) returned 0x1f2f2600 [0196.586] GetProcAddress (hModule=0x7ff8d18c0000, lpProcName="ImageList_WriteEx") returned 0x0 [0196.586] CoTaskMemFree (pv=0x1f2f2600) [0196.586] GdipCreatePen1 (color=0xffffffffff000000, width=0x0, unit=0x0, pen=0x43d5b0) returned 0x0 [0196.586] GdipDrawRectangleI (graphics=0x1c46d570, pen=0x1c46d1b0, x=0, y=0, width=124, height=35) returned 0x0 [0196.587] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.587] GdipDeletePen (pen=0x1c46d1b0) returned 0x0 [0196.587] GdipCreateRegion (region=0x43d080) returned 0x0 [0196.587] GdipGetClip (graphics=0x1c46d570, region=0x1c46a710) returned 0x0 [0196.587] GdipCreateMatrix (matrix=0x43d080) returned 0x0 [0196.587] GdipGetWorldTransform (graphics=0x1c46d570, matrix=0x1c471730) returned 0x0 [0196.587] GdipIsMatrixIdentity (matrix=0x1c471730, result=0x43d0e0) returned 0x0 [0196.587] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32be50 [0196.587] GdipGetMatrixElements (matrix=0x1c471730, matrixOut=0x1f32be50) returned 0x0 [0196.587] LocalFree (hMem=0x1f32be50) returned 0x0 [0196.587] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1f32ccd0 [0196.587] GdipGetMatrixElements (matrix=0x1c471730, matrixOut=0x1f32ccd0) returned 0x0 [0196.587] LocalFree (hMem=0x1f32ccd0) returned 0x0 [0196.587] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.587] GdipDeleteMatrix (matrix=0x1c471730) returned 0x0 [0196.587] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d130) returned 0x0 [0196.587] GdipIsInfiniteRegion (region=0x1c46a710, graphics=0x1c46d570, result=0x43d0f0) returned 0x0 [0196.587] GdipGetRegionHRgn (region=0x1c46a710, graphics=0x1c46d570, hRgn=0x43d0f0) returned 0x0 [0196.587] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.587] GdipDeleteRegion (region=0x1c46a710) returned 0x0 [0196.587] GdipGetDC (graphics=0x1c46d570, hdc=0x43d160) returned 0x0 [0196.587] GetCurrentObject (hdc=0x680109fd, type=0x1) returned 0x1b00017 [0196.587] GetCurrentObject (hdc=0x680109fd, type=0x2) returned 0x1900010 [0196.587] GetCurrentObject (hdc=0x680109fd, type=0x7) returned 0x2905055a [0196.588] GetCurrentObject (hdc=0x680109fd, type=0x6) returned 0x18a0048 [0196.588] SaveDC (hdc=0x680109fd) returned 1 [0196.588] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x780405d8 [0196.588] GetClipRgn (hdc=0x680109fd, hrgn=0x780405d8) returned 0 [0196.588] SelectClipRgn (hdc=0x680109fd, hrgn=0x7e0406cc) returned 2 [0196.588] DeleteObject (ho=0x780405d8) returned 1 [0196.588] DeleteObject (ho=0x7e0406cc) returned 1 [0196.588] OffsetViewportOrgEx (in: hdc=0x680109fd, x=0, y=0, lppt=0x25d3678 | out: lppt=0x25d3678) returned 1 [0196.588] GetROP2 (hdc=0x680109fd) returned 13 [0196.588] GetBkMode (hdc=0x680109fd) returned 2 [0196.588] SetBkMode (hdc=0x680109fd, mode=1) returned 2 [0196.588] CreatePen (iStyle=0, cWidth=1, color=0xffffff) returned 0xffffffffcd30084c [0196.588] SelectObject (hdc=0x680109fd, h=0xffffffffcd30084c) returned 0x1b00017 [0196.588] MoveToEx (in: hdc=0x680109fd, x=123, y=1, lppt=0x25d36e0 | out: lppt=0x25d36e0) returned 1 [0196.588] LineTo (hdc=0x680109fd, x=1, y=1) returned 1 [0196.588] SetBkMode (hdc=0x680109fd, mode=2) returned 1 [0196.588] MoveToEx (in: hdc=0x680109fd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0196.588] GetROP2 (hdc=0x680109fd) returned 13 [0196.588] GetBkMode (hdc=0x680109fd) returned 2 [0196.588] SetBkMode (hdc=0x680109fd, mode=1) returned 2 [0196.589] SelectObject (hdc=0x680109fd, h=0xffffffffcd30084c) returned 0xffffffffcd30084c [0196.589] MoveToEx (in: hdc=0x680109fd, x=1, y=1, lppt=0x25d36f8 | out: lppt=0x25d36f8) returned 1 [0196.589] LineTo (hdc=0x680109fd, x=1, y=34) returned 1 [0196.589] SetBkMode (hdc=0x680109fd, mode=2) returned 1 [0196.589] MoveToEx (in: hdc=0x680109fd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0196.589] SelectObject (hdc=0x680109fd, h=0x1b00017) returned 0xffffffffcd30084c [0196.589] DeleteObject (ho=0xffffffffcd30084c) returned 1 [0196.589] GetROP2 (hdc=0x680109fd) returned 13 [0196.589] GetBkMode (hdc=0x680109fd) returned 2 [0196.589] SetBkMode (hdc=0x680109fd, mode=1) returned 2 [0196.589] CreatePen (iStyle=0, cWidth=1, color=0x696969) returned 0xffffffffb73009ca [0196.589] SelectObject (hdc=0x680109fd, h=0xffffffffb73009ca) returned 0x1b00017 [0196.589] MoveToEx (in: hdc=0x680109fd, x=1, y=34, lppt=0x25d3760 | out: lppt=0x25d3760) returned 1 [0196.589] LineTo (hdc=0x680109fd, x=123, y=34) returned 1 [0196.589] SetBkMode (hdc=0x680109fd, mode=2) returned 1 [0196.589] MoveToEx (in: hdc=0x680109fd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0196.589] GetROP2 (hdc=0x680109fd) returned 13 [0196.589] GetBkMode (hdc=0x680109fd) returned 2 [0196.589] SetBkMode (hdc=0x680109fd, mode=1) returned 2 [0196.589] SelectObject (hdc=0x680109fd, h=0xffffffffb73009ca) returned 0xffffffffb73009ca [0196.589] MoveToEx (in: hdc=0x680109fd, x=123, y=34, lppt=0x25d3778 | out: lppt=0x25d3778) returned 1 [0196.589] LineTo (hdc=0x680109fd, x=123, y=0) returned 1 [0196.589] SetBkMode (hdc=0x680109fd, mode=2) returned 1 [0196.589] MoveToEx (in: hdc=0x680109fd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0196.589] SelectObject (hdc=0x680109fd, h=0x1b00017) returned 0xffffffffb73009ca [0196.590] DeleteObject (ho=0xffffffffb73009ca) returned 1 [0196.590] GetROP2 (hdc=0x680109fd) returned 13 [0196.590] GetBkMode (hdc=0x680109fd) returned 2 [0196.590] SetBkMode (hdc=0x680109fd, mode=1) returned 2 [0196.590] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0xffffffffce30084c [0196.590] SelectObject (hdc=0x680109fd, h=0xffffffffce30084c) returned 0x1b00017 [0196.590] MoveToEx (in: hdc=0x680109fd, x=122, y=2, lppt=0x25d37e0 | out: lppt=0x25d37e0) returned 1 [0196.590] LineTo (hdc=0x680109fd, x=2, y=2) returned 1 [0196.590] SetBkMode (hdc=0x680109fd, mode=2) returned 1 [0196.590] MoveToEx (in: hdc=0x680109fd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0196.590] GetROP2 (hdc=0x680109fd) returned 13 [0196.590] GetBkMode (hdc=0x680109fd) returned 2 [0196.590] SetBkMode (hdc=0x680109fd, mode=1) returned 2 [0196.590] SelectObject (hdc=0x680109fd, h=0xffffffffce30084c) returned 0xffffffffce30084c [0196.590] MoveToEx (in: hdc=0x680109fd, x=2, y=2, lppt=0x25d37f8 | out: lppt=0x25d37f8) returned 1 [0196.590] LineTo (hdc=0x680109fd, x=2, y=33) returned 1 [0196.590] SetBkMode (hdc=0x680109fd, mode=2) returned 1 [0196.590] MoveToEx (in: hdc=0x680109fd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0196.590] SelectObject (hdc=0x680109fd, h=0x1b00017) returned 0xffffffffce30084c [0196.590] DeleteObject (ho=0xffffffffce30084c) returned 1 [0196.590] GetROP2 (hdc=0x680109fd) returned 13 [0196.590] GetBkMode (hdc=0x680109fd) returned 2 [0196.590] SetBkMode (hdc=0x680109fd, mode=1) returned 2 [0196.590] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0xffffffffb83009ca [0196.591] SelectObject (hdc=0x680109fd, h=0xffffffffb83009ca) returned 0x1b00017 [0196.591] MoveToEx (in: hdc=0x680109fd, x=2, y=33, lppt=0x25d3860 | out: lppt=0x25d3860) returned 1 [0196.591] LineTo (hdc=0x680109fd, x=122, y=33) returned 1 [0196.591] SetBkMode (hdc=0x680109fd, mode=2) returned 1 [0196.591] MoveToEx (in: hdc=0x680109fd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0196.591] GetROP2 (hdc=0x680109fd) returned 13 [0196.591] GetBkMode (hdc=0x680109fd) returned 2 [0196.599] SetBkMode (hdc=0x680109fd, mode=1) returned 2 [0196.599] SelectObject (hdc=0x680109fd, h=0xffffffffb83009ca) returned 0xffffffffb83009ca [0196.599] MoveToEx (in: hdc=0x680109fd, x=122, y=33, lppt=0x25d3878 | out: lppt=0x25d3878) returned 1 [0196.599] LineTo (hdc=0x680109fd, x=122, y=1) returned 1 [0196.599] SetBkMode (hdc=0x680109fd, mode=2) returned 1 [0196.599] MoveToEx (in: hdc=0x680109fd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0196.599] SelectObject (hdc=0x680109fd, h=0x1b00017) returned 0xffffffffb83009ca [0196.599] DeleteObject (ho=0xffffffffb83009ca) returned 1 [0196.599] RestoreDC (hdc=0x680109fd, nSavedDC=-1) returned 1 [0196.599] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.599] GdipReleaseDC (graphics=0x1c46d570, hdc=0x680109fd) returned 0x0 [0196.599] GdipGetDC (graphics=0x1c46d570, hdc=0x43d8e0) returned 0x0 [0196.599] BitBlt (hdc=0x35010a3b, x=0, y=0, cx=125, cy=36, hdcSrc=0x680109fd, x1=0, y1=0, rop=0xcc0020) returned 1 [0196.599] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.599] GdipReleaseDC (graphics=0x1c46d570, hdc=0x680109fd) returned 0x0 [0196.600] SelectPalette (hdc=0x35010a3b, hPal=0x188000b, bForceBkgd=0) returned 0x2e0801b6 [0196.600] SelectObject (hdc=0x680109fd, h=0x185000f) returned 0x2905055a [0196.600] DeleteDC (hdc=0x680109fd) returned 1 [0196.600] FindAtomW (lpString="GDI+Atom_3540_1") returned 0xc000 [0196.600] GdipDeleteGraphics (graphics=0x1c46d570) returned 0x0 [0196.600] EndPaint (hWnd=0xa01fa, lpPaint=0x43d9e8) returned 1 [0196.600] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0196.600] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0196.600] WaitMessage () returned 1 [0196.888] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 1 [0196.888] IsWindowUnicode (hWnd=0x40174) returned 1 [0196.888] GetMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x43e5d0) returned 1 [0196.888] TranslateMessage (lpMsg=0x43e5e0) returned 0 [0196.888] DispatchMessageW (lpMsg=0x43e5e0) returned 0x0 [0196.888] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0196.888] PeekMessageW (in: lpMsg=0x43e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x43e5d0) returned 0 [0196.888] WaitMessage () Thread: id = 2 os_tid = 0xddc Thread: id = 3 os_tid = 0xe14 Thread: id = 4 os_tid = 0xe18 [0044.989] CoGetContextToken (in: pToken=0x1ad6efd0 | out: pToken=0x1ad6efd0) returned 0x800401f0 [0044.989] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 5 os_tid = 0xe2c [0049.957] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 6 os_tid = 0xe30 [0050.416] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 7 os_tid = 0xef8 Thread: id = 8 os_tid = 0xf38 Thread: id = 9 os_tid = 0xf3c Thread: id = 10 os_tid = 0xf40 Thread: id = 11 os_tid = 0xf68 Thread: id = 12 os_tid = 0xf6c Thread: id = 18 os_tid = 0xf9c Thread: id = 19 os_tid = 0xfc4 Thread: id = 26 os_tid = 0xff8 Thread: id = 82 os_tid = 0x534 Thread: id = 83 os_tid = 0x7dc Thread: id = 105 os_tid = 0xc14 Thread: id = 129 os_tid = 0xbf8 Thread: id = 147 os_tid = 0x820 Thread: id = 162 os_tid = 0xd9c Thread: id = 172 os_tid = 0x78c Thread: id = 196 os_tid = 0xda0 Thread: id = 215 os_tid = 0xea0 Thread: id = 240 os_tid = 0xe0c Thread: id = 243 os_tid = 0xe98 Thread: id = 263 os_tid = 0xd48 Process: id = "2" image_name = "tempchhksm.exe" filename = "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tempchhksm.exe" page_root = "0x2adcd000" os_pid = "0xf74" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xdd4" cmd_line = "\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe\" " cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 341 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 342 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 343 start_va = 0x40000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 344 start_va = 0x60000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 345 start_va = 0xa0000 end_va = 0xa3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 346 start_va = 0xb0000 end_va = 0xb1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 347 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 348 start_va = 0x400000 end_va = 0x4b8fff entry_point = 0x400000 region_type = mapped_file name = "tempchhksm.exe" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tempchhksm.exe") Region: id = 349 start_va = 0x4c0000 end_va = 0x8bffff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 350 start_va = 0x77ca0000 end_va = 0x77e18fff entry_point = 0x77ca0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 351 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 352 start_va = 0xfffb0000 end_va = 0xfffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000fffb0000" filename = "" Region: id = 353 start_va = 0xfffda000 end_va = 0xfffdafff entry_point = 0x0 region_type = private name = "private_0x00000000fffda000" filename = "" Region: id = 354 start_va = 0xfffdc000 end_va = 0xfffdefff entry_point = 0x0 region_type = private name = "private_0x00000000fffdc000" filename = "" Region: id = 355 start_va = 0xfffdf000 end_va = 0xfffdffff entry_point = 0x0 region_type = private name = "private_0x00000000fffdf000" filename = "" Region: id = 356 start_va = 0xfffe0000 end_va = 0x7ff8ee37ffff entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Region: id = 357 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 358 start_va = 0x7ff8ee542000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ff8ee542000" filename = "" Region: id = 359 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 360 start_va = 0x64af0000 end_va = 0x64b62fff entry_point = 0x64af0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 361 start_va = 0x64b70000 end_va = 0x64bbefff entry_point = 0x64b70000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 362 start_va = 0x64ae0000 end_va = 0x64ae7fff entry_point = 0x64ae0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 363 start_va = 0xa60000 end_va = 0xe5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 364 start_va = 0x74e70000 end_va = 0x74fe5fff entry_point = 0x74e70000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 365 start_va = 0x75260000 end_va = 0x7534ffff entry_point = 0x75260000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 366 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 367 start_va = 0xd0000 end_va = 0x18dfff entry_point = 0xd0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 368 start_va = 0x74ca0000 end_va = 0x74d30fff entry_point = 0x74ca0000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 369 start_va = 0xffeb0000 end_va = 0xfffaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000ffeb0000" filename = "" Region: id = 376 start_va = 0x20000 end_va = 0x23fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 377 start_va = 0x190000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 378 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 379 start_va = 0xe60000 end_va = 0x125ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 380 start_va = 0x1260000 end_va = 0x165ffff entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 381 start_va = 0x746d0000 end_va = 0x746f0fff entry_point = 0x746d0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 382 start_va = 0x74700000 end_va = 0x74716fff entry_point = 0x74700000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 383 start_va = 0x74720000 end_va = 0x74742fff entry_point = 0x74720000 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\SysWOW64\\winmmbase.dll" (normalized: "c:\\windows\\syswow64\\winmmbase.dll") Region: id = 384 start_va = 0x74750000 end_va = 0x74768fff entry_point = 0x74750000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 385 start_va = 0x74770000 end_va = 0x74993fff entry_point = 0x74770000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 386 start_va = 0x749a0000 end_va = 0x74ba8fff entry_point = 0x749a0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll") Region: id = 387 start_va = 0x74bb0000 end_va = 0x74bb7fff entry_point = 0x74bb0000 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\SysWOW64\\wsock32.dll" (normalized: "c:\\windows\\syswow64\\wsock32.dll") Region: id = 388 start_va = 0x74bc0000 end_va = 0x74be3fff entry_point = 0x74bc0000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 389 start_va = 0x74bf0000 end_va = 0x74bf7fff entry_point = 0x74bf0000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 390 start_va = 0x74d40000 end_va = 0x74d98fff entry_point = 0x74d40000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 391 start_va = 0x74da0000 end_va = 0x74da9fff entry_point = 0x74da0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 392 start_va = 0x74db0000 end_va = 0x74dcdfff entry_point = 0x74db0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 393 start_va = 0x75160000 end_va = 0x7521dfff entry_point = 0x75160000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll") Region: id = 394 start_va = 0x75220000 end_va = 0x75255fff entry_point = 0x75220000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 395 start_va = 0x753b0000 end_va = 0x753f3fff entry_point = 0x753b0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 396 start_va = 0x75430000 end_va = 0x767eefff entry_point = 0x75430000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 397 start_va = 0x76810000 end_va = 0x7681efff entry_point = 0x76810000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 398 start_va = 0x768b0000 end_va = 0x76999fff entry_point = 0x768b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 399 start_va = 0x769b0000 end_va = 0x76a0bfff entry_point = 0x769b0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 400 start_va = 0x76a10000 end_va = 0x76a8afff entry_point = 0x76a10000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 401 start_va = 0x76c40000 end_va = 0x76c82fff entry_point = 0x76c40000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 402 start_va = 0x76c90000 end_va = 0x76d21fff entry_point = 0x76c90000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 403 start_va = 0x76d90000 end_va = 0x76e3bfff entry_point = 0x76d90000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 404 start_va = 0x76e40000 end_va = 0x76ff9fff entry_point = 0x76e40000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 405 start_va = 0x77000000 end_va = 0x7714cfff entry_point = 0x77000000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 406 start_va = 0x77150000 end_va = 0x7728ffff entry_point = 0x77150000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 407 start_va = 0x77290000 end_va = 0x772d3fff entry_point = 0x77290000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 408 start_va = 0x77340000 end_va = 0x773ccfff entry_point = 0x77340000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 409 start_va = 0x773d0000 end_va = 0x773d5fff entry_point = 0x773d0000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 410 start_va = 0x773e0000 end_va = 0x773e6fff entry_point = 0x773e0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 411 start_va = 0x773f0000 end_va = 0x778ccfff entry_point = 0x773f0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 412 start_va = 0x779f0000 end_va = 0x77aadfff entry_point = 0x779f0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 413 start_va = 0x77c30000 end_va = 0x77c3bfff entry_point = 0x77c30000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 414 start_va = 0xfffd4000 end_va = 0xfffd6fff entry_point = 0x0 region_type = private name = "private_0x00000000fffd4000" filename = "" Region: id = 415 start_va = 0xfffd7000 end_va = 0xfffd9fff entry_point = 0x0 region_type = private name = "private_0x00000000fffd7000" filename = "" Region: id = 416 start_va = 0x390000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 417 start_va = 0x8c0000 end_va = 0xa47fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 418 start_va = 0x75400000 end_va = 0x7542afff entry_point = 0x75400000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 419 start_va = 0x778d0000 end_va = 0x779effff entry_point = 0x778d0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 420 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 421 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 422 start_va = 0x230000 end_va = 0x231fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 423 start_va = 0x1660000 end_va = 0x17e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001660000" filename = "" Region: id = 424 start_va = 0x17f0000 end_va = 0x2beffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000017f0000" filename = "" Region: id = 425 start_va = 0x2bf0000 end_va = 0x2d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 426 start_va = 0x220000 end_va = 0x223fff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 427 start_va = 0x74c20000 end_va = 0x74c94fff entry_point = 0x74c20000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 428 start_va = 0x240000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 429 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 430 start_va = 0x270000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 431 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 432 start_va = 0x2d80000 end_va = 0x30b6fff entry_point = 0x2d80000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 433 start_va = 0x250000 end_va = 0x253fff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 434 start_va = 0x260000 end_va = 0x260fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 435 start_va = 0x280000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 436 start_va = 0x30c0000 end_va = 0x34bffff entry_point = 0x0 region_type = private name = "private_0x00000000030c0000" filename = "" Region: id = 437 start_va = 0xffead000 end_va = 0xffeaffff entry_point = 0x0 region_type = private name = "private_0x00000000ffead000" filename = "" Region: id = 438 start_va = 0x2bf0000 end_va = 0x2ceffff entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 439 start_va = 0x2d70000 end_va = 0x2d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d70000" filename = "" Region: id = 440 start_va = 0x2d0000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 441 start_va = 0x310000 end_va = 0x310fff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 442 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 443 start_va = 0x34c0000 end_va = 0x38bffff entry_point = 0x0 region_type = private name = "private_0x00000000034c0000" filename = "" Region: id = 444 start_va = 0xffeaa000 end_va = 0xffeacfff entry_point = 0x0 region_type = private name = "private_0x00000000ffeaa000" filename = "" Region: id = 445 start_va = 0x38c0000 end_va = 0x3977fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038c0000" filename = "" Region: id = 446 start_va = 0x320000 end_va = 0x323fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 447 start_va = 0x74c00000 end_va = 0x74c1cfff entry_point = 0x74c00000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 448 start_va = 0x2cf0000 end_va = 0x2d6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002cf0000" filename = "" Region: id = 449 start_va = 0x330000 end_va = 0x333fff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 472 start_va = 0x746b0000 end_va = 0x746c2fff entry_point = 0x746b0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 473 start_va = 0x74690000 end_va = 0x746aafff entry_point = 0x74690000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 474 start_va = 0x74660000 end_va = 0x7468efff entry_point = 0x74660000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 543 start_va = 0x3980000 end_va = 0x3b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000003980000" filename = "" Region: id = 633 start_va = 0x3b80000 end_va = 0x3c53fff entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Region: id = 634 start_va = 0x3c60000 end_va = 0x3d37fff entry_point = 0x0 region_type = private name = "private_0x0000000003c60000" filename = "" Region: id = 635 start_va = 0x3d40000 end_va = 0x3e0bfff entry_point = 0x0 region_type = private name = "private_0x0000000003d40000" filename = "" Region: id = 636 start_va = 0x3e10000 end_va = 0x3ee6fff entry_point = 0x0 region_type = private name = "private_0x0000000003e10000" filename = "" Region: id = 637 start_va = 0x3b80000 end_va = 0x3c50fff entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Region: id = 1701 start_va = 0x3b80000 end_va = 0x3c5afff entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Region: id = 1702 start_va = 0x3c60000 end_va = 0x3d3afff entry_point = 0x0 region_type = private name = "private_0x0000000003c60000" filename = "" Region: id = 1703 start_va = 0x3d40000 end_va = 0x3e19fff entry_point = 0x0 region_type = private name = "private_0x0000000003d40000" filename = "" Region: id = 1704 start_va = 0x3e20000 end_va = 0x3ef7fff entry_point = 0x0 region_type = private name = "private_0x0000000003e20000" filename = "" Region: id = 1705 start_va = 0x3b80000 end_va = 0x3c57fff entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Region: id = 1835 start_va = 0x3b80000 end_va = 0x3f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Thread: id = 13 os_tid = 0xf78 [0068.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bff74 | out: lpSystemTimeAsFileTime=0x8bff74*(dwLowDateTime=0x2b30758a, dwHighDateTime=0x1d47206)) [0068.486] GetCurrentProcessId () returned 0xf74 [0068.486] GetCurrentThreadId () returned 0xf78 [0068.486] GetTickCount () returned 0x243e5 [0068.486] QueryPerformanceCounter (in: lpPerformanceCount=0x8bff6c | out: lpPerformanceCount=0x8bff6c*=1814849000000) returned 1 [0068.486] GetStartupInfoW (in: lpStartupInfo=0x8bff18 | out: lpStartupInfo=0x8bff18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0068.493] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75260000 [0068.493] GetProcAddress (hModule=0x75260000, lpProcName="FlsAlloc") returned 0x7527a330 [0068.493] GetProcAddress (hModule=0x75260000, lpProcName="FlsGetValue") returned 0x75277580 [0068.493] GetProcAddress (hModule=0x75260000, lpProcName="FlsSetValue") returned 0x75279910 [0068.493] GetProcAddress (hModule=0x75260000, lpProcName="FlsFree") returned 0x7527f400 [0068.494] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75260000 [0068.494] GetCurrentThreadId () returned 0xf78 [0068.494] GetStartupInfoW (in: lpStartupInfo=0x8bfeb4 | out: lpStartupInfo=0x8bfeb4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0068.494] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0068.494] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0068.494] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0068.494] SetHandleCount (uNumber=0x20) returned 0x20 [0068.494] GetCommandLineW () returned="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe\" " [0068.495] GetEnvironmentStringsW () returned 0xa80cd8* [0068.495] FreeEnvironmentStringsW (penv=0xa80cd8) returned 1 [0068.495] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x496f38, nSize=0x104 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tempchhksm.exe")) returned 0x32 [0068.497] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0068.497] GetLastError () returned 0x0 [0068.497] SetLastError (dwErrCode=0x0) [0068.497] GetLastError () returned 0x0 [0068.498] SetLastError (dwErrCode=0x0) [0068.498] GetLastError () returned 0x0 [0068.498] SetLastError (dwErrCode=0x0) [0068.498] GetACP () returned 0x4e4 [0068.498] GetLastError () returned 0x0 [0068.498] SetLastError (dwErrCode=0x0) [0068.498] IsValidCodePage (CodePage=0x4e4) returned 1 [0068.498] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x8bfe7c | out: lpCPInfo=0x8bfe7c) returned 1 [0068.498] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x8bf948 | out: lpCPInfo=0x8bf948) returned 1 [0068.498] GetLastError () returned 0x0 [0068.498] SetLastError (dwErrCode=0x0) [0068.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x8bfd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0068.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x8bfd5c, cbMultiByte=256, lpWideCharStr=0x8bf6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿAĀ") returned 256 [0068.498] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿAĀ", cchSrc=256, lpCharType=0x8bf95c | out: lpCharType=0x8bf95c) returned 1 [0068.499] GetLastError () returned 0x0 [0068.499] SetLastError (dwErrCode=0x0) [0068.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x8bfd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0068.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x8bfd5c, cbMultiByte=256, lpWideCharStr=0x8bf698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0068.499] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0068.499] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x8bf488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0068.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x8bfc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x63\x06\x15\xa6\x94\xfe\x8b", lpUsedDefaultChar=0x0) returned 256 [0068.499] GetLastError () returned 0x0 [0068.499] SetLastError (dwErrCode=0x0) [0068.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x8bfd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0068.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x8bfd5c, cbMultiByte=256, lpWideCharStr=0x8bf6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0068.499] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0068.499] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x8bf4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0068.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x8bfb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x63\x06\x15\xa6\x94\xfe\x8b", lpUsedDefaultChar=0x0) returned 256 [0068.499] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x41f20e) returned 0x0 [0068.500] GetVersionExW (in: lpVersionInformation=0x8bfd84*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x7f, dwMinorVersion=0x33323130, dwBuildNumber=0x2d700c0, dwPlatformId=0x3b3a3938, szCSDVersion="\x7f") | out: lpVersionInformation=0x8bfd84*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0068.501] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75260000 [0068.501] GetProcAddress (hModule=0x75260000, lpProcName="IsWow64Process") returned 0x752796e0 [0068.501] GetCurrentProcess () returned 0xffffffff [0068.501] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x8bfedc | out: Wow64Process=0x8bfedc) returned 1 [0068.501] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75260000 [0068.502] GetProcAddress (hModule=0x75260000, lpProcName="GetNativeSystemInfo") returned 0x7527a410 [0068.502] GetNativeSystemInfo (in: lpSystemInfo=0x8bfea0 | out: lpSystemInfo=0x8bfea0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0068.502] FreeLibrary (hLibModule=0x75260000) returned 1 [0068.502] FreeLibrary (hLibModule=0x75260000) returned 1 [0068.504] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0068.504] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0068.504] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0068.504] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0068.504] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0068.504] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0068.506] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc16e [0068.508] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0068.508] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0x8bfea8 | out: phkResult=0x8bfea8*=0x1dc) returned 0x0 [0068.508] RegQueryValueExW (in: hKey=0x1dc, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0x8bfec8, lpcbData=0x8bfeac*=0x8 | out: lpType=0x0, lpData=0x8bfec8*=0x30, lpcbData=0x8bfeac*=0x4) returned 0x0 [0068.508] RegCloseKey (hKey=0x1dc) returned 0x0 [0068.510] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8bf8c0, nSize=0x104 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tempchhksm.exe")) returned 0x32 [0068.511] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0x8bf890 | out: phkResult=0x8bf890*=0x0) returned 0x2 [0068.511] LoadLibraryA (lpLibFileName="uxtheme.dll") returned 0x74c20000 [0068.904] GetProcAddress (hModule=0x74c20000, lpProcName="IsThemeActive") returned 0x74c54900 [0068.904] IsThemeActive () returned 0x1 [0068.914] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0x8bfea8, fWinIni=0x0 | out: pvParam=0x8bfea8) returned 1 [0068.914] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 0 [0068.914] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x8bfc88 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0068.914] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4a7f6c, nSize=0x104 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tempchhksm.exe")) returned 0x32 [0068.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0068.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2d76a50, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0068.915] GetLastError () returned 0x0 [0068.915] SetLastError (dwErrCode=0x0) [0068.915] GetLastError () returned 0x0 [0068.915] SetLastError (dwErrCode=0x0) [0068.915] GetLastError () returned 0x0 [0068.915] SetLastError (dwErrCode=0x0) [0068.915] GetLastError () returned 0x0 [0068.915] SetLastError (dwErrCode=0x0) [0068.915] GetLastError () returned 0x0 [0068.915] SetLastError (dwErrCode=0x0) [0068.915] GetLastError () returned 0x0 [0068.915] SetLastError (dwErrCode=0x0) [0068.915] GetLastError () returned 0x0 [0068.916] SetLastError (dwErrCode=0x0) [0068.916] GetLastError () returned 0x0 [0068.916] SetLastError (dwErrCode=0x0) [0068.916] GetLastError () returned 0x0 [0068.916] SetLastError (dwErrCode=0x0) [0068.916] GetLastError () returned 0x0 [0068.916] SetLastError (dwErrCode=0x0) [0068.916] GetLastError () returned 0x0 [0068.916] SetLastError (dwErrCode=0x0) [0068.916] GetLastError () returned 0x0 [0068.916] SetLastError (dwErrCode=0x0) [0068.916] GetLastError () returned 0x0 [0068.916] SetLastError (dwErrCode=0x0) [0068.916] GetLastError () returned 0x0 [0068.916] SetLastError (dwErrCode=0x0) [0068.916] GetLastError () returned 0x0 [0068.916] SetLastError (dwErrCode=0x0) [0068.916] GetLastError () returned 0x0 [0068.916] SetLastError (dwErrCode=0x0) [0068.916] GetLastError () returned 0x0 [0068.916] SetLastError (dwErrCode=0x0) [0068.916] GetLastError () returned 0x0 [0068.916] SetLastError (dwErrCode=0x0) [0068.917] GetLastError () returned 0x0 [0068.917] SetLastError (dwErrCode=0x0) [0068.917] GetLastError () returned 0x0 [0068.917] SetLastError (dwErrCode=0x0) [0068.917] GetLastError () returned 0x0 [0068.917] SetLastError (dwErrCode=0x0) [0068.917] GetLastError () returned 0x0 [0068.917] SetLastError (dwErrCode=0x0) [0068.917] GetLastError () returned 0x0 [0068.917] SetLastError (dwErrCode=0x0) [0068.917] GetLastError () returned 0x0 [0068.917] SetLastError (dwErrCode=0x0) [0068.917] GetLastError () returned 0x0 [0068.917] SetLastError (dwErrCode=0x0) [0068.917] GetLastError () returned 0x0 [0068.917] SetLastError (dwErrCode=0x0) [0068.917] GetLastError () returned 0x0 [0068.917] SetLastError (dwErrCode=0x0) [0068.917] GetLastError () returned 0x0 [0068.917] SetLastError (dwErrCode=0x0) [0068.917] GetLastError () returned 0x0 [0068.917] SetLastError (dwErrCode=0x0) [0068.917] GetLastError () returned 0x0 [0068.917] SetLastError (dwErrCode=0x0) [0068.918] GetLastError () returned 0x0 [0068.918] SetLastError (dwErrCode=0x0) [0068.918] GetLastError () returned 0x0 [0068.918] SetLastError (dwErrCode=0x0) [0068.918] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tempchhksm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x8bf6dc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e4 [0068.919] GetFileType (hFile=0x1e4) returned 0x1 [0068.920] ReadFile (in: hFile=0x1e4, lpBuffer=0x8af7f4, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af6e0, lpOverlapped=0x0 | out: lpBuffer=0x8af7f4*, lpNumberOfBytesRead=0x8af6e0*=0x10000, lpOverlapped=0x0) returned 1 [0068.921] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10000 [0068.921] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=65516, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffec [0068.921] ReadFile (in: hFile=0x1e4, lpBuffer=0x8af7f4, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af6e0, lpOverlapped=0x0 | out: lpBuffer=0x8af7f4*, lpNumberOfBytesRead=0x8af6e0*=0x10000, lpOverlapped=0x0) returned 1 [0068.922] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ffec [0068.922] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=131032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ffd8 [0068.922] ReadFile (in: hFile=0x1e4, lpBuffer=0x8af7f4, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af6e0, lpOverlapped=0x0 | out: lpBuffer=0x8af7f4*, lpNumberOfBytesRead=0x8af6e0*=0x10000, lpOverlapped=0x0) returned 1 [0068.923] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ffd8 [0068.923] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=196548, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2ffc4 [0068.923] ReadFile (in: hFile=0x1e4, lpBuffer=0x8af7f4, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af6e0, lpOverlapped=0x0 | out: lpBuffer=0x8af7f4*, lpNumberOfBytesRead=0x8af6e0*=0x10000, lpOverlapped=0x0) returned 1 [0068.923] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ffc4 [0068.923] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=262064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ffb0 [0068.923] ReadFile (in: hFile=0x1e4, lpBuffer=0x8af7f4, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af6e0, lpOverlapped=0x0 | out: lpBuffer=0x8af7f4*, lpNumberOfBytesRead=0x8af6e0*=0x10000, lpOverlapped=0x0) returned 1 [0068.925] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ffb0 [0068.925] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=327580, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ff9c [0068.925] ReadFile (in: hFile=0x1e4, lpBuffer=0x8af7f4, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af6e0, lpOverlapped=0x0 | out: lpBuffer=0x8af7f4*, lpNumberOfBytesRead=0x8af6e0*=0x10000, lpOverlapped=0x0) returned 1 [0068.926] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5ff9c [0068.926] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=393096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5ff88 [0068.926] ReadFile (in: hFile=0x1e4, lpBuffer=0x8af7f4, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af6e0, lpOverlapped=0x0 | out: lpBuffer=0x8af7f4*, lpNumberOfBytesRead=0x8af6e0*=0x10000, lpOverlapped=0x0) returned 1 [0068.926] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ff88 [0068.926] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=458612, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ff74 [0068.926] ReadFile (in: hFile=0x1e4, lpBuffer=0x8af7f4, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af6e0, lpOverlapped=0x0 | out: lpBuffer=0x8af7f4*, lpNumberOfBytesRead=0x8af6e0*=0x10000, lpOverlapped=0x0) returned 1 [0068.927] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ff74 [0068.927] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=524128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ff60 [0068.927] ReadFile (in: hFile=0x1e4, lpBuffer=0x8af7f4, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af6e0, lpOverlapped=0x0 | out: lpBuffer=0x8af7f4*, lpNumberOfBytesRead=0x8af6e0*=0x10000, lpOverlapped=0x0) returned 1 [0068.928] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ff60 [0068.928] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=589644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ff4c [0068.928] ReadFile (in: hFile=0x1e4, lpBuffer=0x8af7f4, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af6e0, lpOverlapped=0x0 | out: lpBuffer=0x8af7f4*, lpNumberOfBytesRead=0x8af6e0*=0x10000, lpOverlapped=0x0) returned 1 [0068.929] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ff4c [0068.929] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=655160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9ff38 [0068.929] ReadFile (in: hFile=0x1e4, lpBuffer=0x8af7f4, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af6e0, lpOverlapped=0x0 | out: lpBuffer=0x8af7f4*, lpNumberOfBytesRead=0x8af6e0*=0x10000, lpOverlapped=0x0) returned 1 [0068.929] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=665108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2614 [0068.930] ReadFile (in: hFile=0x1e4, lpBuffer=0x2d77148, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8af6c4, lpOverlapped=0x0 | out: lpBuffer=0x2d77148*, lpNumberOfBytesRead=0x8af6c4*=0x1000, lpOverlapped=0x0) returned 1 [0068.931] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bf6f4 | out: lpSystemTimeAsFileTime=0x8bf6f4*(dwLowDateTime=0x2b759b43, dwHighDateTime=0x1d47206)) [0068.931] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa3614 [0068.931] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=665128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2628 [0068.932] ReadFile (in: hFile=0x1e4, lpBuffer=0x2d77148, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8bedd0, lpOverlapped=0x0 | out: lpBuffer=0x2d77148*, lpNumberOfBytesRead=0x8bedd0*=0x200, lpOverlapped=0x0) returned 1 [0068.932] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bedbc | out: lpSystemTimeAsFileTime=0x8bedbc*(dwLowDateTime=0x2b759b43, dwHighDateTime=0x1d47206)) [0068.932] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bedbc | out: lpSystemTimeAsFileTime=0x8bedbc*(dwLowDateTime=0x2b759b43, dwHighDateTime=0x1d47206)) [0068.932] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bedbc | out: lpSystemTimeAsFileTime=0x8bedbc*(dwLowDateTime=0x2b759b43, dwHighDateTime=0x1d47206)) [0068.932] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2828 [0068.932] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=665273, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa26b9 [0068.932] ReadFile (in: hFile=0x1e4, lpBuffer=0x2d77148, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8bedd0, lpOverlapped=0x0 | out: lpBuffer=0x2d77148*, lpNumberOfBytesRead=0x8bedd0*=0x200, lpOverlapped=0x0) returned 1 [0068.932] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa28b9 [0068.932] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=681921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa67c1 [0068.933] ReadFile (in: hFile=0x1e4, lpBuffer=0x2d77148, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8bedd0, lpOverlapped=0x0 | out: lpBuffer=0x2d77148*, lpNumberOfBytesRead=0x8bedd0*=0x200, lpOverlapped=0x0) returned 1 [0068.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bedbc | out: lpSystemTimeAsFileTime=0x8bedbc*(dwLowDateTime=0x2b759b43, dwHighDateTime=0x1d47206)) [0068.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bedbc | out: lpSystemTimeAsFileTime=0x8bedbc*(dwLowDateTime=0x2b759b43, dwHighDateTime=0x1d47206)) [0068.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bedbc | out: lpSystemTimeAsFileTime=0x8bedbc*(dwLowDateTime=0x2b759b43, dwHighDateTime=0x1d47206)) [0068.933] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa69c1 [0068.933] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=682034, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa6832 [0068.933] ReadFile (in: hFile=0x1e4, lpBuffer=0x2d77148, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8bedd0, lpOverlapped=0x0 | out: lpBuffer=0x2d77148*, lpNumberOfBytesRead=0x8bedd0*=0x200, lpOverlapped=0x0) returned 1 [0068.933] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa6a32 [0068.933] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=844328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce228 [0068.934] ReadFile (in: hFile=0x1e4, lpBuffer=0x2d77148, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8bedd0, lpOverlapped=0x0 | out: lpBuffer=0x2d77148*, lpNumberOfBytesRead=0x8bedd0*=0x200, lpOverlapped=0x0) returned 1 [0068.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bedbc | out: lpSystemTimeAsFileTime=0x8bedbc*(dwLowDateTime=0x2b759b43, dwHighDateTime=0x1d47206)) [0068.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bedbc | out: lpSystemTimeAsFileTime=0x8bedbc*(dwLowDateTime=0x2b759b43, dwHighDateTime=0x1d47206)) [0068.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bedbc | out: lpSystemTimeAsFileTime=0x8bedbc*(dwLowDateTime=0x2b759b43, dwHighDateTime=0x1d47206)) [0068.934] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce428 [0068.934] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=844461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce2ad [0068.934] ReadFile (in: hFile=0x1e4, lpBuffer=0x2d77148, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8bedd0, lpOverlapped=0x0 | out: lpBuffer=0x2d77148*, lpNumberOfBytesRead=0x8bedd0*=0x200, lpOverlapped=0x0) returned 1 [0068.934] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce4ad [0068.934] SetFilePointer (in: hFile=0x1e4, lDistanceToMove=845919, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce85f [0068.935] ReadFile (in: hFile=0x1e4, lpBuffer=0x2d77148, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8bedd0, lpOverlapped=0x0 | out: lpBuffer=0x2d77148*, lpNumberOfBytesRead=0x8bedd0*=0x8, lpOverlapped=0x0) returned 1 [0068.935] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bedbc | out: lpSystemTimeAsFileTime=0x8bedbc*(dwLowDateTime=0x2b759b43, dwHighDateTime=0x1d47206)) [0068.935] CloseHandle (hObject=0x1e4) returned 1 [0068.936] IsDebuggerPresent () returned 0 [0068.936] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", nBufferLength=0x104, lpBuffer=0x4a7f6c, lpFilePart=0x8bf9ec | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", lpFilePart=0x8bf9ec*="TempCHHKSM.exe") returned 0x32 [0068.936] SHGetMalloc (in: ppMalloc=0x8bf9ec | out: ppMalloc=0x8bf9ec*=0x76fc5ee0) returned 0x0 [0068.936] SHGetDesktopFolder (in: ppshf=0x8bf9e8 | out: ppshf=0x8bf9e8*=0xa7e794) returned 0x0 [0068.943] IShellFolder:ParseDisplayName (in: This=0xa7e794, hwnd=0x0, pbc=0x0, pszDisplayName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", pchEaten=0x8bf9e0*=0x2d71948, ppidl=0x8bf9e4, pdwAttributes=0x0 | out: pchEaten=0x8bf9e0*=0x0, ppidl=0x8bf9e4, pdwAttributes=0x0) returned 0x0 [0068.957] SHGetPathFromIDListW (in: pidl=0xa85790, pszPath=0x8bf5c8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe") returned 1 [0068.965] IMalloc:Free (This=0x76fc5ee0, pv=0xa85790) [0068.965] IUnknown:Release (This=0xa7e794) returned 0x0 [0068.965] IUnknown:AddRef (This=0x76fc5ee0) returned 0x1 [0068.965] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", nBufferLength=0x104, lpBuffer=0x8bf7d8, lpFilePart=0x8bf9e8 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", lpFilePart=0x8bf9e8*="TempCHHKSM.exe") returned 0x32 [0068.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0068.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2d76a20, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0068.965] GetLastError () returned 0x0 [0068.966] SetLastError (dwErrCode=0x0) [0068.966] GetLastError () returned 0x0 [0068.966] SetLastError (dwErrCode=0x0) [0068.966] GetLastError () returned 0x0 [0068.966] SetLastError (dwErrCode=0x0) [0068.966] GetLastError () returned 0x0 [0068.966] SetLastError (dwErrCode=0x0) [0068.966] GetLastError () returned 0x0 [0068.966] SetLastError (dwErrCode=0x0) [0068.966] GetLastError () returned 0x0 [0068.966] SetLastError (dwErrCode=0x0) [0068.966] GetLastError () returned 0x0 [0068.966] SetLastError (dwErrCode=0x0) [0068.966] GetLastError () returned 0x0 [0068.966] SetLastError (dwErrCode=0x0) [0068.966] GetLastError () returned 0x0 [0068.966] SetLastError (dwErrCode=0x0) [0068.966] GetLastError () returned 0x0 [0068.966] SetLastError (dwErrCode=0x0) [0068.966] GetLastError () returned 0x0 [0068.966] SetLastError (dwErrCode=0x0) [0068.966] GetLastError () returned 0x0 [0068.967] SetLastError (dwErrCode=0x0) [0068.967] GetLastError () returned 0x0 [0068.967] SetLastError (dwErrCode=0x0) [0068.967] GetLastError () returned 0x0 [0068.967] SetLastError (dwErrCode=0x0) [0068.967] GetLastError () returned 0x0 [0068.967] SetLastError (dwErrCode=0x0) [0068.967] GetLastError () returned 0x0 [0068.967] SetLastError (dwErrCode=0x0) [0068.967] GetLastError () returned 0x0 [0068.967] SetLastError (dwErrCode=0x0) [0068.967] GetLastError () returned 0x0 [0068.967] SetLastError (dwErrCode=0x0) [0068.967] GetLastError () returned 0x0 [0068.967] SetLastError (dwErrCode=0x0) [0068.967] GetLastError () returned 0x0 [0068.967] SetLastError (dwErrCode=0x0) [0068.967] GetLastError () returned 0x0 [0068.967] SetLastError (dwErrCode=0x0) [0068.967] GetLastError () returned 0x0 [0068.967] SetLastError (dwErrCode=0x0) [0068.967] GetLastError () returned 0x0 [0068.967] SetLastError (dwErrCode=0x0) [0068.967] GetLastError () returned 0x0 [0068.968] SetLastError (dwErrCode=0x0) [0068.968] GetLastError () returned 0x0 [0068.968] SetLastError (dwErrCode=0x0) [0068.968] GetLastError () returned 0x0 [0068.968] SetLastError (dwErrCode=0x0) [0068.968] GetLastError () returned 0x0 [0068.968] SetLastError (dwErrCode=0x0) [0068.968] GetLastError () returned 0x0 [0068.968] SetLastError (dwErrCode=0x0) [0068.968] GetLastError () returned 0x0 [0068.968] SetLastError (dwErrCode=0x0) [0068.968] GetLastError () returned 0x0 [0068.968] SetLastError (dwErrCode=0x0) [0068.968] GetLastError () returned 0x0 [0068.968] SetLastError (dwErrCode=0x0) [0068.968] GetLastError () returned 0x0 [0068.968] SetLastError (dwErrCode=0x0) [0068.968] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tempchhksm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x8bf674, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x208 [0068.969] GetFileType (hFile=0x208) returned 0x1 [0068.969] ReadFile (in: hFile=0x208, lpBuffer=0x8af78c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af678, lpOverlapped=0x0 | out: lpBuffer=0x8af78c*, lpNumberOfBytesRead=0x8af678*=0x10000, lpOverlapped=0x0) returned 1 [0068.969] SetFilePointer (in: hFile=0x208, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10000 [0068.969] SetFilePointer (in: hFile=0x208, lDistanceToMove=65516, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffec [0068.969] ReadFile (in: hFile=0x208, lpBuffer=0x8af78c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af678, lpOverlapped=0x0 | out: lpBuffer=0x8af78c*, lpNumberOfBytesRead=0x8af678*=0x10000, lpOverlapped=0x0) returned 1 [0068.970] SetFilePointer (in: hFile=0x208, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ffec [0068.970] SetFilePointer (in: hFile=0x208, lDistanceToMove=131032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ffd8 [0068.970] ReadFile (in: hFile=0x208, lpBuffer=0x8af78c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af678, lpOverlapped=0x0 | out: lpBuffer=0x8af78c*, lpNumberOfBytesRead=0x8af678*=0x10000, lpOverlapped=0x0) returned 1 [0068.970] SetFilePointer (in: hFile=0x208, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ffd8 [0068.970] SetFilePointer (in: hFile=0x208, lDistanceToMove=196548, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2ffc4 [0068.970] ReadFile (in: hFile=0x208, lpBuffer=0x8af78c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af678, lpOverlapped=0x0 | out: lpBuffer=0x8af78c*, lpNumberOfBytesRead=0x8af678*=0x10000, lpOverlapped=0x0) returned 1 [0068.971] SetFilePointer (in: hFile=0x208, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ffc4 [0068.971] SetFilePointer (in: hFile=0x208, lDistanceToMove=262064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ffb0 [0068.971] ReadFile (in: hFile=0x208, lpBuffer=0x8af78c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af678, lpOverlapped=0x0 | out: lpBuffer=0x8af78c*, lpNumberOfBytesRead=0x8af678*=0x10000, lpOverlapped=0x0) returned 1 [0068.971] SetFilePointer (in: hFile=0x208, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ffb0 [0068.972] SetFilePointer (in: hFile=0x208, lDistanceToMove=327580, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ff9c [0068.972] ReadFile (in: hFile=0x208, lpBuffer=0x8af78c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af678, lpOverlapped=0x0 | out: lpBuffer=0x8af78c*, lpNumberOfBytesRead=0x8af678*=0x10000, lpOverlapped=0x0) returned 1 [0068.972] SetFilePointer (in: hFile=0x208, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5ff9c [0068.972] SetFilePointer (in: hFile=0x208, lDistanceToMove=393096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5ff88 [0068.972] ReadFile (in: hFile=0x208, lpBuffer=0x8af78c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af678, lpOverlapped=0x0 | out: lpBuffer=0x8af78c*, lpNumberOfBytesRead=0x8af678*=0x10000, lpOverlapped=0x0) returned 1 [0068.973] SetFilePointer (in: hFile=0x208, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ff88 [0068.973] SetFilePointer (in: hFile=0x208, lDistanceToMove=458612, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ff74 [0068.973] ReadFile (in: hFile=0x208, lpBuffer=0x8af78c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af678, lpOverlapped=0x0 | out: lpBuffer=0x8af78c*, lpNumberOfBytesRead=0x8af678*=0x10000, lpOverlapped=0x0) returned 1 [0068.973] SetFilePointer (in: hFile=0x208, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ff74 [0068.973] SetFilePointer (in: hFile=0x208, lDistanceToMove=524128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ff60 [0068.973] ReadFile (in: hFile=0x208, lpBuffer=0x8af78c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af678, lpOverlapped=0x0 | out: lpBuffer=0x8af78c*, lpNumberOfBytesRead=0x8af678*=0x10000, lpOverlapped=0x0) returned 1 [0068.974] SetFilePointer (in: hFile=0x208, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ff60 [0068.974] SetFilePointer (in: hFile=0x208, lDistanceToMove=589644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ff4c [0068.974] ReadFile (in: hFile=0x208, lpBuffer=0x8af78c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af678, lpOverlapped=0x0 | out: lpBuffer=0x8af78c*, lpNumberOfBytesRead=0x8af678*=0x10000, lpOverlapped=0x0) returned 1 [0068.974] SetFilePointer (in: hFile=0x208, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ff4c [0068.974] SetFilePointer (in: hFile=0x208, lDistanceToMove=655160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9ff38 [0068.974] ReadFile (in: hFile=0x208, lpBuffer=0x8af78c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8af678, lpOverlapped=0x0 | out: lpBuffer=0x8af78c*, lpNumberOfBytesRead=0x8af678*=0x10000, lpOverlapped=0x0) returned 1 [0068.975] SetFilePointer (in: hFile=0x208, lDistanceToMove=665108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2614 [0068.975] ReadFile (in: hFile=0x208, lpBuffer=0x2d77368, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8af65c, lpOverlapped=0x0 | out: lpBuffer=0x2d77368*, lpNumberOfBytesRead=0x8af65c*=0x1000, lpOverlapped=0x0) returned 1 [0068.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bf68c | out: lpSystemTimeAsFileTime=0x8bf68c*(dwLowDateTime=0x2b7cc2c4, dwHighDateTime=0x1d47206)) [0068.975] SetFilePointer (in: hFile=0x208, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa3614 [0068.975] SetFilePointer (in: hFile=0x208, lDistanceToMove=665128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2628 [0068.975] ReadFile (in: hFile=0x208, lpBuffer=0x2d77368, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8bed68, lpOverlapped=0x0 | out: lpBuffer=0x2d77368*, lpNumberOfBytesRead=0x8bed68*=0x200, lpOverlapped=0x0) returned 1 [0068.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bed54 | out: lpSystemTimeAsFileTime=0x8bed54*(dwLowDateTime=0x2b7cc2c4, dwHighDateTime=0x1d47206)) [0068.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bed54 | out: lpSystemTimeAsFileTime=0x8bed54*(dwLowDateTime=0x2b7cc2c4, dwHighDateTime=0x1d47206)) [0068.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bed54 | out: lpSystemTimeAsFileTime=0x8bed54*(dwLowDateTime=0x2b7cc2c4, dwHighDateTime=0x1d47206)) [0068.976] SetFilePointer (in: hFile=0x208, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2828 [0068.976] SetFilePointer (in: hFile=0x208, lDistanceToMove=665301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa26d5 [0068.977] ReadFile (in: hFile=0x208, lpBuffer=0x2d78370, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x8bf1c8, lpOverlapped=0x0 | out: lpBuffer=0x2d78370*, lpNumberOfBytesRead=0x8bf1c8*=0x4000, lpOverlapped=0x0) returned 1 [0068.978] ReadFile (in: hFile=0x208, lpBuffer=0x2d77368, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8bf1b8, lpOverlapped=0x0 | out: lpBuffer=0x2d77368*, lpNumberOfBytesRead=0x8bf1b8*=0x200, lpOverlapped=0x0) returned 1 [0068.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8bf1a4 | out: lpSystemTimeAsFileTime=0x8bf1a4*(dwLowDateTime=0x2b7cc2c4, dwHighDateTime=0x1d47206)) [0069.011] CloseHandle (hObject=0x208) returned 1 [0069.011] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", nBufferLength=0x104, lpBuffer=0x8bfa78, lpFilePart=0x4a7f50 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", lpFilePart=0x4a7f50*="TempCHHKSM.exe") returned 0x32 [0069.011] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0069.011] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0069.011] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0069.011] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A1600E02A1D", cchLength=0xb | out: lpsz="A1600E02A1D") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A1600E02A1D", cchLength=0xb | out: lpsz="A1600E02A1D") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A3B10003E4A", cchLength=0xb | out: lpsz="A3B10003E4A") returned 0xb [0069.012] CharUpperBuffW (in: lpsz="A3B10003E4A", cchLength=0xb | out: lpsz="A3B10003E4A") returned 0xb [0069.013] CharUpperBuffW (in: lpsz="A5F0000370B_", cchLength=0xc | out: lpsz="A5F0000370B_") returned 0xc [0069.013] CharUpperBuffW (in: lpsz="A5F0000370B_", cchLength=0xc | out: lpsz="A5F0000370B_") returned 0xc [0069.013] CharUpperBuffW (in: lpsz="A5F0000370BX_", cchLength=0xd | out: lpsz="A5F0000370BX_") returned 0xd [0069.013] CharUpperBuffW (in: lpsz="A5F0000370BX_", cchLength=0xd | out: lpsz="A5F0000370BX_") returned 0xd [0069.013] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.013] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.013] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", nBufferLength=0x104, lpBuffer=0x8bf840, lpFilePart=0x8bfa54 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", lpFilePart=0x8bfa54*="TempCHHKSM.exe") returned 0x32 [0069.013] GetSysColorBrush (nIndex=15) returned 0x1100074 [0069.013] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0069.013] LoadIconW (hInstance=0x400000, lpIconName=0x63) returned 0x2d0157 [0069.015] LoadIconW (hInstance=0x400000, lpIconName=0xa4) returned 0x1401c7 [0069.016] LoadIconW (hInstance=0x400000, lpIconName=0xa2) returned 0x2700e9 [0069.017] LoadImageW (hInst=0x400000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x80205 [0069.019] RegisterClassExW (param_1=0x8bfa30) returned 0xc179 [0069.019] GetSysColorBrush (nIndex=15) returned 0x1100074 [0069.019] RegisterClassExW (param_1=0x8bf9d8) returned 0xc17a [0069.019] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc078 [0069.019] InitCommonControlsEx (picce=0x8bfa08) returned 1 [0069.028] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0xa8b350 [0069.032] LoadIconW (hInstance=0x400000, lpIconName=0xa9) returned 0x440201 [0069.033] ImageList_ReplaceIcon (himl=0xa8b350, i=-1, hicon=0x440201) returned 0 [0069.044] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x3021a [0069.045] DefWindowProcW (hWnd=0x3021a, Msg=0x24, wParam=0x0, lParam=0x8bf5ec) returned 0x0 [0069.045] DefWindowProcW (hWnd=0x3021a, Msg=0x81, wParam=0x0, lParam=0x8bf5e0) returned 0x1 [0069.051] DefWindowProcW (hWnd=0x3021a, Msg=0x83, wParam=0x0, lParam=0x8bf5cc) returned 0x0 [0069.291] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0069.291] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc078 [0069.291] CreatePopupMenu () returned 0x18010d [0069.292] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x3021a, hMenu=0x1, hInstance=0x400000, lpParam=0x0) returned 0x20216 [0069.349] DefWindowProcW (hWnd=0x3021a, Msg=0x210, wParam=0x10001, lParam=0x20216) returned 0x0 [0069.349] ShowWindow (hWnd=0x3021a, nCmdShow=0) returned 0 [0069.350] ShowWindow (hWnd=0x3021a, nCmdShow=0) returned 0 [0069.350] CharUpperBuffW (in: lpsz="A5F0000370B_", cchLength=0xc | out: lpsz="A5F0000370B_") returned 0xc [0069.350] PeekMessageW (in: lpMsg=0x8bf7b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf7b0) returned 1 [0069.351] TranslateMessage (lpMsg=0x8bf7b0) returned 0 [0069.351] DispatchMessageW (lpMsg=0x8bf7b0) returned 0x0 [0069.351] DefWindowProcW (hWnd=0x3021a, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0069.351] PeekMessageW (in: lpMsg=0x8bf7b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf7b0) returned 0 [0069.351] PeekMessageW (in: lpMsg=0x8bf7b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf7b0) returned 0 [0069.352] CharUpperBuffW (in: lpsz="A5F0000370BX_", cchLength=0xd | out: lpsz="A5F0000370BX_") returned 0xd [0069.352] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.352] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.352] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.352] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.353] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.353] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.354] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.355] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.356] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.356] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] PeekMessageW (in: lpMsg=0x8bedf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedf0) returned 0 [0069.356] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.356] CharUpperBuffW (in: lpsz="TempDir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0069.357] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bec30 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0069.357] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.357] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0069.357] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.357] SetLastError (dwErrCode=0x0) [0069.357] GetLastError () returned 0x0 [0069.357] SetLastError (dwErrCode=0x0) [0069.357] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.357] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.357] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.357] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.358] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.359] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\ueiephm" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\ueiephm")) returned 0xffffffff [0069.359] FindFirstFileW (in: lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\ueiephm", lpFindFileData=0x8bee60 | out: lpFindFileData=0x8bee60) returned 0xffffffff [0069.359] PeekMessageW (in: lpMsg=0x8bf2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf2d0) returned 0 [0069.359] PeekMessageW (in: lpMsg=0x8bf7b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf7b0) returned 0 [0069.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0069.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2c79578, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0069.360] SetLastError (dwErrCode=0x2) [0069.360] GetLastError () returned 0x2 [0069.360] SetLastError (dwErrCode=0x2) [0069.360] GetLastError () returned 0x2 [0069.360] SetLastError (dwErrCode=0x2) [0069.360] GetLastError () returned 0x2 [0069.360] SetLastError (dwErrCode=0x2) [0069.360] GetLastError () returned 0x2 [0069.360] SetLastError (dwErrCode=0x2) [0069.360] GetLastError () returned 0x2 [0069.360] SetLastError (dwErrCode=0x2) [0069.360] GetLastError () returned 0x2 [0069.360] SetLastError (dwErrCode=0x2) [0069.360] GetLastError () returned 0x2 [0069.360] SetLastError (dwErrCode=0x2) [0069.360] GetLastError () returned 0x2 [0069.360] SetLastError (dwErrCode=0x2) [0069.360] GetLastError () returned 0x2 [0069.360] SetLastError (dwErrCode=0x2) [0069.360] GetLastError () returned 0x2 [0069.361] SetLastError (dwErrCode=0x2) [0069.361] GetLastError () returned 0x2 [0069.361] SetLastError (dwErrCode=0x2) [0069.361] GetLastError () returned 0x2 [0069.361] SetLastError (dwErrCode=0x2) [0069.361] GetLastError () returned 0x2 [0069.361] SetLastError (dwErrCode=0x2) [0069.361] GetLastError () returned 0x2 [0069.361] SetLastError (dwErrCode=0x2) [0069.361] GetLastError () returned 0x2 [0069.361] SetLastError (dwErrCode=0x2) [0069.361] GetLastError () returned 0x2 [0069.361] SetLastError (dwErrCode=0x2) [0069.361] GetLastError () returned 0x2 [0069.361] SetLastError (dwErrCode=0x2) [0069.361] GetLastError () returned 0x2 [0069.361] SetLastError (dwErrCode=0x2) [0069.361] GetLastError () returned 0x2 [0069.361] SetLastError (dwErrCode=0x2) [0069.361] GetLastError () returned 0x2 [0069.361] SetLastError (dwErrCode=0x2) [0069.361] GetLastError () returned 0x2 [0069.361] SetLastError (dwErrCode=0x2) [0069.361] GetLastError () returned 0x2 [0069.362] SetLastError (dwErrCode=0x2) [0069.362] GetLastError () returned 0x2 [0069.362] SetLastError (dwErrCode=0x2) [0069.362] GetLastError () returned 0x2 [0069.362] SetLastError (dwErrCode=0x2) [0069.362] GetLastError () returned 0x2 [0069.362] SetLastError (dwErrCode=0x2) [0069.362] GetLastError () returned 0x2 [0069.362] SetLastError (dwErrCode=0x2) [0069.362] GetLastError () returned 0x2 [0069.363] SetLastError (dwErrCode=0x2) [0069.363] GetLastError () returned 0x2 [0069.363] SetLastError (dwErrCode=0x2) [0069.363] GetLastError () returned 0x2 [0069.363] SetLastError (dwErrCode=0x2) [0069.363] GetLastError () returned 0x2 [0069.363] SetLastError (dwErrCode=0x2) [0069.363] GetLastError () returned 0x2 [0069.363] SetLastError (dwErrCode=0x2) [0069.363] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tempchhksm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x8be9a4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x21c [0069.363] GetFileType (hFile=0x21c) returned 0x1 [0069.364] ReadFile (in: hFile=0x21c, lpBuffer=0x8aeabc, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8ae9a8, lpOverlapped=0x0 | out: lpBuffer=0x8aeabc*, lpNumberOfBytesRead=0x8ae9a8*=0x10000, lpOverlapped=0x0) returned 1 [0069.364] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10000 [0069.364] SetFilePointer (in: hFile=0x21c, lDistanceToMove=65516, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffec [0069.364] ReadFile (in: hFile=0x21c, lpBuffer=0x8aeabc, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8ae9a8, lpOverlapped=0x0 | out: lpBuffer=0x8aeabc*, lpNumberOfBytesRead=0x8ae9a8*=0x10000, lpOverlapped=0x0) returned 1 [0069.364] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ffec [0069.364] SetFilePointer (in: hFile=0x21c, lDistanceToMove=131032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ffd8 [0069.364] ReadFile (in: hFile=0x21c, lpBuffer=0x8aeabc, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8ae9a8, lpOverlapped=0x0 | out: lpBuffer=0x8aeabc*, lpNumberOfBytesRead=0x8ae9a8*=0x10000, lpOverlapped=0x0) returned 1 [0069.365] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ffd8 [0069.365] SetFilePointer (in: hFile=0x21c, lDistanceToMove=196548, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2ffc4 [0069.365] ReadFile (in: hFile=0x21c, lpBuffer=0x8aeabc, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8ae9a8, lpOverlapped=0x0 | out: lpBuffer=0x8aeabc*, lpNumberOfBytesRead=0x8ae9a8*=0x10000, lpOverlapped=0x0) returned 1 [0069.365] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ffc4 [0069.365] SetFilePointer (in: hFile=0x21c, lDistanceToMove=262064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ffb0 [0069.365] ReadFile (in: hFile=0x21c, lpBuffer=0x8aeabc, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8ae9a8, lpOverlapped=0x0 | out: lpBuffer=0x8aeabc*, lpNumberOfBytesRead=0x8ae9a8*=0x10000, lpOverlapped=0x0) returned 1 [0069.366] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ffb0 [0069.366] SetFilePointer (in: hFile=0x21c, lDistanceToMove=327580, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ff9c [0069.366] ReadFile (in: hFile=0x21c, lpBuffer=0x8aeabc, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8ae9a8, lpOverlapped=0x0 | out: lpBuffer=0x8aeabc*, lpNumberOfBytesRead=0x8ae9a8*=0x10000, lpOverlapped=0x0) returned 1 [0069.366] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5ff9c [0069.366] SetFilePointer (in: hFile=0x21c, lDistanceToMove=393096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5ff88 [0069.366] ReadFile (in: hFile=0x21c, lpBuffer=0x8aeabc, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8ae9a8, lpOverlapped=0x0 | out: lpBuffer=0x8aeabc*, lpNumberOfBytesRead=0x8ae9a8*=0x10000, lpOverlapped=0x0) returned 1 [0069.367] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ff88 [0069.367] SetFilePointer (in: hFile=0x21c, lDistanceToMove=458612, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ff74 [0069.367] ReadFile (in: hFile=0x21c, lpBuffer=0x8aeabc, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8ae9a8, lpOverlapped=0x0 | out: lpBuffer=0x8aeabc*, lpNumberOfBytesRead=0x8ae9a8*=0x10000, lpOverlapped=0x0) returned 1 [0069.367] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ff74 [0069.367] SetFilePointer (in: hFile=0x21c, lDistanceToMove=524128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ff60 [0069.367] ReadFile (in: hFile=0x21c, lpBuffer=0x8aeabc, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8ae9a8, lpOverlapped=0x0 | out: lpBuffer=0x8aeabc*, lpNumberOfBytesRead=0x8ae9a8*=0x10000, lpOverlapped=0x0) returned 1 [0069.367] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ff60 [0069.367] SetFilePointer (in: hFile=0x21c, lDistanceToMove=589644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ff4c [0069.367] ReadFile (in: hFile=0x21c, lpBuffer=0x8aeabc, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8ae9a8, lpOverlapped=0x0 | out: lpBuffer=0x8aeabc*, lpNumberOfBytesRead=0x8ae9a8*=0x10000, lpOverlapped=0x0) returned 1 [0069.367] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ff4c [0069.367] SetFilePointer (in: hFile=0x21c, lDistanceToMove=655160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9ff38 [0069.368] ReadFile (in: hFile=0x21c, lpBuffer=0x8aeabc, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8ae9a8, lpOverlapped=0x0 | out: lpBuffer=0x8aeabc*, lpNumberOfBytesRead=0x8ae9a8*=0x10000, lpOverlapped=0x0) returned 1 [0069.368] SetFilePointer (in: hFile=0x21c, lDistanceToMove=665108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2614 [0069.368] ReadFile (in: hFile=0x21c, lpBuffer=0x2d77368, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8ae98c, lpOverlapped=0x0 | out: lpBuffer=0x2d77368*, lpNumberOfBytesRead=0x8ae98c*=0x1000, lpOverlapped=0x0) returned 1 [0069.368] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa3614 [0069.368] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\ueiephm" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\ueiephm")) returned 0xffffffff [0069.368] FindFirstFileW (in: lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\ueiephm", lpFindFileData=0x8bea28 | out: lpFindFileData=0x8bea28) returned 0xffffffff [0069.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8ada9c | out: lpSystemTimeAsFileTime=0x8ada9c*(dwLowDateTime=0x2bb85f69, dwHighDateTime=0x1d47206)) [0069.368] SetFilePointer (in: hFile=0x21c, lDistanceToMove=665128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2628 [0069.368] ReadFile (in: hFile=0x21c, lpBuffer=0x2d77368, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8ad560, lpOverlapped=0x0 | out: lpBuffer=0x2d77368*, lpNumberOfBytesRead=0x8ad560*=0x200, lpOverlapped=0x0) returned 1 [0069.368] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2828 [0069.369] SetFilePointer (in: hFile=0x21c, lDistanceToMove=665273, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa26b9 [0069.369] ReadFile (in: hFile=0x21c, lpBuffer=0x2d77368, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8ad560, lpOverlapped=0x0 | out: lpBuffer=0x2d77368*, lpNumberOfBytesRead=0x8ad560*=0x200, lpOverlapped=0x0) returned 1 [0069.369] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa28b9 [0069.369] SetFilePointer (in: hFile=0x21c, lDistanceToMove=681921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa67c1 [0069.369] ReadFile (in: hFile=0x21c, lpBuffer=0x2d77368, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8ad560, lpOverlapped=0x0 | out: lpBuffer=0x2d77368*, lpNumberOfBytesRead=0x8ad560*=0x200, lpOverlapped=0x0) returned 1 [0069.369] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa69c1 [0069.369] SetFilePointer (in: hFile=0x21c, lDistanceToMove=682034, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa6832 [0069.369] ReadFile (in: hFile=0x21c, lpBuffer=0x2d77368, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8ad560, lpOverlapped=0x0 | out: lpBuffer=0x2d77368*, lpNumberOfBytesRead=0x8ad560*=0x200, lpOverlapped=0x0) returned 1 [0069.369] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa6a32 [0069.369] SetFilePointer (in: hFile=0x21c, lDistanceToMove=844328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce228 [0069.369] ReadFile (in: hFile=0x21c, lpBuffer=0x2d77368, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8ad560, lpOverlapped=0x0 | out: lpBuffer=0x2d77368*, lpNumberOfBytesRead=0x8ad560*=0x200, lpOverlapped=0x0) returned 1 [0069.369] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8ad8b0 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0069.369] GetTempFileNameW (in: lpPathName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\", lpPrefixString="aut", uUnique=0x0, lpTempFileName=0x8adf70 | out: lpTempFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\aut475F.tmp" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\aut475f.tmp")) returned 0x475f [0069.373] CreateFileW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\aut475F.tmp" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\aut475f.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x8ad984, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x220 [0069.374] GetFileType (hFile=0x220) returned 0x1 [0069.374] ReadFile (in: hFile=0x21c, lpBuffer=0x2d77368, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8ad9b0, lpOverlapped=0x0 | out: lpBuffer=0x2d77368*, lpNumberOfBytesRead=0x8ad9b0*=0x43f, lpOverlapped=0x0) returned 1 [0069.374] WriteFile (in: hFile=0x220, lpBuffer=0x2c7ed38*, nNumberOfBytesToWrite=0x596, lpNumberOfBytesWritten=0x8abf34, lpOverlapped=0x0 | out: lpBuffer=0x2c7ed38*, lpNumberOfBytesWritten=0x8abf34*=0x596, lpOverlapped=0x0) returned 1 [0069.375] CloseHandle (hObject=0x220) returned 1 [0069.376] CreateFileW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\aut475F.tmp" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\aut475f.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x8ad970, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x220 [0069.376] GetFileType (hFile=0x220) returned 0x1 [0069.376] CreateFileW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\ueiephm" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\ueiephm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x8ad970, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0069.377] GetFileType (hFile=0x224) returned 0x1 [0069.377] ReadFile (in: hFile=0x220, lpBuffer=0x2c7ed38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8ad980, lpOverlapped=0x0 | out: lpBuffer=0x2c7ed38*, lpNumberOfBytesRead=0x8ad980*=0x596, lpOverlapped=0x0) returned 1 [0069.378] ReadFile (in: hFile=0x220, lpBuffer=0x2bf05d6, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x8ad968, lpOverlapped=0x0 | out: lpBuffer=0x2bf05d6*, lpNumberOfBytesRead=0x8ad968*=0x0, lpOverlapped=0x0) returned 1 [0069.379] WriteFile (in: hFile=0x224, lpBuffer=0x2c9fd48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8abee4, lpOverlapped=0x0 | out: lpBuffer=0x2c9fd48*, lpNumberOfBytesWritten=0x8abee4*=0x1000, lpOverlapped=0x0) returned 1 [0069.382] CloseHandle (hObject=0x220) returned 1 [0069.382] WriteFile (in: hFile=0x224, lpBuffer=0x2cafd50*, nNumberOfBytesToWrite=0xd6a, lpNumberOfBytesWritten=0x8abf1c, lpOverlapped=0x0 | out: lpBuffer=0x2cafd50*, lpNumberOfBytesWritten=0x8abf1c*=0xd6a, lpOverlapped=0x0) returned 1 [0069.382] CloseHandle (hObject=0x224) returned 1 [0069.383] DeleteFileW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\aut475F.tmp" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\aut475f.tmp")) returned 1 [0069.384] CreateFileW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\ueiephm" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\ueiephm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0069.384] SetFileTime (hFile=0x224, lpCreationTime=0x8adaf8, lpLastAccessTime=0x0, lpLastWriteTime=0x8adb00) returned 1 [0069.384] CloseHandle (hObject=0x224) returned 1 [0069.385] CloseHandle (hObject=0x21c) returned 1 [0069.385] PeekMessageW (in: lpMsg=0x8bf7b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf7b0) returned 0 [0069.385] CharUpperBuffW (in: lpsz="Execute", cchLength=0x7 | out: lpsz="EXECUTE") returned 0x7 [0069.385] CharUpperBuffW (in: lpsz="Binarytostring", cchLength=0xe | out: lpsz="BINARYTOSTRING") returned 0xe [0069.386] CharUpperBuffW (in: lpsz="Execute", cchLength=0x7 | out: lpsz="EXECUTE") returned 0x7 [0069.386] CharUpperBuffW (in: lpsz="Binarytostring", cchLength=0xe | out: lpsz="BINARYTOSTRING") returned 0xe [0069.386] CharUpperBuffW (in: lpsz="StringSplit", cchLength=0xb | out: lpsz="STRINGSPLIT") returned 0xb [0069.386] CharUpperBuffW (in: lpsz="FileRead", cchLength=0x8 | out: lpsz="FILEREAD") returned 0x8 [0069.386] CharUpperBuffW (in: lpsz="A5F0000370Bsz_", cchLength=0xe | out: lpsz="A5F0000370BSZ_") returned 0xe [0069.386] CreateFileW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\ueiephm" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\ueiephm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x21c [0069.386] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.386] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bef44 | out: lpNewFilePointer=0x0) returned 1 [0069.386] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bef58 | out: lpNewFilePointer=0x0) returned 1 [0069.386] ReadFile (in: hFile=0x21c, lpBuffer=0x2bf0048, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bef6c, lpOverlapped=0x0 | out: lpBuffer=0x2bf0048*, lpNumberOfBytesRead=0x8bef6c*=0x1d6a, lpOverlapped=0x0) returned 1 [0069.387] ReadFile (in: hFile=0x21c, lpBuffer=0x2bf0048, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bef6c, lpOverlapped=0x0 | out: lpBuffer=0x2bf0048*, lpNumberOfBytesRead=0x8bef6c*=0x0, lpOverlapped=0x0) returned 1 [0069.387] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.388] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bef50 | out: lpNewFilePointer=0x0) returned 1 [0069.388] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.388] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bef50 | out: lpNewFilePointer=0x0) returned 1 [0069.388] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bef14 | out: lpNewFilePointer=0x0) returned 1 [0069.388] ReadFile (in: hFile=0x21c, lpBuffer=0x2bf0048, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bef28, lpOverlapped=0x0 | out: lpBuffer=0x2bf0048*, lpNumberOfBytesRead=0x8bef28*=0x1d6a, lpOverlapped=0x0) returned 1 [0069.389] CloseHandle (hObject=0x21c) returned 1 [0069.391] PeekMessageW (in: lpMsg=0x8bf7b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf7b0) returned 0 [0069.391] PeekMessageW (in: lpMsg=0x8bf7b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf7b0) returned 0 [0069.391] CharUpperBuffW (in: lpsz="Execute", cchLength=0x7 | out: lpsz="EXECUTE") returned 0x7 [0069.391] CharUpperBuffW (in: lpsz="Binarytostring", cchLength=0xe | out: lpsz="BINARYTOSTRING") returned 0xe [0069.391] CharUpperBuffW (in: lpsz="Execute", cchLength=0x7 | out: lpsz="EXECUTE") returned 0x7 [0069.391] CharUpperBuffW (in: lpsz="Binarytostring", cchLength=0xe | out: lpsz="BINARYTOSTRING") returned 0xe [0069.391] CharUpperBuffW (in: lpsz="FileDelete", cchLength=0xa | out: lpsz="FILEDELETE") returned 0xa [0069.392] CharUpperBuffW (in: lpsz="A5F0000370Bsz_", cchLength=0xe | out: lpsz="A5F0000370BSZ_") returned 0xe [0069.392] GetFullPathNameW (in: lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\ueiephm", nBufferLength=0x104, lpBuffer=0x8be8e8, lpFilePart=0x8be8c4 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\ueiephm", lpFilePart=0x8be8c4*="ueiephm") returned 0x2c [0069.392] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\ueiephm" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\ueiephm")) returned 0x20 [0069.392] FindFirstFileW (in: lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\ueiephm", lpFindFileData=0x8beaf8 | out: lpFindFileData=0x8beaf8) returned 0xa7c9a8 [0069.392] DeleteFileW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\ueiephm" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\ueiephm")) returned 1 [0069.394] FindNextFileW (in: hFindFile=0xa7c9a8, lpFindFileData=0x8beaf8 | out: lpFindFileData=0x8beaf8) returned 0 [0069.394] FindClose (in: hFindFile=0xa7c9a8 | out: hFindFile=0xa7c9a8) returned 1 [0069.394] PeekMessageW (in: lpMsg=0x8bf7b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf7b0) returned 0 [0069.394] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0069.394] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0069.394] CharUpperBuffW (in: lpsz="Os", cchLength=0x2 | out: lpsz="OS") returned 0x2 [0069.394] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0069.395] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.395] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.396] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.397] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.398] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.401] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.402] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.403] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.404] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.410] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.411] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0069.411] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.411] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.411] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.513] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.513] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.514] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.514] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.514] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.514] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.514] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.514] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.514] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.555] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.555] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.555] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.555] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.555] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.594] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.594] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.594] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.594] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.599] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.599] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.600] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.600] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.600] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.600] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.600] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.600] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.604] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.604] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.604] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.616] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.616] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.616] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.659] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.659] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.660] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.660] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.701] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.701] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.701] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.701] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.701] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.760] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.760] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.760] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.760] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.760] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.827] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.827] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.827] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.827] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.868] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.868] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.906] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.906] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.907] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.907] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.907] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.907] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.907] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.907] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.912] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.912] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.912] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.912] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.913] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.913] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.913] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.913] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.913] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.913] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.954] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.954] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.955] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.955] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.955] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.955] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.955] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.955] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.960] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.960] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.960] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.960] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.960] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.960] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.971] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.971] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.971] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.972] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.972] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.972] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.976] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.976] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.976] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.977] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.977] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.977] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.978] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.979] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.979] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.979] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.979] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.979] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.982] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.982] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.982] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.982] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.982] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.982] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.984] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.984] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.984] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.984] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.984] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.986] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.986] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.986] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.986] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.993] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.993] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.993] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.993] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.993] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.993] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.993] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.994] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.997] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.997] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.997] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.997] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.997] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0069.997] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.000] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.000] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.001] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.001] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.001] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.003] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.003] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.003] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.003] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.004] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.005] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.005] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.005] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.005] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.005] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.005] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.005] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.010] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.010] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.010] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.010] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.011] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.012] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.012] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.012] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.013] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.013] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.013] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.015] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.015] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.015] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.015] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.017] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.017] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.017] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.017] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.017] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.078] TranslateMessage (lpMsg=0x8bf488) returned 0 [0070.078] DispatchMessageW (lpMsg=0x8bf488) returned 0x0 [0070.078] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0070.078] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0070.078] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.078] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.078] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.078] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.079] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.080] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.081] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.081] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.081] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.081] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.081] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.081] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.081] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.081] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.081] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.081] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.081] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.082] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.083] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.084] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.085] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.086] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.086] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.086] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.086] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.086] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.086] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.086] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.086] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.086] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.086] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.086] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.086] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.086] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.086] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.086] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.188] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.189] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.190] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.190] PeekMessageW (in: lpMsg=0x8bf488, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf488) returned 0 [0070.190] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.307] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.307] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.307] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.307] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.307] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.307] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.307] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.435] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.435] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.436] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.436] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.436] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.436] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.560] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.560] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.561] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.596] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.596] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.599] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.599] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.599] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.604] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.604] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.604] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.604] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.604] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.604] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.604] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.606] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.606] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.606] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.630] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.630] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.630] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.631] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.631] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.631] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.631] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.631] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.632] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.632] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.632] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.632] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.632] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.632] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.632] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.637] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.637] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.637] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.638] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.638] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.638] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0070.638] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0070.638] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0070.639] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0070.639] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0070.639] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0070.639] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0070.639] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0070.639] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0070.639] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0070.639] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0070.639] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0070.639] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0070.639] CharUpperBuffW (in: lpsz="A1600E02A1D", cchLength=0xb | out: lpsz="A1600E02A1D") returned 0xb [0070.639] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0070.639] CharUpperBuffW (in: lpsz="TempDir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0070.639] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0070.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/wl.jpg", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", lpFilePart=0x8bedf4*="wl.jpg") returned 0x2b [0070.639] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\wl.jpg")) returned 0xffffffff [0070.640] FindFirstFileW (in: lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xffffffff [0070.640] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0070.640] GetLastError () returned 0x6 [0070.640] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0070.640] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0070.640] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0070.640] CharUpperBuffW (in: lpsz="A3B10003E4A", cchLength=0xb | out: lpsz="A3B10003E4A") returned 0xb [0070.640] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0070.640] CharUpperBuffW (in: lpsz="SSA3B10003E4A", cchLength=0xd | out: lpsz="SSA3B10003E4A") returned 0xd [0070.640] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0070.640] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.640] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.640] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.641] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.642] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.643] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.643] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.643] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.644] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.645] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.646] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.647] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.648] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.648] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.648] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.648] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.648] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.648] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.648] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.648] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.648] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.648] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.648] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.648] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.648] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.648] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.648] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.649] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.650] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.652] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0070.653] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.653] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.653] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.653] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.653] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.653] CharUpperBuffW (in: lpsz="Compiled", cchLength=0x8 | out: lpsz="COMPILED") returned 0x8 [0070.653] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0070.654] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x75260000 [0070.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentProcess", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0070.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentProcess", cchWideChar=18, lpMultiByteStr=0x2c7a978, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentProcess", lpUsedDefaultChar=0x0) returned 18 [0070.654] GetProcAddress (hModule=0x75260000, lpProcName="GetCurrentProcess") returned 0x75272da0 [0070.654] FreeLibrary (hLibModule=0x75260000) returned 1 [0070.654] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0070.655] CharLowerBuffW (in: lpsz="Byte[4]", cchLength=0x7 | out: lpsz="byte[4]") returned 0x7 [0070.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0070.656] CharLowerBuffW (in: lpsz="none", cchLength=0x4 | out: lpsz="none") returned 0x4 [0070.656] LoadLibraryW (lpLibFileName="ntdll.dll") returned 0x77ca0000 [0070.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZwSetInformationProcess", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0070.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZwSetInformationProcess", cchWideChar=24, lpMultiByteStr=0x2c7ac38, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZwSetInformationProcess", lpUsedDefaultChar=0x0) returned 24 [0070.656] GetProcAddress (hModule=0x77ca0000, lpProcName="ZwSetInformationProcess") returned 0x77d08da0 [0070.656] FreeLibrary (hLibModule=0x77ca0000) returned 1 [0070.656] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0070.656] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0070.656] CharUpperBuffW (in: lpsz="A3B10003E4A", cchLength=0xb | out: lpsz="A3B10003E4A") returned 0xb [0070.656] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0070.656] CharUpperBuffW (in: lpsz="A1600E02A1D", cchLength=0xb | out: lpsz="A1600E02A1D") returned 0xb [0070.656] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0070.657] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf2b8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0070.658] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.658] CharUpperBuffW (in: lpsz="SSA1600E02A1D", cchLength=0xd | out: lpsz="SSA1600E02A1D") returned 0xd [0070.658] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.658] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.658] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.658] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.658] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.658] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.658] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.658] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.658] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.658] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.659] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.659] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.659] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.659] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.659] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.662] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.662] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.662] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.662] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.662] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.662] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.662] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.662] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.662] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.662] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.662] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.662] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.662] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.662] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.663] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.664] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.665] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.666] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.667] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.667] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.667] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.670] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.673] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.675] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.675] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.676] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.676] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.677] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.677] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0070.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x2bf3a50, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/]+\\z", lpUsedDefaultChar=0x0) returned 9 [0070.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\Desktop", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0070.679] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\Desktop", cchWideChar=30, lpMultiByteStr=0x2c005c0, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpUsedDefaultChar=0x0) returned 30 [0070.680] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.680] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0070.680] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0070.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x2c7ac38, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", lpUsedDefaultChar=0x0) returned 23 [0070.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x2c83780, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.*", lpUsedDefaultChar=0x0) returned 4 [0070.681] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.681] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.681] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0xa7d0e8 [0070.681] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.681] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.681] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.681] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.681] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.681] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.681] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0070.681] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.681] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.681] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.681] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.682] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.682] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.682] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.682] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.682] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.682] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.682] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.682] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.682] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.682] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.682] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.682] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.682] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.682] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0070.683] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0 [0070.683] FindClose (in: hFindFile=0xa7d0e8 | out: hFindFile=0xa7d0e8) returned 1 [0070.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-2zElut.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0070.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2zElut.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0070.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zElut.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0070.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Elut.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0070.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lut.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0070.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ut.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0070.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0070.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-2zElut.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0070.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2zElut.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0070.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zElut.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0070.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Elut.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0070.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lut.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0070.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ut.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0070.684] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0070.684] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0070.684] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0070.684] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0070.684] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0070.684] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0070.684] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.685] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.685] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.685] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.685] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.685] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.685] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.685] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.685] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.685] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.686] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.686] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.690] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.690] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.691] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.691] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.691] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.691] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.691] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.691] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.691] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.691] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/-2zElut.mkv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cb28 [0070.691] FindClose (in: hFindFile=0xa7cb28 | out: hFindFile=0xa7cb28) returned 1 [0070.691] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0070.691] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0070.692] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0070.692] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0070.692] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0070.692] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0070.692] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.692] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.692] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.692] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.693] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.694] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.694] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.695] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.696] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.696] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.697] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.697] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.697] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.697] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.697] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.697] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.697] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.697] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.697] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.697] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.697] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.698] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.699] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.700] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.700] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.701] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.702] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] PeekMessageW (in: lpMsg=0x8befc8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8befc8) returned 0 [0070.703] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.704] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.704] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.704] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0070.704] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0070.704] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.704] SetLastError (dwErrCode=0x3f0) [0070.704] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0070.704] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0070.704] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0070.705] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.707] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0070.707] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0070.707] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0070.707] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0070.707] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0070.707] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7abd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0070.707] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0070.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0070.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7acb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0070.708] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0070.708] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0071.117] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 1 [0071.117] TranslateMessage (lpMsg=0x8bf4a8) returned 0 [0071.117] DispatchMessageW (lpMsg=0x8bf4a8) returned 0x0 [0071.117] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0071.119] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0071.119] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.119] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.119] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0071.119] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.119] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0071.119] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.119] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.119] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.119] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.119] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.120] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0071.120] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.120] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0071.120] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.120] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.120] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.120] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bed68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed68) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.121] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.121] SetLastError (dwErrCode=0x0) [0071.121] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.122] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.122] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.122] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.122] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.122] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0071.122] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.122] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0071.122] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.122] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.122] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.122] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.122] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.122] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.122] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.122] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.122] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.122] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.122] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.122] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.122] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.123] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.124] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.125] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.126] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.127] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.128] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.129] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.130] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.130] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.130] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.130] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.130] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.130] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.132] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.132] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.132] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.132] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.132] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.132] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.132] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.133] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.134] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.135] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.135] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.135] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.135] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.135] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.135] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.135] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.139] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.139] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.139] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.139] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.139] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.139] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.139] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.140] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.146] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.146] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.146] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.146] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.146] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.146] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.146] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.157] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.157] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.157] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.157] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.157] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.157] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.157] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.157] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.164] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.164] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0071.164] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0071.164] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.164] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.164] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0071.164] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0071.164] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.164] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.164] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0071.164] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0071.164] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.164] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92f10, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0071.165] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0071.165] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0071.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x2c847d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0071.166] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0071.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x2c847c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0071.166] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.166] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.166] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c92f88, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0071.166] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0071.166] CryptHashData (hHash=0xa7cda8, pbData=0x2c84810, dwDataLen=0x3, dwFlags=0x1) returned 1 [0071.166] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.167] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.167] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.167] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.167] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.167] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.167] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0071.167] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.167] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0071.167] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.167] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.167] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0071.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a2d0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0071.167] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0071.168] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cda8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7caa8) returned 1 [0071.189] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.189] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.189] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.189] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.189] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.189] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.189] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.189] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0071.189] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.189] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0071.189] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0071.189] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0071.190] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0071.190] CryptDestroyHash (hHash=0xa7cda8) returned 1 [0071.191] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.191] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.191] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.191] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.191] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.191] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/-2zElut.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-2zelut.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0071.191] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.191] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0071.191] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.192] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.192] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.192] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0071.192] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.-2zElut.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.-2zelut.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0071.223] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.223] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.223] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.223] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.226] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0071.226] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0071.228] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x8808, lpOverlapped=0x0) returned 1 [0071.228] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0071.234] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.280] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.280] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.280] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0071.283] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.283] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0071.283] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.283] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.284] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.284] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.284] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.284] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.289] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.289] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.289] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.289] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.289] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.289] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.289] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.289] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.289] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.289] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.289] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.289] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.291] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.292] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.292] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.292] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.292] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.292] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.292] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.292] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.292] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.292] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.292] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.292] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.308] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.308] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.308] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.308] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.308] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.308] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.308] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.308] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.308] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.308] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.309] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.310] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.311] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.312] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.325] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.325] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.326] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.326] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.326] PeekMessageW (in: lpMsg=0x8beed8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beed8) returned 0 [0071.326] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.326] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.326] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.326] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.326] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.326] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.329] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.329] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.329] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.329] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.329] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.329] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.329] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.329] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.369] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.369] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.369] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.369] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.369] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.369] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.369] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0071.369] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0071.370] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.370] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.370] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0071.370] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0071.370] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.370] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.372] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b158, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.372] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0071.372] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x18808, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x18810) returned 1 [0071.372] CharLowerBuffW (in: lpsz="byte[100368]", cchLength=0xc | out: lpsz="byte[100368]") returned 0xc [0071.377] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.377] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.379] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b1b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.379] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0071.379] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x39b1068*, pdwDataLen=0x8bef60*=0x18808, dwBufLen=0x18810 | out: pbData=0x39b1068*, pdwDataLen=0x8bef60*=0x18810) returned 1 [0071.394] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0071.394] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0071.394] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.394] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.394] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.394] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.394] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.394] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.396] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0071.396] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0071.396] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.396] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.396] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.396] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.396] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.396] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.415] WriteFile (in: hFile=0x24c, lpBuffer=0x3980048*, nNumberOfBytesToWrite=0x18810, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3980048*, lpNumberOfBytesWritten=0x8bf5e4*=0x18810, lpOverlapped=0x0) returned 1 [0071.418] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.418] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.418] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0071.418] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.418] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0071.419] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.419] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.422] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.423] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.424] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0071.424] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8beec0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beec0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.424] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.424] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0071.424] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.424] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0071.424] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a570, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0071.425] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0071.425] CryptDestroyKey (hKey=0xa7caa8) returned 1 [0071.425] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.425] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.425] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0071.425] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.425] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0071.425] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.425] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.426] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0071.426] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0071.426] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0071.426] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0071.426] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0071.426] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0071.426] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.426] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.426] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0071.426] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.426] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0071.426] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0071.426] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.426] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.426] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.426] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.426] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.426] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0071.426] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.426] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0071.426] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.426] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.426] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0071.426] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.427] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0071.427] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.427] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.427] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.427] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.427] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.427] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.427] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.427] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.432] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.432] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.432] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.432] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.432] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.432] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.432] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.432] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0071.432] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.432] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0071.432] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.432] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.432] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7acd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0071.433] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0071.433] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0071.433] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.433] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.433] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.433] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.433] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.433] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.433] FreeLibrary (hLibModule=0x76a10000) returned 1 [0071.433] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.433] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.433] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.433] CloseHandle (hObject=0x240) returned 1 [0071.434] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.434] CloseHandle (hObject=0x24c) returned 1 [0071.442] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.443] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0071.443] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0071.443] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0071.443] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/-2zElut.mkv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-2zElut.mkv", lpFilePart=0x8bedf4*="-2zElut.mkv") returned 0x29 [0071.443] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-2zElut.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-2zelut.mkv")) returned 0x20 [0071.443] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-2zElut.mkv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7c9a8 [0071.444] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-2zElut.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-2zelut.mkv")) returned 1 [0071.460] FindNextFileW (in: hFindFile=0xa7c9a8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0071.460] FindClose (in: hFindFile=0xa7c9a8 | out: hFindFile=0xa7c9a8) returned 1 [0071.461] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0071.461] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0071.461] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0071.461] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/-2zElut.mkv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-2zElut.mkv", lpFilePart=0x8bf650*="-2zElut.mkv") returned 0x29 [0071.461] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-2zElut.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-2zelut.mkv")) returned 0xffffffff [0071.461] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0071.461] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0071.461] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0071.461] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3 rt.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0071.461] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" rt.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0071.461] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rt.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0071.461] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0071.461] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0071.461] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3 rt.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0071.461] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" rt.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0071.461] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rt.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0071.461] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0071.461] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0071.461] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0071.461] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0071.461] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0071.461] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0071.461] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.462] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0071.462] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.462] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.462] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.462] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.462] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.462] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/3 rt.png", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d068 [0071.462] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0071.462] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.462] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.462] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0071.462] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.462] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0071.462] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.462] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.462] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.462] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.462] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.462] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.462] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.462] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.462] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0071.463] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.463] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.463] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0071.463] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.463] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0071.463] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.463] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.463] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.463] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.463] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.463] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.463] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0071.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0071.463] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.463] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.463] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0071.463] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.463] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0071.463] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0071.463] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0071.464] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0071.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa98, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0071.464] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0071.464] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0071.464] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.464] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.465] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0071.465] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.465] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0071.465] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.465] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.465] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.465] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.465] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.465] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.465] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0071.465] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.465] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0071.465] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.465] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.465] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.465] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.465] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.465] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.465] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.465] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0071.465] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.465] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0071.465] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.465] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.466] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0071.466] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.466] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0071.466] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.466] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.466] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.466] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.466] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.466] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.466] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.466] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.466] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.466] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0071.466] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.466] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0071.466] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.466] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.466] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.466] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.466] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.467] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.467] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.467] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.467] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.467] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0071.467] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.467] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0071.467] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.467] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.467] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92f58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0071.468] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0071.468] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0071.468] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.468] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.469] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.469] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983600, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0071.469] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0071.469] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983550, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0071.469] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.469] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.469] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.469] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.470] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.470] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.470] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a330, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0071.470] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0071.470] CryptHashData (hHash=0xa7caa8, pbData=0x39835a0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0071.470] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.470] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.470] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.470] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.470] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.470] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.470] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.470] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.470] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0071.470] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.470] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0071.470] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.470] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.471] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0071.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a528, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0071.471] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0071.471] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7caa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cca8) returned 1 [0071.471] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.471] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.471] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.471] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.471] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.471] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.471] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.472] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0071.472] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.472] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0071.472] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0071.472] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a978, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0071.472] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0071.472] CryptDestroyHash (hHash=0xa7caa8) returned 1 [0071.472] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.472] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.472] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.472] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.472] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.472] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/3 rt.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\3 rt.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0071.472] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.473] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0071.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.473] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0071.473] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.3 rt.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.3 rt.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0071.477] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.477] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.477] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.477] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.479] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0071.479] ReadFile (in: hFile=0x24c, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0xbae1, lpOverlapped=0x0) returned 1 [0071.481] ReadFile (in: hFile=0x24c, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0071.484] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.484] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.484] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.484] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0071.484] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.484] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0071.484] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.484] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.484] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.484] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.484] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.484] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.484] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.484] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0071.485] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.485] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0071.485] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.485] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.485] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.485] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.485] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.485] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.485] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.485] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.485] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.485] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0071.485] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.485] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0071.485] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.485] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.485] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.485] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.485] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.485] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.485] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.485] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.485] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.485] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.485] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.485] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.486] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.486] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a2e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.486] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0071.486] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xbae1, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xbae8) returned 1 [0071.486] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.486] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.486] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.487] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.487] CharLowerBuffW (in: lpsz="byte[47848]", cchLength=0xb | out: lpsz="byte[47848]") returned 0xb [0071.487] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.489] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.489] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.489] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.489] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.489] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.489] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.490] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a150, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.490] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0071.490] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cc80f0*, pdwDataLen=0x8bef60*=0xbae1, dwBufLen=0xbae8 | out: pbData=0x2cc80f0*, pdwDataLen=0x8bef60*=0xbae8) returned 1 [0071.492] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.492] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.492] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.492] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.493] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0071.493] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.493] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0071.493] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.493] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.493] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0071.493] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.493] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0071.493] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.493] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.493] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.493] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.493] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.493] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.493] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.493] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.493] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.493] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.493] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.496] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.496] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.497] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.497] WriteFile (in: hFile=0x240, lpBuffer=0x399fb48*, nNumberOfBytesToWrite=0xbae8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x399fb48*, lpNumberOfBytesWritten=0x8bf5e4*=0xbae8, lpOverlapped=0x0) returned 1 [0071.499] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.499] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.499] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0071.499] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.499] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0071.499] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.499] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.499] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.499] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0071.499] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.499] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0071.499] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0071.500] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92ac0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0071.500] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0071.500] CryptDestroyKey (hKey=0xa7cca8) returned 1 [0071.500] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.500] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.500] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0071.500] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.500] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0071.500] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.500] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.500] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0071.500] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0071.500] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0071.500] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0071.500] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0071.500] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0071.501] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.501] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.501] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0071.501] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.501] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0071.501] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0071.501] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.501] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.501] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.501] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.501] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.501] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0071.501] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.501] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0071.501] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.501] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.501] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0071.501] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.501] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0071.501] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.502] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.502] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.502] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.502] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.502] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.502] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.502] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.502] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.502] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.502] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.502] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.502] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.502] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.502] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.502] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0071.502] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.502] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0071.502] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.502] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.502] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7abd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0071.503] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0071.503] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0071.503] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.503] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.503] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.503] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.503] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.503] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.503] FreeLibrary (hLibModule=0x76a10000) returned 1 [0071.503] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.503] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.503] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.503] CloseHandle (hObject=0x24c) returned 1 [0071.505] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.506] CloseHandle (hObject=0x240) returned 1 [0071.514] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.514] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0071.514] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0071.514] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0071.514] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/3 rt.png", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3 rt.png", lpFilePart=0x8bedf4*="3 rt.png") returned 0x26 [0071.514] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3 rt.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\3 rt.png")) returned 0x20 [0071.514] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3 rt.png", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d0a8 [0071.515] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3 rt.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\3 rt.png")) returned 1 [0071.521] FindNextFileW (in: hFindFile=0xa7d0a8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0071.521] FindClose (in: hFindFile=0xa7d0a8 | out: hFindFile=0xa7d0a8) returned 1 [0071.521] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0071.521] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0071.522] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0071.522] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/3 rt.png", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3 rt.png", lpFilePart=0x8bf650*="3 rt.png") returned 0x26 [0071.522] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3 rt.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\3 rt.png")) returned 0xffffffff [0071.522] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0071.522] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0071.522] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5h pi4P G_.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h pi4P G_.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" pi4P G_.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pi4P G_.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i4P G_.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4P G_.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P G_.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" G_.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G_.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0071.522] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5h pi4P G_.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h pi4P G_.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" pi4P G_.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pi4P G_.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i4P G_.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4P G_.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P G_.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" G_.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0071.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G_.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0071.522] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0071.523] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0071.523] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0071.523] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0071.523] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0071.523] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0071.523] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.523] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0071.523] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.523] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.523] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.523] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.523] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.523] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/5h pi4P G_.ods", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cda8 [0071.523] FindClose (in: hFindFile=0xa7cda8 | out: hFindFile=0xa7cda8) returned 1 [0071.523] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.523] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.524] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0071.524] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.524] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0071.524] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.524] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.524] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.524] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.524] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.524] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.524] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.524] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.524] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0071.524] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.524] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.524] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0071.524] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.524] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0071.524] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.524] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.524] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.524] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.524] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.525] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.525] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0071.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0071.525] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.525] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.525] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0071.525] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.525] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0071.525] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0071.525] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0071.525] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0071.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a958, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0071.525] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0071.525] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0071.526] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.526] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.526] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0071.526] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.526] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0071.526] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.526] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.526] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.526] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.526] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.526] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.527] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0071.527] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.527] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0071.527] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.530] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.530] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.530] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.530] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.530] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.530] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.530] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0071.530] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.530] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0071.531] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.531] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.531] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.531] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.531] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.531] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.531] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.531] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0071.531] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.531] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0071.531] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.531] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.531] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.531] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.531] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.531] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.531] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.531] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.531] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.531] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0071.531] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.531] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0071.531] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.531] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.531] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.532] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.532] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.532] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.532] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.532] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.532] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.532] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.532] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.532] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0071.532] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.532] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0071.532] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.532] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.532] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0071.532] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0071.532] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0071.532] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983db0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0071.533] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0071.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d70, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0071.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.533] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.533] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.533] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.533] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.533] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.533] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a0f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0071.533] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0071.533] CryptHashData (hHash=0xa7c9a8, pbData=0x3983d60, dwDataLen=0x3, dwFlags=0x1) returned 1 [0071.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.534] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.534] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.534] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.534] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.534] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.534] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.534] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.534] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0071.534] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.534] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0071.534] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.534] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.534] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0071.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a588, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0071.535] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0071.535] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7c9a8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cee8) returned 1 [0071.535] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.535] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.535] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.535] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.535] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.535] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.535] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.535] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0071.535] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.535] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0071.535] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0071.535] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7acd8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0071.536] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0071.536] CryptDestroyHash (hHash=0xa7c9a8) returned 1 [0071.536] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.536] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.536] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.536] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.536] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.536] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/5h pi4P G_.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\5h pi4p g_.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0071.536] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.536] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0071.536] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.536] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.536] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.536] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0071.537] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.5h pi4P G_.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.5h pi4p g_.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0071.540] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.540] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.540] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.540] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.542] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0071.542] ReadFile (in: hFile=0x240, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0071.544] ReadFile (in: hFile=0x240, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0x7525, lpOverlapped=0x0) returned 1 [0071.544] ReadFile (in: hFile=0x240, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0071.549] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.549] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.549] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.549] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0071.550] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.550] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0071.550] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.550] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.550] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.551] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.551] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.551] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.551] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.551] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0071.551] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.551] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0071.551] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.551] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.551] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.551] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.551] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.551] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.551] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.551] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.551] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.551] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0071.551] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.551] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0071.551] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.551] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.551] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.551] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.552] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.552] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.554] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.554] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.554] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.554] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.554] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.555] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a1e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.556] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0071.556] CryptEncrypt (in: hKey=0xa7cee8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x17525, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x17528) returned 1 [0071.556] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.556] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.556] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.556] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.556] CharLowerBuffW (in: lpsz="byte[95528]", cchLength=0xb | out: lpsz="byte[95528]") returned 0xb [0071.556] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.560] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.560] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.560] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.560] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.560] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.560] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0071.561] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a168, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.562] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0071.562] CryptEncrypt (in: hKey=0xa7cee8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x39a4060*, pdwDataLen=0x8bef60*=0x17525, dwBufLen=0x17528 | out: pbData=0x39a4060*, pdwDataLen=0x8bef60*=0x17528) returned 1 [0071.565] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.565] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.565] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.565] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.567] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.567] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.567] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.567] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0071.567] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.567] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0071.567] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.567] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.567] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0071.567] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.567] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0071.567] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.567] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.567] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0071.567] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.567] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.567] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.567] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.568] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.568] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0071.568] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.568] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0071.568] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0071.576] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.576] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.576] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.577] WriteFile (in: hFile=0x24c, lpBuffer=0x2c95018*, nNumberOfBytesToWrite=0x17528, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesWritten=0x8bf5e4*=0x17528, lpOverlapped=0x0) returned 1 [0071.580] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.580] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.580] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0071.580] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.580] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0071.580] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.580] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.580] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.580] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0071.580] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.580] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0071.580] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0071.580] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92838, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0071.580] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0071.581] CryptDestroyKey (hKey=0xa7cee8) returned 1 [0071.581] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.581] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.581] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0071.581] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.581] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0071.581] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.581] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.581] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0071.581] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0071.581] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0071.581] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0071.581] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0071.581] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0071.581] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.581] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.581] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0071.581] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.582] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0071.582] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0071.582] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.582] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0071.582] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.582] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0071.582] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.582] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0071.582] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.582] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0071.582] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.582] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.582] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0071.582] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.582] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0071.582] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.582] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.582] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0071.582] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.582] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0071.582] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.582] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0071.582] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.582] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0071.582] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.582] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.583] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.583] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.583] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.583] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.583] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0071.583] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.583] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0071.583] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.583] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.583] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0071.583] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0071.583] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0071.583] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.583] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0071.583] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.583] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0071.583] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.583] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0071.584] FreeLibrary (hLibModule=0x76a10000) returned 1 [0071.584] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.584] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0071.584] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.584] CloseHandle (hObject=0x240) returned 1 [0071.586] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0071.586] CloseHandle (hObject=0x24c) returned 1 [0072.675] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0072.675] TranslateMessage (lpMsg=0x8bf708) returned 0 [0072.675] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0072.675] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0072.675] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0072.675] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0072.680] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0072.680] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0072.680] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0072.681] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/5h pi4P G_.ods", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5h pi4P G_.ods", lpFilePart=0x8bedf4*="5h pi4P G_.ods") returned 0x2c [0072.681] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5h pi4P G_.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\5h pi4p g_.ods")) returned 0x20 [0072.681] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5h pi4P G_.ods", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cee8 [0072.681] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5h pi4P G_.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\5h pi4p g_.ods")) returned 1 [0073.222] FindNextFileW (in: hFindFile=0xa7cee8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0073.222] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0073.222] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0073.222] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0073.222] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0073.222] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/5h pi4P G_.ods", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5h pi4P G_.ods", lpFilePart=0x8bf650*="5h pi4P G_.ods") returned 0x2c [0073.222] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5h pi4P G_.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\5h pi4p g_.ods")) returned 0xffffffff [0073.222] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0073.222] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0073.222] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0073.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6UcE2 -hZ7ABmj.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UcE2 -hZ7ABmj.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0073.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cE2 -hZ7ABmj.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E2 -hZ7ABmj.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2 -hZ7ABmj.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" -hZ7ABmj.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-hZ7ABmj.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hZ7ABmj.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Z7ABmj.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7ABmj.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ABmj.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Bmj.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mj.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.223] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6UcE2 -hZ7ABmj.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UcE2 -hZ7ABmj.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cE2 -hZ7ABmj.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E2 -hZ7ABmj.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2 -hZ7ABmj.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" -hZ7ABmj.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-hZ7ABmj.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hZ7ABmj.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Z7ABmj.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7ABmj.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ABmj.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Bmj.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0073.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mj.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.223] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0073.223] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0073.223] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0073.223] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0073.223] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0073.223] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0073.223] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.223] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0073.223] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.224] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.224] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.224] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.224] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.224] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/6UcE2 -hZ7ABmj.bmp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cb28 [0073.224] FindClose (in: hFindFile=0xa7cb28 | out: hFindFile=0xa7cb28) returned 1 [0073.224] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.224] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.224] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0073.224] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.224] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0073.224] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.224] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.224] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0073.224] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0073.224] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0073.224] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0073.224] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0073.224] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.224] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0073.225] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.225] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.225] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0073.225] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.225] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0073.225] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.225] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.225] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.225] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.225] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.225] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.225] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0073.225] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0073.225] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.225] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.225] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0073.225] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.225] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0073.225] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0073.225] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0073.225] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0073.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac78, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0073.226] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0073.226] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0073.226] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.226] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.226] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0073.226] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.227] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0073.227] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.227] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0073.227] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.227] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0073.227] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.227] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0073.227] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.227] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0073.227] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.227] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.228] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.228] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0073.228] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.228] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0073.228] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.228] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.228] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0073.228] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.228] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0073.228] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.228] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.228] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.228] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.228] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0073.228] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.228] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0073.228] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.228] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.228] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.228] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.228] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.229] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.229] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.229] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.229] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.229] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.229] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.229] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0073.229] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.229] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0073.229] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.229] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.229] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92eb0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0073.229] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0073.229] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0073.229] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.229] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.229] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.229] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981c00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0073.230] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0073.230] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981c20, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0073.230] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.230] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.230] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.230] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.230] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.230] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.230] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a348, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0073.230] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0073.230] CryptHashData (hHash=0xa7cc28, pbData=0x3981c80, dwDataLen=0x3, dwFlags=0x1) returned 1 [0073.230] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.230] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.230] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.230] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.230] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.230] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.230] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.231] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0073.231] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.231] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0073.231] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.231] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a570, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0073.231] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0073.231] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cc28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cb28) returned 1 [0073.231] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.231] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.231] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0073.231] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.231] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0073.232] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7acd8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0073.232] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0073.232] CryptDestroyHash (hHash=0xa7cc28) returned 1 [0073.232] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.232] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.232] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.232] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.232] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.233] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/6UcE2 -hZ7ABmj.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\6uce2 -hz7abmj.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0073.233] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.233] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0073.233] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.233] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.233] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.233] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0073.233] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.6UcE2 -hZ7ABmj.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.6uce2 -hz7abmj.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0073.318] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.318] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.318] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.318] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.320] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0073.320] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0073.322] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x350d, lpOverlapped=0x0) returned 1 [0073.323] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0073.326] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.326] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.326] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.326] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0073.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.327] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0073.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.327] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0073.327] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.327] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0073.328] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.328] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.328] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0073.328] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.328] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0073.328] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.328] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.328] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.328] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.328] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0073.328] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.328] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0073.328] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.328] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.328] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.328] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.328] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.328] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.328] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.328] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.328] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.329] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a198, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.329] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0073.329] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x1350d, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x13510) returned 1 [0073.329] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.329] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.329] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.330] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.330] CharLowerBuffW (in: lpsz="byte[79120]", cchLength=0xb | out: lpsz="byte[79120]") returned 0xb [0073.330] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.489] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 1 [0073.489] TranslateMessage (lpMsg=0x8bf3b8) returned 0 [0073.489] DispatchMessageW (lpMsg=0x8bf3b8) returned 0x0 [0073.489] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0073.489] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0073.489] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.489] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.489] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.489] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.489] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.489] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.490] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a168, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.491] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0073.491] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3997568*, pdwDataLen=0x8bef60*=0x1350d, dwBufLen=0x13510 | out: pbData=0x3997568*, pdwDataLen=0x8bef60*=0x13510) returned 1 [0073.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.494] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.494] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.494] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.494] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.494] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0073.494] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.494] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0073.494] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.494] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.495] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0073.495] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.495] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0073.495] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.495] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.495] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.495] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.495] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0073.495] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.495] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0073.495] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.495] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.495] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.495] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.495] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.501] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.501] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.501] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.501] WriteFile (in: hFile=0x240, lpBuffer=0x2cc8540*, nNumberOfBytesToWrite=0x13510, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cc8540*, lpNumberOfBytesWritten=0x8bf5e4*=0x13510, lpOverlapped=0x0) returned 1 [0073.504] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.504] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.504] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0073.504] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0073.504] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0073.504] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0073.504] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0073.504] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.504] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0073.504] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.504] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0073.504] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0073.504] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c928b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0073.504] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0073.504] CryptDestroyKey (hKey=0xa7cb28) returned 1 [0073.505] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0073.505] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0073.505] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0073.505] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0073.505] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0073.505] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0073.505] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0073.505] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0073.505] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0073.505] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0073.505] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0073.505] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0073.505] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0073.506] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.506] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0073.506] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.506] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0073.506] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.506] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.506] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0073.506] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.506] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0073.506] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.506] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.506] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.506] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.506] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0073.506] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0073.506] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0073.506] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0073.506] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0073.506] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.506] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.507] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.507] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.507] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.507] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.507] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0073.507] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.507] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0073.507] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.507] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.507] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0073.507] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0073.507] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0073.507] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.507] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.507] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.507] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.507] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.507] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.507] FreeLibrary (hLibModule=0x76a10000) returned 1 [0073.507] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.508] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.508] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.508] CloseHandle (hObject=0x24c) returned 1 [0073.509] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.509] CloseHandle (hObject=0x240) returned 1 [0073.597] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.599] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0073.599] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0073.599] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0073.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/6UcE2 -hZ7ABmj.bmp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\6UcE2 -hZ7ABmj.bmp", lpFilePart=0x8bedf4*="6UcE2 -hZ7ABmj.bmp") returned 0x30 [0073.599] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\6UcE2 -hZ7ABmj.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\6uce2 -hz7abmj.bmp")) returned 0x20 [0073.599] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\6UcE2 -hZ7ABmj.bmp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cee8 [0073.599] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\6UcE2 -hZ7ABmj.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\6uce2 -hz7abmj.bmp")) returned 1 [0073.795] FindNextFileW (in: hFindFile=0xa7cee8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0073.795] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0073.795] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0073.795] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0073.795] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0073.795] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/6UcE2 -hZ7ABmj.bmp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\6UcE2 -hZ7ABmj.bmp", lpFilePart=0x8bf650*="6UcE2 -hZ7ABmj.bmp") returned 0x30 [0073.795] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\6UcE2 -hZ7ABmj.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\6uce2 -hz7abmj.bmp")) returned 0xffffffff [0073.795] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0073.795] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0073.795] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8irUlxoryz9NBEdK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="irUlxoryz9NBEdK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rUlxoryz9NBEdK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ulxoryz9NBEdK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lxoryz9NBEdK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xoryz9NBEdK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oryz9NBEdK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ryz9NBEdK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yz9NBEdK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z9NBEdK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9NBEdK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NBEdK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BEdK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EdK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dK.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0073.796] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8irUlxoryz9NBEdK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="irUlxoryz9NBEdK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rUlxoryz9NBEdK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ulxoryz9NBEdK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lxoryz9NBEdK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xoryz9NBEdK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oryz9NBEdK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ryz9NBEdK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yz9NBEdK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z9NBEdK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9NBEdK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0073.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NBEdK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0073.797] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BEdK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0073.797] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EdK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0073.797] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dK.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0073.797] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0073.797] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0073.797] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0073.797] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0073.797] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0073.797] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0073.797] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.797] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0073.797] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.797] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.797] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.797] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.797] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.797] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/8irUlxoryz9NBEdK.gif", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cf28 [0073.797] FindClose (in: hFindFile=0xa7cf28 | out: hFindFile=0xa7cf28) returned 1 [0073.798] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.798] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.798] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0073.798] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.798] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0073.798] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.798] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.798] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0073.798] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0073.798] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0073.798] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0073.798] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0073.798] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.798] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0073.798] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.799] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.799] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0073.799] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.799] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0073.799] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.799] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.799] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.799] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.799] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.799] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.799] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0073.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0073.799] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.799] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.799] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0073.799] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.844] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0073.844] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0073.844] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0073.844] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0073.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aab8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0073.845] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0073.845] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0073.845] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.845] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.845] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0073.845] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.845] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0073.845] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.845] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.845] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.845] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.845] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.845] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.846] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0073.846] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.846] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0073.846] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.846] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.846] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.846] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.846] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.846] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.846] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.846] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0073.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.846] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0073.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.846] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0073.847] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.847] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0073.847] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.847] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.847] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0073.847] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.847] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0073.847] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.847] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.847] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.847] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.847] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0073.847] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.847] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0073.847] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.847] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.847] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.847] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.847] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.847] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.847] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.847] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.847] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.847] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0073.848] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.848] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0073.848] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.848] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.848] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0073.848] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0073.848] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0073.848] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.848] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.848] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.848] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981750, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0073.848] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0073.848] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981890, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0073.849] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.849] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.849] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.849] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.849] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.849] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.849] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a2e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0073.849] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0073.849] CryptHashData (hHash=0xa7d168, pbData=0x3981860, dwDataLen=0x3, dwFlags=0x1) returned 1 [0073.849] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.849] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.849] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.849] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.849] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.849] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.849] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.849] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.849] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0073.849] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.849] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0073.850] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.850] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.850] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a690, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0073.850] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0073.850] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d168, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cee8) returned 1 [0073.850] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.850] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.850] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.850] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.850] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.850] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.850] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.850] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0073.850] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.850] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0073.850] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0073.850] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a9d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0073.851] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0073.851] CryptDestroyHash (hHash=0xa7d168) returned 1 [0073.851] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.851] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.851] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.851] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.851] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.852] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/8irUlxoryz9NBEdK.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8irulxoryz9nbedk.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0073.852] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.852] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0073.852] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.852] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.852] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.852] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0073.852] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.8irUlxoryz9NBEdK.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.8irulxoryz9nbedk.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0073.855] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.855] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.855] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.869] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.871] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0073.871] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0073.873] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x4caf, lpOverlapped=0x0) returned 1 [0073.873] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0073.876] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.877] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.877] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.877] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0073.887] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.887] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0073.887] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.887] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.888] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.888] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.888] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.888] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.888] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.888] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0073.888] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.888] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0073.888] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.888] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.888] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0073.888] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.888] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0073.888] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.888] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.888] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.888] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.888] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0073.888] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.888] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0073.888] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.888] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.888] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.888] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.888] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.888] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.889] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.889] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.889] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.889] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.889] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.889] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.889] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.889] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a1e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.890] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0073.890] CryptEncrypt (in: hKey=0xa7cee8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x14caf, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x14cb0) returned 1 [0073.890] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.890] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.890] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.890] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.890] CharLowerBuffW (in: lpsz="byte[85168]", cchLength=0xb | out: lpsz="byte[85168]") returned 0xb [0073.890] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.892] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.892] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.892] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.892] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.892] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.893] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0073.894] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a150, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.894] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0073.894] CryptEncrypt (in: hKey=0xa7cee8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3998d08*, pdwDataLen=0x8bef60*=0x14caf, dwBufLen=0x14cb0 | out: pbData=0x3998d08*, pdwDataLen=0x8bef60*=0x14cb0) returned 1 [0073.897] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.897] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.897] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.897] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.898] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.898] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.898] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.898] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0073.898] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.898] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0073.898] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.898] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.899] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0073.899] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.899] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0073.899] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.899] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.899] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0073.899] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.899] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0073.899] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.899] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0073.899] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.899] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0073.899] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.899] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0073.899] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0073.905] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.905] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.905] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.906] WriteFile (in: hFile=0x24c, lpBuffer=0x2cc9ce0*, nNumberOfBytesToWrite=0x14cb0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cc9ce0*, lpNumberOfBytesWritten=0x8bf5e4*=0x14cb0, lpOverlapped=0x0) returned 1 [0073.908] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.908] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.908] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0073.908] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0073.908] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0073.908] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0073.908] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0073.908] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.908] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0073.908] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.908] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0073.908] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0073.908] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92838, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0073.908] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0073.908] CryptDestroyKey (hKey=0xa7cee8) returned 1 [0073.909] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0073.909] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0073.909] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0073.909] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0073.909] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0073.909] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0073.909] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0073.909] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0073.909] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0073.909] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0073.909] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0073.909] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0073.909] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0073.909] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0073.909] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0073.909] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0073.909] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0073.909] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0073.910] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0073.910] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0073.910] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0073.910] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0073.910] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0073.910] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.910] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0073.910] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.910] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0073.910] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.910] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.910] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0073.910] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.910] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0073.910] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.910] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.910] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0073.910] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.910] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0073.910] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0073.920] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0073.920] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0073.920] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0073.920] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.920] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.920] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.920] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.920] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.920] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.920] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0073.920] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.920] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0073.920] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.920] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.920] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0073.921] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0073.921] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0073.921] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.921] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0073.921] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.921] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0073.921] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.921] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0073.921] FreeLibrary (hLibModule=0x76a10000) returned 1 [0073.921] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.921] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0073.921] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.921] CloseHandle (hObject=0x240) returned 1 [0073.923] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.923] CloseHandle (hObject=0x24c) returned 1 [0073.978] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0073.980] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0073.980] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0073.980] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0073.980] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/8irUlxoryz9NBEdK.gif", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8irUlxoryz9NBEdK.gif", lpFilePart=0x8bedf4*="8irUlxoryz9NBEdK.gif") returned 0x32 [0073.980] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8irUlxoryz9NBEdK.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8irulxoryz9nbedk.gif")) returned 0x20 [0073.980] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8irUlxoryz9NBEdK.gif", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cfa8 [0073.980] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8irUlxoryz9NBEdK.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8irulxoryz9nbedk.gif")) returned 1 [0074.013] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0074.013] FindClose (in: hFindFile=0xa7cfa8 | out: hFindFile=0xa7cfa8) returned 1 [0074.013] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.013] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0074.013] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0074.013] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/8irUlxoryz9NBEdK.gif", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8irUlxoryz9NBEdK.gif", lpFilePart=0x8bf650*="8irUlxoryz9NBEdK.gif") returned 0x32 [0074.013] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8irUlxoryz9NBEdK.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8irulxoryz9nbedk.gif")) returned 0xffffffff [0074.013] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.014] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.014] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8ZHaOi1b54EwUUY.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZHaOi1b54EwUUY.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HaOi1b54EwUUY.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aOi1b54EwUUY.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Oi1b54EwUUY.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i1b54EwUUY.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1b54EwUUY.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b54EwUUY.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="54EwUUY.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4EwUUY.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EwUUY.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wUUY.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UUY.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UY.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.014] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8ZHaOi1b54EwUUY.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZHaOi1b54EwUUY.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HaOi1b54EwUUY.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aOi1b54EwUUY.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Oi1b54EwUUY.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i1b54EwUUY.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1b54EwUUY.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b54EwUUY.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="54EwUUY.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4EwUUY.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EwUUY.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wUUY.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UUY.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.014] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UY.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.014] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.014] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0074.014] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0074.014] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0074.015] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0074.015] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0074.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.015] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0074.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.015] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/8ZHaOi1b54EwUUY.wav", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7caa8 [0074.015] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0074.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.015] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0074.015] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.015] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0074.015] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.015] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.015] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.015] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.015] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.015] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.016] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.016] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.016] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0074.016] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.016] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.016] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0074.016] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.016] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0074.016] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.016] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.016] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.016] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.016] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.016] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.016] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0074.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0074.016] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.016] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.016] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0074.016] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.016] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0074.016] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0074.016] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0074.017] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0074.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a9b8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0074.017] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0074.017] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0074.017] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.017] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.017] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0074.018] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.018] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0074.018] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.018] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.018] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.018] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.018] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.018] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.018] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0074.018] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.018] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0074.018] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.018] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.019] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0074.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.019] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0074.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.019] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0074.019] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.019] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0074.019] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.019] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.019] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.019] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.019] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.019] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.020] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0074.020] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.020] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0074.020] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.020] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.020] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.020] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.020] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.020] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.020] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.020] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.020] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0074.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.020] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0074.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.020] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92f88, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0074.020] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0074.021] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0074.021] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.049] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.050] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.050] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3980a40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0074.050] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0074.050] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3980ae0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0074.050] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.050] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.050] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.050] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.050] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.050] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.050] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a2e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0074.051] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0074.051] CryptHashData (hHash=0xa7cee8, pbData=0x3980970, dwDataLen=0x3, dwFlags=0x1) returned 1 [0074.051] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.051] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.051] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.051] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.051] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.051] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.051] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.051] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.051] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0074.051] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.051] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0074.051] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.051] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.051] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a3f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0074.052] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0074.052] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cee8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cca8) returned 1 [0074.052] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.052] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.052] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.052] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.052] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.052] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.052] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.052] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0074.052] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.052] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0074.052] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0074.052] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0074.052] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0074.052] CryptDestroyHash (hHash=0xa7cee8) returned 1 [0074.052] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.053] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.053] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.053] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.053] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.053] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/8ZHaOi1b54EwUUY.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8zhaoi1b54ewuuy.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0074.054] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.054] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0074.054] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.054] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.054] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.054] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0074.054] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.8ZHaOi1b54EwUUY.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.8zhaoi1b54ewuuy.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0074.058] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.058] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.059] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.059] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.061] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0074.061] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x86da, lpOverlapped=0x0) returned 1 [0074.062] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0074.064] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.064] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.064] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.064] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0074.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.065] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0074.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.065] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0074.065] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.065] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0074.065] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.065] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.065] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.065] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.066] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.066] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.066] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.066] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.066] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.066] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0074.066] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.066] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0074.066] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.066] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.066] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.066] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.066] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.066] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.066] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.066] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.066] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.067] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a2d0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.067] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0074.067] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x86da, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x86e0) returned 1 [0074.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.067] CharLowerBuffW (in: lpsz="byte[34528]", cchLength=0xb | out: lpsz="byte[34528]") returned 0xb [0074.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.068] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.068] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.068] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.068] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.068] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.069] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a360, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.069] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0074.069] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cce4e0*, pdwDataLen=0x8bef60*=0x86da, dwBufLen=0x86e0 | out: pbData=0x2cce4e0*, pdwDataLen=0x8bef60*=0x86e0) returned 1 [0074.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.071] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0074.071] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.071] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0074.071] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.071] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.071] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0074.071] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.071] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0074.071] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.071] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.071] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.071] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.071] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.071] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.071] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.071] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.071] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.071] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.071] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.072] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.076] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.080] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.080] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.080] WriteFile (in: hFile=0x240, lpBuffer=0x2cbd710*, nNumberOfBytesToWrite=0x86e0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cbd710*, lpNumberOfBytesWritten=0x8bf5e4*=0x86e0, lpOverlapped=0x0) returned 1 [0074.082] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.082] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.082] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0074.083] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0074.083] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0074.083] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0074.083] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0074.083] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.083] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0074.083] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.083] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0074.083] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0074.083] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92808, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0074.083] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0074.083] CryptDestroyKey (hKey=0xa7cca8) returned 1 [0074.083] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0074.083] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0074.083] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0074.083] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0074.083] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0074.083] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0074.084] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0074.084] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0074.084] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0074.084] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0074.084] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0074.084] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0074.084] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0074.084] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0074.084] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.084] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0074.084] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.084] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0074.084] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0074.084] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0074.084] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0074.084] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0074.084] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0074.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.084] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0074.084] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.084] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0074.085] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.085] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.085] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0074.085] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.085] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0074.085] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.085] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.085] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.085] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.085] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.085] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.085] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.085] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.085] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.085] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.085] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.085] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.085] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.085] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.086] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.086] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0074.086] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.086] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0074.086] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.086] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.086] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0074.086] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0074.086] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0074.086] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.086] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.086] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.086] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.086] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.086] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.086] FreeLibrary (hLibModule=0x76a10000) returned 1 [0074.086] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.087] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.087] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.087] CloseHandle (hObject=0x24c) returned 1 [0074.089] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.089] CloseHandle (hObject=0x240) returned 1 [0074.099] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.100] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.100] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0074.100] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0074.101] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/8ZHaOi1b54EwUUY.wav", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8ZHaOi1b54EwUUY.wav", lpFilePart=0x8bedf4*="8ZHaOi1b54EwUUY.wav") returned 0x31 [0074.101] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8ZHaOi1b54EwUUY.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8zhaoi1b54ewuuy.wav")) returned 0x20 [0074.101] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8ZHaOi1b54EwUUY.wav", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d168 [0074.101] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8ZHaOi1b54EwUUY.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8zhaoi1b54ewuuy.wav")) returned 1 [0074.140] FindNextFileW (in: hFindFile=0xa7d168, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0074.140] FindClose (in: hFindFile=0xa7d168 | out: hFindFile=0xa7d168) returned 1 [0074.140] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.140] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0074.140] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0074.140] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/8ZHaOi1b54EwUUY.wav", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8ZHaOi1b54EwUUY.wav", lpFilePart=0x8bf650*="8ZHaOi1b54EwUUY.wav") returned 0x31 [0074.141] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8ZHaOi1b54EwUUY.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8zhaoi1b54ewuuy.wav")) returned 0xffffffff [0074.141] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.141] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.141] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop Ransomware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop Ransomware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop Ransomware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop Ransomware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top Ransomware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op Ransomware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p Ransomware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Ransomware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ransomware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ansomware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nsomware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="somware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="omware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ware.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="are.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="re.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.141] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop Ransomware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop Ransomware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop Ransomware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop Ransomware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top Ransomware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op Ransomware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p Ransomware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Ransomware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0074.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ransomware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ansomware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0074.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nsomware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="somware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="omware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ware.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="are.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0074.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="re.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.142] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.142] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0074.142] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0074.142] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0074.142] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0074.142] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0074.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.142] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0074.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.142] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Desktop Ransomware.exe", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7c9e8 [0074.143] FindClose (in: hFindFile=0xa7c9e8 | out: hFindFile=0xa7c9e8) returned 1 [0074.143] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.143] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.143] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0074.143] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.143] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0074.143] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.143] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.143] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.143] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.143] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.143] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.143] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.143] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.143] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0074.144] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.144] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.144] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0074.144] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.144] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0074.144] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.144] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.144] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.144] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.144] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.144] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.144] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0074.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0074.144] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.144] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.144] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0074.144] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.144] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0074.144] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0074.144] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0074.145] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0074.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a958, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0074.145] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0074.145] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0074.145] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.145] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.145] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0074.145] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.146] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0074.146] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.146] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.146] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.146] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.146] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.146] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.146] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0074.146] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.148] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0074.148] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.148] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0074.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.148] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0074.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.148] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0074.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.149] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0074.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.149] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.149] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.149] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.149] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.149] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.149] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0074.149] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.149] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0074.149] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.149] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.149] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.149] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.149] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.149] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.149] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.149] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.149] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0074.149] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.150] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0074.150] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.150] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.150] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92fb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0074.150] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0074.150] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0074.150] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.150] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.150] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.150] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x39811f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0074.150] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0074.150] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981200, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0074.150] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.150] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.150] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.151] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.151] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.151] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.151] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a1e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0074.151] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0074.151] CryptHashData (hHash=0xa7cb28, pbData=0x3981170, dwDataLen=0x3, dwFlags=0x1) returned 1 [0074.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.151] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.151] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.151] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.151] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.151] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.151] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0074.151] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.151] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0074.151] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.151] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.151] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a468, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0074.152] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0074.152] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cb28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d068) returned 1 [0074.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.152] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.152] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0074.152] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.152] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0074.152] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0074.152] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7acb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0074.152] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0074.152] CryptDestroyHash (hHash=0xa7cb28) returned 1 [0074.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.152] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.153] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.153] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.153] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.153] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Desktop Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\desktop ransomware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0074.153] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.153] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0074.153] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.153] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.153] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.153] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0074.153] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.Desktop Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.desktop ransomware.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0074.154] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.154] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.154] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.154] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.156] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0074.156] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0074.160] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0074.161] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0074.163] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0074.164] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0074.165] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0074.166] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0074.167] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0074.169] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0074.171] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0074.172] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0074.173] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0074.174] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0xa000, lpOverlapped=0x0) returned 1 [0074.176] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0074.204] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.218] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.218] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.218] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0074.241] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 1 [0074.241] TranslateMessage (lpMsg=0x8bf3b8) returned 0 [0074.241] DispatchMessageW (lpMsg=0x8bf3b8) returned 0x0 [0074.241] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0074.241] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0074.241] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.241] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0074.241] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.241] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.241] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.241] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.241] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.241] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.241] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.242] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0074.242] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.242] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0074.242] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.242] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.242] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.242] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.242] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.242] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.242] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.242] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.242] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.242] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0074.242] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.242] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0074.242] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.242] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.242] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.242] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.242] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.243] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.243] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.243] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.243] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.243] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.255] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a138, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.256] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0074.256] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xca000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xca008) returned 1 [0074.256] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.256] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.256] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.256] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.256] CharLowerBuffW (in: lpsz="byte[827400]", cchLength=0xc | out: lpsz="byte[827400]") returned 0xc [0074.264] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.296] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.297] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.297] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.297] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.297] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.316] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a150, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.317] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0074.317] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e1b020*, pdwDataLen=0x8bef60*=0xca000, dwBufLen=0xca008 | out: pbData=0x3e1b020*, pdwDataLen=0x8bef60*=0xca008) returned 1 [0074.363] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.363] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.363] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.363] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.387] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.387] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.387] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.387] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0074.387] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.387] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0074.387] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.387] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.387] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0074.388] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.388] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0074.388] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.388] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.388] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.388] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.388] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.388] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.388] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.388] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.388] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.388] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.388] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.518] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.518] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.518] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.527] WriteFile (in: hFile=0x24c, lpBuffer=0x3c64020*, nNumberOfBytesToWrite=0xca008, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3c64020*, lpNumberOfBytesWritten=0x8bf5e4*=0xca008, lpOverlapped=0x0) returned 1 [0074.543] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.544] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.544] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0074.544] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0074.544] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0074.544] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0074.544] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0074.544] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.544] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0074.544] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.544] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0074.544] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0074.544] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c928b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0074.544] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0074.545] CryptDestroyKey (hKey=0xa7d068) returned 1 [0074.545] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0074.545] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0074.545] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0074.545] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0074.545] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0074.545] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0074.545] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0074.545] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0074.545] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0074.545] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0074.545] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0074.545] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0074.545] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0074.545] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0074.545] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.545] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0074.545] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.545] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0074.545] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0074.545] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0074.545] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0074.546] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0074.546] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0074.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.546] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0074.546] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.546] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0074.546] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.546] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.546] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0074.546] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.546] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0074.546] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.546] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.546] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.546] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.546] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.546] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.546] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.546] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.546] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.546] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.546] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.546] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.547] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.547] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.547] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.547] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0074.547] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.547] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0074.547] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.547] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.547] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0074.547] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0074.547] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0074.547] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.547] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.547] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.547] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.548] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.548] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0074.548] FreeLibrary (hLibModule=0x76a10000) returned 1 [0074.548] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.548] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.548] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.548] CloseHandle (hObject=0x240) returned 1 [0074.549] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.549] CloseHandle (hObject=0x24c) returned 1 [0074.565] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.568] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.568] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0074.568] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0074.568] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Desktop Ransomware.exe", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", lpFilePart=0x8bedf4*="Desktop Ransomware.exe") returned 0x34 [0074.568] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\desktop ransomware.exe")) returned 0x20 [0074.569] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7ce28 [0074.569] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\desktop ransomware.exe")) returned 0 [0074.569] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0074.569] GetLastError () returned 0x5 [0074.569] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.569] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0074.569] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0074.569] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Desktop Ransomware.exe", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe", lpFilePart=0x8bf650*="Desktop Ransomware.exe") returned 0x34 [0074.569] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Desktop Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\desktop ransomware.exe")) returned 0x20 [0074.569] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.569] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.569] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0074.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0074.570] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0074.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0074.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0074.570] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0074.570] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0074.570] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0074.570] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0074.570] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0074.570] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0074.570] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.570] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0074.570] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.570] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.570] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.571] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.571] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.571] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/desktop.ini", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7caa8 [0074.571] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0074.571] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.571] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.571] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0074.571] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.571] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0074.571] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.571] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.571] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.571] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.571] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.571] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.571] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0074.571] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.571] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0074.572] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.572] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.572] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0074.572] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.572] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0074.572] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.572] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.572] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.572] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.572] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.572] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.572] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0074.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0074.572] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.572] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.572] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0074.572] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.572] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0074.572] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0074.572] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0074.573] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0074.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0074.573] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0074.573] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0074.573] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.573] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.573] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0074.574] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.574] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0074.574] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.574] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.574] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.574] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.574] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.574] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.574] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0074.574] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.574] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0074.574] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.574] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.574] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0074.574] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0074.574] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.574] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.574] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.574] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0074.574] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.574] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0074.575] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.575] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.575] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.575] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.575] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.575] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.575] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.575] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0074.575] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.575] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0074.575] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.575] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.575] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.575] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.575] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.575] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.575] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.575] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.575] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.575] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0074.575] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.575] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0074.575] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.575] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.576] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.576] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.576] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.576] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.576] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.576] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.576] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.576] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.576] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.576] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0074.576] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.576] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0074.576] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.576] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.576] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e50, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0074.576] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0074.576] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0074.577] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.577] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.577] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.577] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981dc0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0074.577] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0074.577] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981cf0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0074.604] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.604] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.604] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.604] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.604] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.604] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.604] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a330, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0074.604] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0074.604] CryptHashData (hHash=0xa7cee8, pbData=0x3981e20, dwDataLen=0x3, dwFlags=0x1) returned 1 [0074.604] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.604] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.604] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.604] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.604] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.604] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.605] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.605] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.605] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0074.605] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.605] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0074.605] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.605] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.605] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a4c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0074.605] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0074.605] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cee8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cb28) returned 1 [0074.605] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.605] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.605] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.605] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.605] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.605] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.605] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.605] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0074.606] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.606] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0074.606] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0074.606] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7abd8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0074.606] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0074.606] CryptDestroyHash (hHash=0xa7cee8) returned 1 [0074.606] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.606] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.606] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.606] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.606] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.607] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0074.607] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.607] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0074.607] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.607] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.607] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.607] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0074.607] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0074.625] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.625] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.625] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.625] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.628] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0074.628] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x11a, lpOverlapped=0x0) returned 1 [0074.628] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0074.630] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.630] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.630] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.631] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0074.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.631] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0074.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.631] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0074.631] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.631] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0074.631] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.631] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.631] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.631] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.631] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.631] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.631] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.631] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.631] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.631] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0074.631] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.631] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0074.632] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.632] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.632] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.632] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.632] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.632] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.632] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.632] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.632] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.632] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.632] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.632] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.632] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.632] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a330, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.632] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0074.632] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x11a, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x120) returned 1 [0074.632] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.633] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.633] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.633] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.633] CharLowerBuffW (in: lpsz="byte[288]", cchLength=0x9 | out: lpsz="byte[288]") returned 0x9 [0074.633] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.633] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.633] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0074.633] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.633] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0074.633] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.633] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0074.633] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a360, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.633] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0074.633] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cb5028*, pdwDataLen=0x8bef60*=0x11a, dwBufLen=0x120 | out: pbData=0x2cb5028*, pdwDataLen=0x8bef60*=0x120) returned 1 [0074.633] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.633] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.633] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.633] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.633] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.634] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.634] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.634] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0074.634] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.634] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0074.634] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.634] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.634] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0074.634] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.634] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0074.634] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.634] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.634] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0074.634] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.634] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0074.634] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.634] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0074.634] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.634] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0074.634] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.634] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0074.634] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0074.634] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.634] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.634] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.635] WriteFile (in: hFile=0x240, lpBuffer=0x2c85028*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2c85028*, lpNumberOfBytesWritten=0x8bf5e4*=0x120, lpOverlapped=0x0) returned 1 [0074.635] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0074.635] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.255] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0075.255] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 1 [0075.255] TranslateMessage (lpMsg=0x8bf3a0) returned 0 [0075.255] DispatchMessageW (lpMsg=0x8bf3a0) returned 0x0 [0075.255] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0075.255] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0075.255] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.255] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0075.255] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.255] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.256] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.256] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.256] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.256] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.256] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.256] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92ac0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0075.256] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0075.256] CryptDestroyKey (hKey=0xa7cb28) returned 1 [0075.256] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.256] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.256] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0075.257] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.257] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0075.257] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.257] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.257] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0075.257] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.257] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0075.257] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.257] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.257] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.257] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.257] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.257] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.257] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.257] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.257] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.257] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.257] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.258] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.258] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.258] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.258] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0075.258] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.258] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0075.258] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.258] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.258] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0075.258] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.258] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0075.258] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.258] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.258] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.258] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.258] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.258] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.258] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.259] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.259] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.259] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.259] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.259] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.259] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.259] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.259] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.259] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0075.259] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.259] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0075.259] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.259] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.259] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0075.260] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0075.260] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0075.260] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.260] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.260] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.260] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.260] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.260] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.260] FreeLibrary (hLibModule=0x76a10000) returned 1 [0075.260] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.260] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.260] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.260] CloseHandle (hObject=0x24c) returned 1 [0075.261] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.261] CloseHandle (hObject=0x240) returned 1 [0075.264] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.264] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.264] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.264] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.264] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/desktop.ini", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", lpFilePart=0x8bedf4*="desktop.ini") returned 0x29 [0075.264] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\desktop.ini")) returned 0x26 [0075.264] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cb68 [0075.265] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\desktop.ini")) returned 1 [0075.266] FindNextFileW (in: hFindFile=0xa7cb68, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0075.266] FindClose (in: hFindFile=0xa7cb68 | out: hFindFile=0xa7cb68) returned 1 [0075.266] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.266] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.267] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.267] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/desktop.ini", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", lpFilePart=0x8bf650*="desktop.ini") returned 0x29 [0075.267] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\desktop.ini")) returned 0xffffffff [0075.267] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.267] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.267] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dPayGG-Py.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PayGG-Py.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ayGG-Py.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yGG-Py.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GG-Py.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G-Py.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Py.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Py.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.267] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dPayGG-Py.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PayGG-Py.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ayGG-Py.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yGG-Py.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GG-Py.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G-Py.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Py.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Py.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.267] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.267] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0075.267] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.268] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.268] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.268] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.268] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.268] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0075.268] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.268] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.268] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.268] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.268] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.268] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/dPayGG-Py.wav", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cfa8 [0075.268] FindClose (in: hFindFile=0xa7cfa8 | out: hFindFile=0xa7cfa8) returned 1 [0075.268] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.268] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.268] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0075.268] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.268] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0075.268] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.268] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.269] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.269] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.269] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.269] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.269] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.269] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.269] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0075.269] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.269] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.269] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0075.269] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.269] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0075.269] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.269] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.269] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.269] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.269] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.269] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.269] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0075.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0075.270] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.270] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.270] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.270] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.270] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.270] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.270] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0075.270] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0075.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0075.270] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0075.270] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0075.271] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.271] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.271] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0075.271] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.271] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0075.271] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.271] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.271] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.271] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.271] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.271] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.271] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0075.271] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.271] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0075.271] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.271] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.272] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.272] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.272] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.272] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.272] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.272] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0075.272] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.272] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0075.272] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.272] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.272] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.272] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.272] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.272] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.272] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.272] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0075.272] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.272] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0075.272] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.272] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.272] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.272] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.273] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.273] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.273] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.273] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.273] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.273] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0075.273] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.273] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0075.273] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.273] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.273] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.273] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.273] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.273] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.273] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.273] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.273] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.273] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.273] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.273] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0075.273] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.273] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0075.274] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.274] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.274] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0075.274] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0075.274] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0075.274] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.274] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.274] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.274] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3980780, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0075.274] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0075.274] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3980890, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0075.274] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.275] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.275] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.275] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.275] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.275] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.275] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0075.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a330, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0075.275] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0075.275] CryptHashData (hHash=0xa7cc28, pbData=0x39806f0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0075.275] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.275] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.275] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.275] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.275] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.275] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.275] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.275] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.275] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0075.276] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.276] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0075.276] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.276] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.276] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0075.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a6d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0075.276] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0075.276] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cc28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cd28) returned 1 [0075.276] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.276] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.276] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.276] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.276] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.276] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.276] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.276] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0075.276] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.276] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0075.276] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0075.277] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0075.277] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0075.277] CryptDestroyHash (hHash=0xa7cc28) returned 1 [0075.277] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.277] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.277] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.277] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.277] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.278] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/dPayGG-Py.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dpaygg-py.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0075.278] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.278] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0075.278] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.278] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.278] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.278] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0075.278] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.dPayGG-Py.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.dpaygg-py.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0075.279] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.279] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.279] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.279] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.281] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0075.281] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x1b35, lpOverlapped=0x0) returned 1 [0075.283] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0075.285] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.285] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.285] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.285] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0075.286] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.286] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0075.286] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.286] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.286] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.286] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.286] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.286] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.286] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.286] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0075.286] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.286] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0075.286] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.286] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.286] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.286] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.287] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.287] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.287] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.287] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.287] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.287] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0075.287] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.287] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0075.287] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.287] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.287] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.287] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.287] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.287] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.287] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.287] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.287] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.287] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.449] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.449] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.449] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.450] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a3d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.450] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0075.450] CryptEncrypt (in: hKey=0xa7cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x1b35, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x1b38) returned 1 [0075.450] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.450] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.450] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.450] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.450] CharLowerBuffW (in: lpsz="byte[6968]", cchLength=0xa | out: lpsz="byte[6968]") returned 0xa [0075.450] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.450] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.451] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.451] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.451] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.451] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.451] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.451] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a168, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.451] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0075.451] CryptEncrypt (in: hKey=0xa7cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cba1e8*, pdwDataLen=0x8bef60*=0x1b35, dwBufLen=0x1b38 | out: pbData=0x2cba1e8*, pdwDataLen=0x8bef60*=0x1b38) returned 1 [0075.451] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.451] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.451] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.452] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.452] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.452] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.452] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.452] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0075.452] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.452] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0075.452] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.452] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.452] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0075.452] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.452] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0075.452] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.452] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.452] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.452] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.452] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.452] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.452] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.452] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.452] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.452] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.452] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.452] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.453] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb6b68*, nNumberOfBytesToWrite=0x1b38, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb6b68*, lpNumberOfBytesWritten=0x8bf5e4*=0x1b38, lpOverlapped=0x0) returned 1 [0075.454] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.454] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.454] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0075.454] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.454] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0075.454] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.454] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.454] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.454] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.454] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.454] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.454] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.455] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c929b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0075.455] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0075.455] CryptDestroyKey (hKey=0xa7cd28) returned 1 [0075.455] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.455] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.455] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0075.455] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.455] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0075.455] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.455] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.455] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0075.455] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.455] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0075.455] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.455] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.455] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.455] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.456] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.456] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.456] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.456] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.456] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.456] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.456] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.456] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.456] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.456] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.456] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0075.456] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.456] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0075.456] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.456] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.456] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0075.456] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.456] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0075.456] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.456] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.456] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.456] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.457] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.457] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.457] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.457] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.457] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.457] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.457] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.457] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.457] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.457] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.457] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.457] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0075.457] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.457] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0075.457] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.457] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.457] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ab58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0075.457] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0075.457] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0075.458] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.458] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.458] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.458] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.458] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.458] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.458] FreeLibrary (hLibModule=0x76a10000) returned 1 [0075.458] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.458] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.458] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.458] CloseHandle (hObject=0x240) returned 1 [0075.459] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.459] CloseHandle (hObject=0x24c) returned 1 [0075.460] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.461] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.461] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.461] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.461] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/dPayGG-Py.wav", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dPayGG-Py.wav", lpFilePart=0x8bedf4*="dPayGG-Py.wav") returned 0x2b [0075.461] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dPayGG-Py.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dpaygg-py.wav")) returned 0x20 [0075.461] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dPayGG-Py.wav", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d0a8 [0075.461] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dPayGG-Py.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dpaygg-py.wav")) returned 1 [0075.571] FindNextFileW (in: hFindFile=0xa7d0a8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0075.571] FindClose (in: hFindFile=0xa7d0a8 | out: hFindFile=0xa7d0a8) returned 1 [0075.571] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.571] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.571] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.571] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/dPayGG-Py.wav", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dPayGG-Py.wav", lpFilePart=0x8bf650*="dPayGG-Py.wav") returned 0x2b [0075.571] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dPayGG-Py.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dpaygg-py.wav")) returned 0xffffffff [0075.572] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.572] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.572] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e5GfWHYXYvLZf4xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5GfWHYXYvLZf4xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GfWHYXYvLZf4xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWHYXYvLZf4xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WHYXYvLZf4xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HYXYvLZf4xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YXYvLZf4xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XYvLZf4xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YvLZf4xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vLZf4xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LZf4xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zf4xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f4xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xlvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lvH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vH.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.572] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e5GfWHYXYvLZf4xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5GfWHYXYvLZf4xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GfWHYXYvLZf4xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWHYXYvLZf4xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WHYXYvLZf4xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HYXYvLZf4xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YXYvLZf4xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XYvLZf4xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YvLZf4xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vLZf4xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LZf4xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zf4xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f4xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.573] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.573] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xlvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.573] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lvH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.573] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vH.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.573] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.573] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0075.573] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.573] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.573] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.573] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.573] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.573] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0075.573] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.573] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.573] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.573] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.631] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.631] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/e5GfWHYXYvLZf4xlvH.odt", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7ce28 [0075.631] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0075.631] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.631] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.631] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0075.631] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.631] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0075.631] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.632] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.632] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.632] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.632] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.632] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.632] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.632] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.632] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0075.632] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.632] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.632] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0075.632] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.632] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0075.632] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.632] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.632] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.632] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.632] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.632] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.632] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0075.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0075.633] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.633] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.633] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.633] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.633] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.633] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.633] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7acd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0075.633] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0075.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0075.633] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0075.633] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0075.634] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.634] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.634] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0075.634] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.634] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0075.634] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.634] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.634] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.634] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.634] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.634] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.634] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0075.634] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.634] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0075.634] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.634] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.634] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.635] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.635] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.635] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.635] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.635] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0075.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.635] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0075.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.635] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0075.635] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.635] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0075.635] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.635] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.635] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.635] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.635] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.635] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.635] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.636] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.636] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.636] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0075.636] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.636] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0075.636] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.636] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.636] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.636] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.636] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.636] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.636] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.636] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.636] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.636] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.636] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.636] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0075.636] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.636] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0075.636] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.636] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.636] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e68, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0075.637] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0075.637] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0075.637] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.637] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.637] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.637] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981c90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0075.637] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0075.637] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981b00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0075.637] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.637] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.637] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.637] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.637] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.637] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.637] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0075.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a2e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0075.638] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0075.638] CryptHashData (hHash=0xa7cc28, pbData=0x3981bd0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0075.638] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.638] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.638] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.638] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.638] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.638] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.638] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.638] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.638] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0075.638] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.638] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0075.638] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.638] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.638] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0075.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a4c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0075.639] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0075.639] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cc28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cca8) returned 1 [0075.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.639] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.639] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0075.639] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.639] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0075.639] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0075.639] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aa58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0075.639] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0075.639] CryptDestroyHash (hHash=0xa7cc28) returned 1 [0075.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.639] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.639] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.640] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.805] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.805] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/e5GfWHYXYvLZf4xlvH.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\e5gfwhyxyvlzf4xlvh.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0075.805] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.805] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0075.805] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.805] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.805] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.805] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0075.805] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.e5GfWHYXYvLZf4xlvH.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.e5gfwhyxyvlzf4xlvh.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0075.806] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.806] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.806] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.806] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.808] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0075.808] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0xd110, lpOverlapped=0x0) returned 1 [0075.809] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0075.812] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.812] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.812] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.812] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0075.813] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.813] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0075.813] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.813] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.813] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.813] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.814] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.814] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.814] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.814] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0075.814] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.814] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0075.814] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.814] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.814] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.814] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.814] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.814] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.814] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.814] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.814] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.814] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0075.814] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.814] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0075.814] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.814] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.814] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.814] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.814] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.814] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.814] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.815] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.815] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.815] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.815] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.815] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.815] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.816] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a2d0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.816] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0075.816] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xd110, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xd118) returned 1 [0075.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.817] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.817] CharLowerBuffW (in: lpsz="byte[53528]", cchLength=0xb | out: lpsz="byte[53528]") returned 0xb [0075.817] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.818] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.818] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.819] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.819] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.819] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.819] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.820] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a150, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.820] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0075.820] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3984050*, pdwDataLen=0x8bef60*=0xd110, dwBufLen=0xd118 | out: pbData=0x3984050*, pdwDataLen=0x8bef60*=0xd118) returned 1 [0075.822] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.822] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.822] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.822] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.822] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.822] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.822] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.822] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0075.822] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.823] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0075.823] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.823] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.823] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0075.823] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.823] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0075.823] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.823] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.823] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.823] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.823] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.823] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.823] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.823] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.823] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.823] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.823] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.823] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.827] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.827] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.827] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.827] WriteFile (in: hFile=0x240, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0xd118, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0xd118, lpOverlapped=0x0) returned 1 [0075.830] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.830] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.830] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0075.830] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.830] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0075.830] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.830] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.830] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.830] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.830] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.830] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.830] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.830] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92808, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0075.831] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0075.831] CryptDestroyKey (hKey=0xa7cca8) returned 1 [0075.831] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.831] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.831] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0075.831] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.831] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0075.831] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.831] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.831] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0075.831] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.831] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0075.831] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.831] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.831] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.831] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.832] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.832] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.832] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.832] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.832] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.832] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.832] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.832] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.832] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.832] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.832] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0075.832] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.832] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0075.832] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.857] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.857] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0075.857] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.857] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0075.857] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.857] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.857] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.857] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.857] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.857] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.857] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.857] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.858] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.858] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.858] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.858] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.858] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.858] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.858] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.858] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0075.858] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.858] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0075.858] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.858] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a9b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0075.858] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0075.858] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0075.858] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.858] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.858] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.859] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.859] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.859] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.859] FreeLibrary (hLibModule=0x76a10000) returned 1 [0075.859] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.859] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.859] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.859] CloseHandle (hObject=0x24c) returned 1 [0075.862] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.862] CloseHandle (hObject=0x240) returned 1 [0075.866] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.868] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.868] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.868] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.868] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/e5GfWHYXYvLZf4xlvH.odt", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\e5GfWHYXYvLZf4xlvH.odt", lpFilePart=0x8bedf4*="e5GfWHYXYvLZf4xlvH.odt") returned 0x34 [0075.868] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\e5GfWHYXYvLZf4xlvH.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\e5gfwhyxyvlzf4xlvh.odt")) returned 0x20 [0075.869] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\e5GfWHYXYvLZf4xlvH.odt", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7c9a8 [0075.869] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\e5GfWHYXYvLZf4xlvH.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\e5gfwhyxyvlzf4xlvh.odt")) returned 1 [0075.871] FindNextFileW (in: hFindFile=0xa7c9a8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0075.871] FindClose (in: hFindFile=0xa7c9a8 | out: hFindFile=0xa7c9a8) returned 1 [0075.871] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.871] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.871] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.871] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/e5GfWHYXYvLZf4xlvH.odt", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\e5GfWHYXYvLZf4xlvH.odt", lpFilePart=0x8bf650*="e5GfWHYXYvLZf4xlvH.odt") returned 0x34 [0075.871] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\e5GfWHYXYvLZf4xlvH.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\e5gfwhyxyvlzf4xlvh.odt")) returned 0xffffffff [0075.872] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.872] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.872] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gj X79Jxk-e2.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j X79Jxk-e2.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" X79Jxk-e2.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X79Jxk-e2.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="79Jxk-e2.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9Jxk-e2.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jxk-e2.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xk-e2.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k-e2.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-e2.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e2.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.872] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gj X79Jxk-e2.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j X79Jxk-e2.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" X79Jxk-e2.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X79Jxk-e2.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="79Jxk-e2.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9Jxk-e2.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jxk-e2.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xk-e2.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k-e2.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-e2.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.873] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e2.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.873] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.873] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0075.873] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.873] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.873] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.873] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.873] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.873] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0075.873] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.873] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.873] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.873] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.873] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.873] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/gj X79Jxk-e2.mp3", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cb68 [0075.873] FindClose (in: hFindFile=0xa7cb68 | out: hFindFile=0xa7cb68) returned 1 [0075.874] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.874] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.874] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0075.874] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.874] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0075.874] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.874] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.874] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.874] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.874] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.874] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.874] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.874] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.874] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0075.874] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.874] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.875] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0075.875] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.875] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0075.875] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.875] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.875] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.875] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.875] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.875] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.875] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0075.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0075.875] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.875] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.875] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.875] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.881] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.881] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.881] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0075.882] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0075.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0075.882] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0075.882] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0075.883] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.883] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.883] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0075.883] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.883] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0075.883] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.883] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.883] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.883] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.883] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.883] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.883] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0075.883] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.883] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0075.883] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.883] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.884] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.884] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.884] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.884] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.884] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.884] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0075.884] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.884] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0075.884] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.884] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.884] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.884] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.884] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.884] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.884] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.884] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0075.884] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.884] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0075.884] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.885] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.885] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.885] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.885] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.885] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.885] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.885] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.885] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.885] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0075.885] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.885] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0075.885] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.885] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.885] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.885] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.885] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.885] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.886] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.886] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.886] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.886] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.886] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.886] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0075.886] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.886] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0075.886] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.886] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.886] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e98, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0075.887] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0075.887] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0075.887] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.887] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.887] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.887] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x39809a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0075.887] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0075.887] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3980970, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0075.887] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.887] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.887] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.888] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.888] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.888] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.888] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0075.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a2e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0075.888] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0075.888] CryptHashData (hHash=0xa7cee8, pbData=0x3980960, dwDataLen=0x3, dwFlags=0x1) returned 1 [0075.888] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.888] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.888] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.888] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.888] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.888] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.888] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.888] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.889] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0075.889] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.889] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0075.889] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.889] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.889] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0075.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a528, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0075.889] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0075.889] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cee8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d168) returned 1 [0075.889] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.889] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.889] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.889] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.889] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.889] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.890] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.890] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0075.890] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.890] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0075.890] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0075.890] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aab8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0075.890] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0075.890] CryptDestroyHash (hHash=0xa7cee8) returned 1 [0075.890] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.890] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.890] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.890] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.890] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.892] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/gj X79Jxk-e2.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gj x79jxk-e2.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0075.892] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.892] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0075.892] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.892] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.892] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.892] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0075.892] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.gj X79Jxk-e2.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.gj x79jxk-e2.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0075.893] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.893] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.893] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.893] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.895] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0075.895] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x71ea, lpOverlapped=0x0) returned 1 [0075.896] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0075.900] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.900] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.900] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.900] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0075.900] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.900] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0075.900] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.900] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.900] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.901] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.901] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.901] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.901] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.901] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0075.901] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.901] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0075.901] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.901] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.901] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.901] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.901] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.901] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.901] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.901] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.901] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.901] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0075.901] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.902] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0075.902] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.902] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.902] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.902] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.902] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.902] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.902] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.902] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.902] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.902] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.902] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.902] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.902] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.903] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a138, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.903] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0075.903] CryptEncrypt (in: hKey=0xa7d168, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x71ea, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x71f0) returned 1 [0075.903] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.903] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.903] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.903] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.903] CharLowerBuffW (in: lpsz="byte[29168]", cchLength=0xb | out: lpsz="byte[29168]") returned 0xb [0075.903] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.904] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.904] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.904] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.904] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.904] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.904] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.904] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a138, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.905] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0075.905] CryptEncrypt (in: hKey=0xa7d168, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cca610*, pdwDataLen=0x8bef60*=0x71ea, dwBufLen=0x71f0 | out: pbData=0x2cca610*, pdwDataLen=0x8bef60*=0x71f0) returned 1 [0075.906] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.906] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.906] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.906] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.906] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.906] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.906] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.906] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0075.906] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.906] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0075.906] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.906] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.907] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0075.918] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.918] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0075.918] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.918] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.918] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.919] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.919] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.919] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.919] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.920] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.920] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.920] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.920] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.920] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.921] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.921] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.921] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.921] WriteFile (in: hFile=0x24c, lpBuffer=0x2cbc220*, nNumberOfBytesToWrite=0x71f0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cbc220*, lpNumberOfBytesWritten=0x8bf5e4*=0x71f0, lpOverlapped=0x0) returned 1 [0075.923] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.923] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.923] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0075.923] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.923] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0075.923] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.924] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.924] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.924] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.924] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.924] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.924] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.924] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92808, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0075.924] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0075.924] CryptDestroyKey (hKey=0xa7d168) returned 1 [0075.924] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.924] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.924] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0075.924] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.925] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0075.925] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.925] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.925] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0075.925] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.925] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0075.925] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.925] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.925] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.925] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.925] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.925] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.925] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.925] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.925] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.925] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.925] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.925] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.925] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.925] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.926] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0075.926] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.926] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0075.926] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.926] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.926] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0075.926] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.926] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0075.926] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.926] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.926] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.926] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.926] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.926] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.926] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.926] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.926] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.926] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.926] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.927] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.927] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.927] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.927] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.927] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0075.927] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.927] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0075.927] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.927] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.927] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a9f8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0075.927] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0075.927] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0075.927] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.927] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.928] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.928] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.928] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.928] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.928] FreeLibrary (hLibModule=0x76a10000) returned 1 [0075.928] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.928] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.928] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.928] CloseHandle (hObject=0x240) returned 1 [0075.929] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.929] CloseHandle (hObject=0x24c) returned 1 [0075.932] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.932] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.932] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.933] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.933] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/gj X79Jxk-e2.mp3", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gj X79Jxk-e2.mp3", lpFilePart=0x8bedf4*="gj X79Jxk-e2.mp3") returned 0x2e [0075.933] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gj X79Jxk-e2.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gj x79jxk-e2.mp3")) returned 0x20 [0075.933] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gj X79Jxk-e2.mp3", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cee8 [0075.933] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gj X79Jxk-e2.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gj x79jxk-e2.mp3")) returned 1 [0075.941] FindNextFileW (in: hFindFile=0xa7cee8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0075.941] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0075.941] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.941] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.941] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.942] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/gj X79Jxk-e2.mp3", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gj X79Jxk-e2.mp3", lpFilePart=0x8bf650*="gj X79Jxk-e2.mp3") returned 0x2e [0075.942] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gj X79Jxk-e2.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gj x79jxk-e2.mp3")) returned 0xffffffff [0075.942] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.942] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.942] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IKU0-73q9hf36BYJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KU0-73q9hf36BYJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U0-73q9hf36BYJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0-73q9hf36BYJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-73q9hf36BYJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="73q9hf36BYJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3q9hf36BYJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q9hf36BYJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9hf36BYJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hf36BYJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f36BYJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="36BYJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6BYJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BYJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YJPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JPVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PVXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VXf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xf.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.942] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IKU0-73q9hf36BYJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KU0-73q9hf36BYJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U0-73q9hf36BYJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0-73q9hf36BYJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-73q9hf36BYJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="73q9hf36BYJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3q9hf36BYJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q9hf36BYJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9hf36BYJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hf36BYJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f36BYJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="36BYJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6BYJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BYJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YJPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JPVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PVXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VXf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xf.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.943] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.943] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0075.943] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.943] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.943] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.943] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.944] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.944] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0075.944] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.944] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.944] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.944] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.944] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.944] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/IKU0-73q9hf36BYJPVXf.flv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cb28 [0075.944] FindClose (in: hFindFile=0xa7cb28 | out: hFindFile=0xa7cb28) returned 1 [0075.944] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.944] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.944] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0075.944] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.944] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0075.945] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.945] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.945] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.945] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.945] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.945] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.945] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.945] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.945] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0075.945] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.945] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.945] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0075.945] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.945] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0075.945] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.945] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.946] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.946] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.946] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.946] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.946] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0075.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0075.946] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.946] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.946] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.946] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.946] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.946] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.946] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a958, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0075.946] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0075.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa78, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0075.947] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0075.947] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0075.947] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.948] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.948] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0075.948] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.948] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0075.948] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.948] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.948] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.948] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.948] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.948] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.948] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0075.948] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.949] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0075.949] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.949] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0075.949] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.949] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0075.949] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.949] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0075.949] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.950] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0075.950] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.950] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.950] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.950] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.950] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.950] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.950] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.950] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.950] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.950] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0075.950] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.950] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0075.950] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.950] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.950] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.950] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.950] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.950] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.951] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.951] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.951] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.951] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.951] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.951] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0075.951] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.951] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0075.951] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.951] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.951] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e68, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0075.951] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0075.951] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0075.952] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.952] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.952] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.952] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x39803b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0075.952] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0075.952] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x39803f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0075.952] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.952] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.952] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.952] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.952] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.952] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.952] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0075.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a150, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0075.953] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0075.953] CryptHashData (hHash=0xa7cca8, pbData=0x3980430, dwDataLen=0x3, dwFlags=0x1) returned 1 [0075.953] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.953] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.953] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.953] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.953] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.953] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.953] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.953] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.953] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0075.953] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.953] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0075.953] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.954] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.954] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0075.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a3f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0075.955] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0075.955] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cca8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cfa8) returned 1 [0075.955] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.955] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.955] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.955] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.955] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.955] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.955] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.955] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0075.955] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.955] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0075.955] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0075.955] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a978, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0075.956] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0075.956] CryptDestroyHash (hHash=0xa7cca8) returned 1 [0075.956] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.956] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.956] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.956] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.956] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.956] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/IKU0-73q9hf36BYJPVXf.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\iku0-73q9hf36byjpvxf.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0075.956] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.956] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0075.956] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.956] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.956] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.957] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0075.957] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.IKU0-73q9hf36BYJPVXf.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.iku0-73q9hf36byjpvxf.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0075.957] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.957] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.957] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.957] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.960] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0075.960] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x759e, lpOverlapped=0x0) returned 1 [0075.961] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0075.964] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.964] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.964] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.964] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0075.965] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.965] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0075.965] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.965] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.965] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.965] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.965] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.965] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.965] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.965] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0075.965] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.965] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0075.965] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.965] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.965] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.966] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.966] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.966] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.966] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.966] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.970] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.971] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0075.971] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.971] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0075.971] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.971] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.971] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.971] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.971] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.972] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a2d0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.972] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0075.972] CryptEncrypt (in: hKey=0xa7cfa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x759e, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x75a0) returned 1 [0075.972] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.972] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.972] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.972] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.972] CharLowerBuffW (in: lpsz="byte[30112]", cchLength=0xb | out: lpsz="byte[30112]") returned 0xb [0075.972] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.973] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.973] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.973] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.973] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.973] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.973] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0075.973] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a168, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.974] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0075.974] CryptEncrypt (in: hKey=0xa7cfa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ccb120*, pdwDataLen=0x8bef60*=0x759e, dwBufLen=0x75a0 | out: pbData=0x2ccb120*, pdwDataLen=0x8bef60*=0x75a0) returned 1 [0075.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.975] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0075.975] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.975] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0075.975] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.975] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.975] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0075.976] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.976] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0075.976] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.976] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.976] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0075.976] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.976] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.976] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.976] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.976] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.976] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0075.976] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.976] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0075.976] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0075.977] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.977] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.977] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.977] WriteFile (in: hFile=0x240, lpBuffer=0x2cbc5d0*, nNumberOfBytesToWrite=0x75a0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cbc5d0*, lpNumberOfBytesWritten=0x8bf5e4*=0x75a0, lpOverlapped=0x0) returned 1 [0075.979] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.979] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.979] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0075.979] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.979] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0075.979] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.979] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.979] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.979] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.980] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.980] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.980] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0075.980] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c929a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0075.980] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0075.980] CryptDestroyKey (hKey=0xa7cfa8) returned 1 [0075.980] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.980] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.980] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0075.980] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.980] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0075.980] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.980] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.980] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0075.981] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.981] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0075.981] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.981] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.981] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0075.981] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.981] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.981] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.981] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.981] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.981] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0075.981] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.981] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0075.981] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.981] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0075.981] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.981] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0075.981] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.981] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0075.982] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.982] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.982] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0075.982] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.982] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0075.982] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.982] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.982] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.982] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.982] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.982] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.982] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.982] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.982] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.982] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.982] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.982] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.982] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.982] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.983] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.983] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0075.983] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.983] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0075.983] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.983] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.983] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0075.983] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0075.983] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0075.983] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.983] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.983] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.984] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.984] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.984] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0075.984] FreeLibrary (hLibModule=0x76a10000) returned 1 [0075.984] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.984] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.984] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.984] CloseHandle (hObject=0x24c) returned 1 [0075.986] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.986] CloseHandle (hObject=0x240) returned 1 [0075.987] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.988] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.991] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.991] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.991] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/IKU0-73q9hf36BYJPVXf.flv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IKU0-73q9hf36BYJPVXf.flv", lpFilePart=0x8bedf4*="IKU0-73q9hf36BYJPVXf.flv") returned 0x36 [0075.991] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IKU0-73q9hf36BYJPVXf.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\iku0-73q9hf36byjpvxf.flv")) returned 0x20 [0075.991] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IKU0-73q9hf36BYJPVXf.flv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cda8 [0075.991] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IKU0-73q9hf36BYJPVXf.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\iku0-73q9hf36byjpvxf.flv")) returned 1 [0075.994] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0075.994] FindClose (in: hFindFile=0xa7cda8 | out: hFindFile=0xa7cda8) returned 1 [0075.994] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.994] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.994] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.994] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/IKU0-73q9hf36BYJPVXf.flv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IKU0-73q9hf36BYJPVXf.flv", lpFilePart=0x8bf650*="IKU0-73q9hf36BYJPVXf.flv") returned 0x36 [0075.995] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IKU0-73q9hf36BYJPVXf.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\iku0-73q9hf36byjpvxf.flv")) returned 0xffffffff [0075.995] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.995] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.995] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J_D_Smy7X3HCRMT CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_D_Smy7X3HCRMT CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D_Smy7X3HCRMT CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_Smy7X3HCRMT CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Smy7X3HCRMT CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="my7X3HCRMT CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y7X3HCRMT CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7X3HCRMT CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X3HCRMT CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3HCRMT CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HCRMT CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CRMT CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RMT CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MT CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CH6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0075.995] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J_D_Smy7X3HCRMT CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_D_Smy7X3HCRMT CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D_Smy7X3HCRMT CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_Smy7X3HCRMT CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Smy7X3HCRMT CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="my7X3HCRMT CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y7X3HCRMT CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7X3HCRMT CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X3HCRMT CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3HCRMT CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HCRMT CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CRMT CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RMT CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MT CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CH6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0075.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6x.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0075.996] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0075.996] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0075.996] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.996] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.996] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0075.996] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0075.996] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.996] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0075.996] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.996] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.996] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.996] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.996] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.996] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/J_D_Smy7X3HCRMT CH6x.mkv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cc28 [0075.996] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0075.997] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.997] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0075.997] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0075.997] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.997] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0075.997] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.997] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.997] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0075.997] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.997] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0075.997] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.997] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0075.997] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.997] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0075.997] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.997] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.997] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0075.997] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.997] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0075.997] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.997] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.997] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.998] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.998] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.998] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.998] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0075.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0075.998] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.998] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0075.998] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.998] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0075.998] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.998] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0075.998] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0075.998] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0075.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac78, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0075.998] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0075.999] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0075.999] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.999] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.999] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0075.999] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.999] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0075.999] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.999] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.999] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0075.999] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.999] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.999] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0075.999] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0075.999] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.000] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0076.000] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.000] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0076.000] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.000] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0076.000] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.000] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0076.000] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.001] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0076.001] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 1 [0076.001] TranslateMessage (lpMsg=0x8bf158) returned 0 [0076.001] DispatchMessageW (lpMsg=0x8bf158) returned 0x0 [0076.001] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0076.001] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0076.001] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.001] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.001] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.001] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.001] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.001] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.001] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.001] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.001] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.001] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0076.001] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.001] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0076.001] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.001] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.002] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.002] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.002] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.002] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.002] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.002] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.002] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.002] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.002] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.002] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0076.002] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.002] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0076.002] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.002] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.002] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92eb0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0076.002] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0076.002] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0076.003] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.003] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.003] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.003] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3982680, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0076.003] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0076.003] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x39826e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0076.003] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.003] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.003] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.003] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.003] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.003] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.003] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0076.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a138, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0076.003] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0076.003] CryptHashData (hHash=0xa7cc28, pbData=0x39825c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0076.004] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.004] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.004] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.004] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.004] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.004] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.004] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.004] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.004] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0076.004] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.004] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0076.004] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.004] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.004] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0076.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a528, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0076.004] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0076.004] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cc28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d068) returned 1 [0076.004] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.004] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.004] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.004] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.005] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.005] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.005] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.005] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.005] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.005] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.005] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.005] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0076.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a958, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0076.005] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0076.005] CryptDestroyHash (hHash=0xa7cc28) returned 1 [0076.005] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.005] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.005] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.005] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.005] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.005] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/J_D_Smy7X3HCRMT CH6x.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\j_d_smy7x3hcrmt ch6x.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0076.006] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.006] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0076.006] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.006] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.006] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.006] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0076.006] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.J_D_Smy7X3HCRMT CH6x.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.j_d_smy7x3hcrmt ch6x.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0076.006] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.006] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.006] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.006] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.008] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0076.009] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10ef, lpOverlapped=0x0) returned 1 [0076.009] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0076.012] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.012] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.012] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.012] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0076.012] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.012] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0076.012] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.012] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.012] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.012] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.012] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.012] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.013] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.013] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0076.013] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.013] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0076.013] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.013] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.013] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.013] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.013] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.013] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.013] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.013] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.013] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.013] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0076.013] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.013] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0076.013] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.013] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.013] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.014] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.014] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.014] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.014] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.014] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.014] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.014] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.014] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.014] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.014] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.014] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a330, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0076.014] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0076.014] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x10ef, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x10f0) returned 1 [0076.014] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.014] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.014] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.014] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.015] CharLowerBuffW (in: lpsz="byte[4336]", cchLength=0xa | out: lpsz="byte[4336]") returned 0xa [0076.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.015] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.015] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.015] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.015] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.015] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.015] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a168, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0076.015] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0076.015] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cb8310*, pdwDataLen=0x8bef60*=0x10ef, dwBufLen=0x10f0 | out: pbData=0x2cb8310*, pdwDataLen=0x8bef60*=0x10f0) returned 1 [0076.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.016] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0076.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.016] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0076.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.016] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0076.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.016] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0076.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.017] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.017] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.017] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.017] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.017] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.017] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.017] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.017] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.017] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.017] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.017] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.017] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.017] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb6120*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb6120*, lpNumberOfBytesWritten=0x8bf5e4*=0x10f0, lpOverlapped=0x0) returned 1 [0076.018] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.018] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.018] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0076.018] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.018] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0076.018] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.018] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.018] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.018] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0076.018] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.018] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0076.018] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0076.018] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92838, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0076.019] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0076.019] CryptDestroyKey (hKey=0xa7d068) returned 1 [0076.019] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.019] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.019] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0076.019] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.019] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0076.019] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.019] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.019] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0076.019] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.019] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0076.019] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.019] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.019] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.019] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.019] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.019] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0076.019] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.020] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0076.020] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0076.020] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.020] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.020] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.020] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.020] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.020] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0076.020] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.020] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0076.020] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.020] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.020] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0076.020] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.020] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0076.020] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.020] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.020] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.020] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.020] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.020] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.020] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.020] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.020] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.020] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.020] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.021] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.021] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0076.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.021] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0076.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.021] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0076.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0076.021] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0076.021] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0076.021] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.021] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.021] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.021] FreeLibrary (hLibModule=0x76a10000) returned 1 [0076.022] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.022] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.022] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.022] CloseHandle (hObject=0x240) returned 1 [0076.022] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.022] CloseHandle (hObject=0x24c) returned 1 [0076.025] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.025] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.025] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.025] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.025] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/J_D_Smy7X3HCRMT CH6x.mkv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\J_D_Smy7X3HCRMT CH6x.mkv", lpFilePart=0x8bedf4*="J_D_Smy7X3HCRMT CH6x.mkv") returned 0x36 [0076.025] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\J_D_Smy7X3HCRMT CH6x.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\j_d_smy7x3hcrmt ch6x.mkv")) returned 0x20 [0076.026] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\J_D_Smy7X3HCRMT CH6x.mkv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d128 [0076.026] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\J_D_Smy7X3HCRMT CH6x.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\j_d_smy7x3hcrmt ch6x.mkv")) returned 1 [0076.028] FindNextFileW (in: hFindFile=0xa7d128, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0076.028] FindClose (in: hFindFile=0xa7d128 | out: hFindFile=0xa7d128) returned 1 [0076.029] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.029] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.029] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.029] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/J_D_Smy7X3HCRMT CH6x.mkv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\J_D_Smy7X3HCRMT CH6x.mkv", lpFilePart=0x8bf650*="J_D_Smy7X3HCRMT CH6x.mkv") returned 0x36 [0076.029] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\J_D_Smy7X3HCRMT CH6x.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\j_d_smy7x3hcrmt ch6x.mkv")) returned 0xffffffff [0076.029] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.029] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.029] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K2q1laBaVd-UhyM66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2q1laBaVd-UhyM66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q1laBaVd-UhyM66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1laBaVd-UhyM66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="laBaVd-UhyM66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aBaVd-UhyM66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BaVd-UhyM66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aVd-UhyM66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vd-UhyM66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d-UhyM66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-UhyM66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UhyM66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hyM66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yM66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="66s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.029] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K2q1laBaVd-UhyM66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2q1laBaVd-UhyM66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q1laBaVd-UhyM66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1laBaVd-UhyM66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="laBaVd-UhyM66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aBaVd-UhyM66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BaVd-UhyM66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aVd-UhyM66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vd-UhyM66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d-UhyM66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-UhyM66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UhyM66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hyM66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yM66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="66s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6s.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.030] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.030] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0076.030] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.030] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.030] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.030] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.030] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.030] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0076.030] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.030] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.030] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.030] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.030] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.030] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/K2q1laBaVd-UhyM66s.mkv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d168 [0076.031] FindClose (in: hFindFile=0xa7d168 | out: hFindFile=0xa7d168) returned 1 [0076.031] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.031] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.031] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0076.031] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.031] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0076.031] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.031] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.031] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.031] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.031] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.031] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.031] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.031] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.031] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0076.031] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.031] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.034] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0076.034] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.034] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0076.034] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.034] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.034] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.034] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.034] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.034] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.034] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0076.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0076.034] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.034] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.034] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0076.034] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.034] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0076.034] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0076.034] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0076.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0076.035] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0076.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0076.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0076.035] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0076.035] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0076.035] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.035] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.035] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0076.036] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.036] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0076.036] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.036] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.036] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.036] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.036] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.036] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.036] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0076.036] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.036] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0076.036] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.036] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.036] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.036] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.036] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0076.036] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.036] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0076.036] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.036] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.036] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.036] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.037] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.037] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.037] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.037] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0076.037] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.037] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0076.037] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.037] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.037] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.037] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.037] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.037] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.037] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.037] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.037] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.037] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0076.037] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.037] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0076.037] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.037] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.037] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.037] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.037] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.037] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.037] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.038] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.038] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.038] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.038] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.038] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0076.038] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.038] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0076.038] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.038] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.038] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e68, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0076.038] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0076.038] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0076.038] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.038] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.039] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.039] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3980460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0076.039] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0076.039] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3980400, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0076.039] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.039] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.039] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.039] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.039] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.039] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.039] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0076.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a2d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0076.039] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0076.039] CryptHashData (hHash=0xa7d068, pbData=0x3980470, dwDataLen=0x3, dwFlags=0x1) returned 1 [0076.040] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.040] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.040] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.040] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.040] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.040] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.040] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.040] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.040] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0076.040] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.040] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0076.040] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.040] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.040] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0076.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a690, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0076.040] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0076.040] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d068, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cd28) returned 1 [0076.040] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.041] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.041] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.041] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.041] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.041] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.041] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.041] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.041] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.041] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.041] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.041] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0076.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aab8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0076.041] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0076.041] CryptDestroyHash (hHash=0xa7d068) returned 1 [0076.041] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.041] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.041] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.041] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.041] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.042] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/K2q1laBaVd-UhyM66s.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\k2q1labavd-uhym66s.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0076.042] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.042] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0076.042] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.042] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.042] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.042] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0076.042] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.K2q1laBaVd-UhyM66s.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.k2q1labavd-uhym66s.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0076.043] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.043] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.043] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.043] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.045] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0076.045] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0076.046] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x87d, lpOverlapped=0x0) returned 1 [0076.047] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0076.068] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.068] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.068] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.068] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0076.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.070] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0076.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.070] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0076.070] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.071] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0076.071] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.071] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.071] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.071] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.071] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.071] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.071] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.071] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.071] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.071] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0076.071] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.071] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0076.071] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.071] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.071] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.071] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.071] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.071] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.071] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.071] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.072] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.073] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a3d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0076.073] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0076.073] CryptEncrypt (in: hKey=0xa7cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x1087d, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x10880) returned 1 [0076.073] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.073] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.073] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.073] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.073] CharLowerBuffW (in: lpsz="byte[67712]", cchLength=0xb | out: lpsz="byte[67712]") returned 0xb [0076.074] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.076] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.076] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.076] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.076] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.076] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.076] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.077] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a0f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0076.078] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0076.078] CryptEncrypt (in: hKey=0xa7cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3984050*, pdwDataLen=0x8bef60*=0x1087d, dwBufLen=0x10880 | out: pbData=0x3984050*, pdwDataLen=0x8bef60*=0x10880) returned 1 [0076.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.081] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0076.081] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.081] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0076.081] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.081] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.081] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0076.081] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.081] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0076.081] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.081] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.081] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.082] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.082] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.082] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.082] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.082] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.082] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.082] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.082] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.087] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.087] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.087] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.088] WriteFile (in: hFile=0x240, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0x10880, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0x10880, lpOverlapped=0x0) returned 1 [0076.090] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.090] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.090] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0076.090] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.090] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0076.090] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.090] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.090] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.090] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0076.090] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.090] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0076.090] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0076.090] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c929a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0076.090] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0076.090] CryptDestroyKey (hKey=0xa7cd28) returned 1 [0076.090] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.091] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.091] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0076.091] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.091] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0076.091] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.091] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.091] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0076.091] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.091] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0076.091] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.091] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.091] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.091] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.091] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.091] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0076.091] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.091] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0076.091] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0076.091] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.091] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.091] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.091] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.092] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.092] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0076.092] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.092] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0076.092] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.092] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.092] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0076.092] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.092] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0076.092] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.092] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.092] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.092] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.092] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.092] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.092] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.092] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.092] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.092] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.092] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.092] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.092] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.092] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.094] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.095] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0076.095] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.095] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0076.095] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.095] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.095] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0076.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7abd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0076.095] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0076.095] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0076.095] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.095] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.095] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.095] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.095] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.095] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.095] FreeLibrary (hLibModule=0x76a10000) returned 1 [0076.096] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.096] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.096] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.096] CloseHandle (hObject=0x24c) returned 1 [0076.098] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.098] CloseHandle (hObject=0x240) returned 1 [0076.101] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.103] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.103] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.103] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.103] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/K2q1laBaVd-UhyM66s.mkv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\K2q1laBaVd-UhyM66s.mkv", lpFilePart=0x8bedf4*="K2q1laBaVd-UhyM66s.mkv") returned 0x34 [0076.103] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\K2q1laBaVd-UhyM66s.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\k2q1labavd-uhym66s.mkv")) returned 0x20 [0076.103] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\K2q1laBaVd-UhyM66s.mkv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cda8 [0076.103] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\K2q1laBaVd-UhyM66s.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\k2q1labavd-uhym66s.mkv")) returned 1 [0076.105] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0076.106] FindClose (in: hFindFile=0xa7cda8 | out: hFindFile=0xa7cda8) returned 1 [0076.106] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.106] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.106] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.106] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/K2q1laBaVd-UhyM66s.mkv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\K2q1laBaVd-UhyM66s.mkv", lpFilePart=0x8bf650*="K2q1laBaVd-UhyM66s.mkv") returned 0x34 [0076.106] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\K2q1laBaVd-UhyM66s.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\k2q1labavd-uhym66s.mkv")) returned 0xffffffff [0076.106] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.106] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.106] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.106] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lITr E-u.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.106] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ITr E-u.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.106] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tr E-u.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.106] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r E-u.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.106] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" E-u.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.106] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" E-u.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.106] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E-u.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.106] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-u.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.106] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.106] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.106] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lITr E-u.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.106] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ITr E-u.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.106] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tr E-u.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.106] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r E-u.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.107] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" E-u.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.107] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" E-u.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.107] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E-u.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.107] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-u.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.107] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.107] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0076.107] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.107] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.107] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.107] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.107] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.107] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0076.107] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.107] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.107] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.107] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.107] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.107] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/lITr E-u.ots", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cd28 [0076.107] FindClose (in: hFindFile=0xa7cd28 | out: hFindFile=0xa7cd28) returned 1 [0076.107] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.107] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.108] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0076.108] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.108] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0076.108] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.108] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.108] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.108] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.108] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.108] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.108] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.108] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.108] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0076.108] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.108] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.108] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0076.108] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.108] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0076.108] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.108] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.108] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.109] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.109] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.109] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.109] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0076.109] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0076.109] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.109] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.109] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0076.109] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.109] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0076.109] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0076.109] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0076.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0076.109] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0076.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0076.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0076.110] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0076.110] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0076.111] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.111] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.111] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0076.111] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.111] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0076.111] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.111] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.111] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.111] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.111] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.111] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.111] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0076.111] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.111] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0076.111] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.111] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.111] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.111] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.111] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.111] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.111] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.111] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0076.111] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.112] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0076.112] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.112] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.112] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.112] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.112] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.112] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.112] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.112] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0076.112] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.112] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0076.112] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.112] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.112] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.112] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.112] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.112] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.112] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.112] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.112] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.112] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0076.112] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.112] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0076.112] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.113] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.113] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.113] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.113] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.113] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.113] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.113] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.113] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.113] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.113] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.113] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0076.113] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.113] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0076.113] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.113] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.113] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92f58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0076.114] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0076.114] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0076.114] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.114] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.114] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.114] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983140, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0076.114] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0076.114] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983250, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0076.114] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.115] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.115] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.115] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.115] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.115] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.115] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0076.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a2d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0076.115] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0076.115] CryptHashData (hHash=0xa7cca8, pbData=0x3983240, dwDataLen=0x3, dwFlags=0x1) returned 1 [0076.115] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.116] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.116] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.116] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.116] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.116] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.116] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.116] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.116] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0076.116] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.116] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0076.116] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.116] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.116] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0076.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a528, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0076.116] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0076.116] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cca8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cb68) returned 1 [0076.116] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.116] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.117] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.117] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.117] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.117] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.117] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.117] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.117] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.117] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.117] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.117] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0076.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0076.117] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0076.117] CryptDestroyHash (hHash=0xa7cca8) returned 1 [0076.117] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.117] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.117] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.117] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.117] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.118] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/lITr E-u.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\litr e-u.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0076.118] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.118] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0076.118] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.119] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0076.119] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.lITr E-u.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.litr e-u.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0076.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.121] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0076.121] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0xd623, lpOverlapped=0x0) returned 1 [0076.123] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0076.126] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.126] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.126] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.126] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0076.126] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.127] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0076.127] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.127] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.127] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.127] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.127] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.127] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.127] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.127] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0076.127] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.127] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0076.127] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.127] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.127] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.127] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.127] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.127] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.127] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.127] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.127] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.127] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0076.127] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.127] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0076.127] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.127] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.128] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.128] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.128] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.128] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.128] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.128] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.128] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.128] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.128] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.128] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.128] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.129] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a330, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0076.129] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0076.130] CryptEncrypt (in: hKey=0xa7cb68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xd623, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xd628) returned 1 [0076.130] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.130] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.130] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.130] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.130] CharLowerBuffW (in: lpsz="byte[54824]", cchLength=0xb | out: lpsz="byte[54824]") returned 0xb [0076.130] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.132] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.132] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.132] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.132] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.132] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.132] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.133] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a0f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0076.134] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0076.134] CryptEncrypt (in: hKey=0xa7cb68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3984050*, pdwDataLen=0x8bef60*=0xd623, dwBufLen=0xd628 | out: pbData=0x3984050*, pdwDataLen=0x8bef60*=0xd628) returned 1 [0076.135] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.136] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.136] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.136] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.136] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.136] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.136] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.136] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0076.136] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.136] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0076.136] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.136] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.136] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0076.137] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.137] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0076.137] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.137] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.137] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.137] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.137] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.137] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.137] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.137] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.137] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.137] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.137] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.137] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.142] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0xd628, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0xd628, lpOverlapped=0x0) returned 1 [0076.144] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.144] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.144] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0076.144] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.149] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0076.149] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.149] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.149] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.149] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0076.149] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.149] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0076.149] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0076.149] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c929b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0076.150] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0076.150] CryptDestroyKey (hKey=0xa7cb68) returned 1 [0076.150] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.150] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.150] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0076.150] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.150] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0076.150] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.150] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.150] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0076.150] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.150] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0076.150] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.150] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.150] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.150] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.150] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.150] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0076.150] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.150] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0076.150] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0076.150] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.151] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.151] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.151] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.151] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.151] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0076.151] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.151] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0076.151] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.151] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.151] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0076.151] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.151] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0076.151] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.151] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.151] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.151] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.151] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.151] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.151] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.151] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.151] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.151] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.152] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.152] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.152] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.152] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.152] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.152] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0076.152] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.152] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0076.152] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.152] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.152] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0076.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7acf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0076.152] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0076.152] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0076.152] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.152] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.152] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.152] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.152] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.153] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.153] FreeLibrary (hLibModule=0x76a10000) returned 1 [0076.153] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.153] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.153] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.153] CloseHandle (hObject=0x240) returned 1 [0076.155] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.155] CloseHandle (hObject=0x24c) returned 1 [0076.538] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.540] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.540] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.540] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.540] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/lITr E-u.ots", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lITr E-u.ots", lpFilePart=0x8bedf4*="lITr E-u.ots") returned 0x2b [0076.540] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lITr E-u.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\litr e-u.ots")) returned 0x20 [0076.540] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lITr E-u.ots", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d0a8 [0076.540] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lITr E-u.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\litr e-u.ots")) returned 1 [0076.680] FindNextFileW (in: hFindFile=0xa7d0a8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0076.680] FindClose (in: hFindFile=0xa7d0a8 | out: hFindFile=0xa7d0a8) returned 1 [0076.680] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.680] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.680] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.680] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/lITr E-u.ots", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lITr E-u.ots", lpFilePart=0x8bf650*="lITr E-u.ots") returned 0x2b [0076.680] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lITr E-u.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\litr e-u.ots")) returned 0xffffffff [0076.680] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.680] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.680] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="md9DYhuwlzuJ4s.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d9DYhuwlzuJ4s.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9DYhuwlzuJ4s.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DYhuwlzuJ4s.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YhuwlzuJ4s.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="huwlzuJ4s.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uwlzuJ4s.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wlzuJ4s.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lzuJ4s.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zuJ4s.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uJ4s.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J4s.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4s.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.681] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="md9DYhuwlzuJ4s.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d9DYhuwlzuJ4s.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9DYhuwlzuJ4s.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DYhuwlzuJ4s.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YhuwlzuJ4s.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="huwlzuJ4s.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uwlzuJ4s.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wlzuJ4s.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lzuJ4s.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zuJ4s.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uJ4s.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J4s.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4s.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.681] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.681] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0076.681] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.681] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.682] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.682] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.682] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.682] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0076.682] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.682] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.682] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.682] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.682] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.682] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/md9DYhuwlzuJ4s.bmp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cf28 [0076.682] FindClose (in: hFindFile=0xa7cf28 | out: hFindFile=0xa7cf28) returned 1 [0076.682] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.682] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.682] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0076.682] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.682] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0076.682] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.682] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.682] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.683] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.683] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.683] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.683] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.683] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.683] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0076.683] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.683] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.683] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0076.683] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.683] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0076.683] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.683] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.683] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.684] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.684] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.684] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.684] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0076.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0076.684] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.684] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.684] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0076.684] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.684] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0076.684] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0076.684] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0076.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7abf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0076.684] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0076.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0076.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7abb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0076.685] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0076.685] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0076.685] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.685] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.685] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0076.685] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.685] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0076.685] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.685] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.685] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.685] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.685] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.685] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.686] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0076.686] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.686] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0076.686] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.686] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.686] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.686] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.686] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.687] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.687] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.687] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0076.687] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.687] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0076.687] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.688] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.688] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.688] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.688] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.688] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.688] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.688] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0076.689] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.689] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0076.689] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.689] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.689] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.689] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.689] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.689] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.689] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.689] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.689] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.689] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0076.689] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.689] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0076.689] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.690] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.690] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.690] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.690] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.690] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.690] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.690] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.690] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.690] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.690] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.690] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0076.690] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.690] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0076.690] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.690] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.690] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e68, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0076.691] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0076.691] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0076.691] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.691] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.691] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.691] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3980c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0076.691] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0076.691] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3980c20, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0076.691] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.691] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.691] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.691] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.691] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.691] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.691] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0076.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a198, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0076.692] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0076.692] CryptHashData (hHash=0xa7cd28, pbData=0x3980b60, dwDataLen=0x3, dwFlags=0x1) returned 1 [0076.692] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.692] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.692] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.692] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.692] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.692] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.692] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.692] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.692] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0076.692] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.692] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0076.692] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.692] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.692] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0076.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a438, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0076.693] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0076.693] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cd28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cc28) returned 1 [0076.693] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.693] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.693] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.693] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.693] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.693] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.693] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.693] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.693] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.693] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.693] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.693] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0076.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0076.693] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0076.693] CryptDestroyHash (hHash=0xa7cd28) returned 1 [0076.693] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.693] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.693] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.694] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.694] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.694] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/md9DYhuwlzuJ4s.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\md9dyhuwlzuj4s.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0076.694] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.695] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0076.695] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.695] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.695] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.695] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0076.695] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.md9DYhuwlzuJ4s.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.md9dyhuwlzuj4s.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0076.716] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.716] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.716] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.716] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.719] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0076.719] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0076.723] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x752a, lpOverlapped=0x0) returned 1 [0076.724] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0076.729] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.729] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.729] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.729] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0076.734] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.734] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0076.734] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.734] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.734] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.734] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.734] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.734] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.734] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.734] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0076.734] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.734] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0076.734] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.735] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.735] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.735] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.735] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.735] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.735] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.735] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.735] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.735] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0076.735] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.735] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0076.735] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.736] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.736] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.736] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.736] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.736] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.736] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.736] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.736] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.736] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.736] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.736] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.885] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 1 [0076.885] TranslateMessage (lpMsg=0x8bef58) returned 0 [0076.885] DispatchMessageW (lpMsg=0x8bef58) returned 0x0 [0076.885] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0076.885] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0076.885] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.887] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a348, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0076.887] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0076.887] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x1752a, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x17530) returned 1 [0076.887] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.887] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.887] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.887] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.887] CharLowerBuffW (in: lpsz="byte[95536]", cchLength=0xb | out: lpsz="byte[95536]") returned 0xb [0076.887] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.891] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.894] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.894] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.894] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.894] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.894] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.895] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a348, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0076.896] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0076.896] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x399b588*, pdwDataLen=0x8bef60*=0x1752a, dwBufLen=0x17530 | out: pbData=0x399b588*, pdwDataLen=0x8bef60*=0x17530) returned 1 [0076.900] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.900] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.900] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.900] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.901] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.901] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.901] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.901] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0076.901] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.901] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0076.901] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.901] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.901] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0076.901] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.901] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0076.901] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.902] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.902] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.902] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.902] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.902] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.902] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.902] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.902] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.902] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.902] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.902] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.914] WriteFile (in: hFile=0x240, lpBuffer=0x2ccc560*, nNumberOfBytesToWrite=0x17530, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2ccc560*, lpNumberOfBytesWritten=0x8bf5e4*=0x17530, lpOverlapped=0x0) returned 1 [0076.919] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.919] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.919] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0076.919] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.919] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0076.919] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.920] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.920] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.920] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0076.920] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.920] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0076.920] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0076.920] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c929a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0076.920] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0076.920] CryptDestroyKey (hKey=0xa7cc28) returned 1 [0076.920] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.921] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.921] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0076.921] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.921] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0076.921] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.921] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.921] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0076.921] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.921] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0076.921] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.921] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.921] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0076.921] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.921] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.921] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0076.921] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.921] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0076.922] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0076.922] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.922] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0076.922] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.922] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0076.922] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.922] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0076.922] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.922] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0076.922] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.922] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.922] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0076.927] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.927] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0076.927] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.927] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.927] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.927] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.927] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.927] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.927] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.927] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.927] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.928] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.928] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.928] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.928] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.928] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.928] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.928] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0076.928] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.928] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0076.928] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.928] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.928] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0076.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0076.929] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0076.929] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0076.929] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.929] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.929] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.929] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.929] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.929] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0076.929] FreeLibrary (hLibModule=0x76a10000) returned 1 [0076.929] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.929] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.929] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.929] CloseHandle (hObject=0x24c) returned 1 [0076.930] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.930] CloseHandle (hObject=0x240) returned 1 [0076.952] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.958] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.958] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.958] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.958] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/md9DYhuwlzuJ4s.bmp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\md9DYhuwlzuJ4s.bmp", lpFilePart=0x8bedf4*="md9DYhuwlzuJ4s.bmp") returned 0x30 [0076.958] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\md9DYhuwlzuJ4s.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\md9dyhuwlzuj4s.bmp")) returned 0x20 [0076.958] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\md9DYhuwlzuJ4s.bmp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cee8 [0076.958] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\md9DYhuwlzuJ4s.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\md9dyhuwlzuj4s.bmp")) returned 1 [0076.963] FindNextFileW (in: hFindFile=0xa7cee8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0076.963] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0076.963] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.963] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.963] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.963] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/md9DYhuwlzuJ4s.bmp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\md9DYhuwlzuJ4s.bmp", lpFilePart=0x8bf650*="md9DYhuwlzuJ4s.bmp") returned 0x30 [0076.963] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\md9DYhuwlzuJ4s.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\md9dyhuwlzuj4s.bmp")) returned 0xffffffff [0076.963] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.964] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.964] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OHPAk7bl2NSxuhuQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HPAk7bl2NSxuhuQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAk7bl2NSxuhuQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ak7bl2NSxuhuQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k7bl2NSxuhuQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7bl2NSxuhuQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bl2NSxuhuQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l2NSxuhuQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NSxuhuQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NSxuhuQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SxuhuQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xuhuQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uhuQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="huQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uQR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QR7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XV.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0076.964] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OHPAk7bl2NSxuhuQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HPAk7bl2NSxuhuQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAk7bl2NSxuhuQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ak7bl2NSxuhuQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k7bl2NSxuhuQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7bl2NSxuhuQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bl2NSxuhuQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l2NSxuhuQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NSxuhuQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NSxuhuQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SxuhuQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xuhuQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uhuQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="huQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uQR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QR7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0076.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XV.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0076.965] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0076.965] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0076.965] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.965] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.965] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0076.965] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0076.966] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.966] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0076.966] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.966] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.966] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.966] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.966] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.966] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/OHPAk7bl2NSxuhuQR7XV.flv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cf68 [0076.966] FindClose (in: hFindFile=0xa7cf68 | out: hFindFile=0xa7cf68) returned 1 [0076.966] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.966] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.966] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0076.966] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.967] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0076.967] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.967] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.967] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.967] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.967] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.967] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.967] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0076.967] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.967] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0076.967] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.967] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.967] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0076.967] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.968] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0076.968] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.968] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.968] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.968] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.968] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.968] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.968] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0076.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0076.968] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.968] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.968] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0076.968] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.968] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0076.968] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0076.968] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0076.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0076.969] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0076.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0076.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7acd8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0076.969] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0076.970] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0076.971] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.971] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.971] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0076.971] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.971] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0076.971] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.971] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.971] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.972] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.972] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.972] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.972] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0076.972] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.972] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0076.972] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.972] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.972] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0076.972] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0076.972] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.972] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.972] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.972] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0076.972] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.972] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0076.972] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.972] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.973] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.973] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.973] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.973] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.973] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.973] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0076.973] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.973] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0076.973] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.973] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.973] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0076.973] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.973] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0076.973] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.973] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0076.973] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.973] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.973] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0076.974] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.974] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0076.974] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.974] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.974] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0076.974] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0076.974] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.974] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.974] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.974] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.974] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.974] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.974] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.974] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0076.974] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.974] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0076.974] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.975] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.975] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e68, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0076.975] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0076.975] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0076.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983370, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0076.975] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0076.976] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983390, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0076.976] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.976] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.976] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.976] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.976] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.976] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.976] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0076.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a198, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0076.976] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0076.977] CryptHashData (hHash=0xa7cb28, pbData=0x3983310, dwDataLen=0x3, dwFlags=0x1) returned 1 [0076.977] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.977] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.977] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.977] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.977] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.977] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.977] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.977] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.977] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0076.977] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.977] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0076.977] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.977] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0076.977] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0076.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a510, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0076.978] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0076.978] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cb28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d068) returned 1 [0076.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.978] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0076.978] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.978] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0076.978] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.978] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0076.978] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0076.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aab8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0076.979] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0076.979] CryptDestroyHash (hHash=0xa7cb28) returned 1 [0076.979] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0076.979] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.979] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.979] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.979] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.987] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/OHPAk7bl2NSxuhuQR7XV.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ohpak7bl2nsxuhuqr7xv.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0076.988] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.988] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0076.988] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.988] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.988] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.988] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0076.988] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.OHPAk7bl2NSxuhuQR7XV.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.ohpak7bl2nsxuhuqr7xv.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0076.995] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.995] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.996] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.996] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0076.999] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0076.999] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x8da3, lpOverlapped=0x0) returned 1 [0077.000] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0077.004] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.005] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.005] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.005] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0077.005] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.005] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0077.005] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.005] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.005] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.005] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.005] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.006] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.006] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.006] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.006] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.006] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.006] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.006] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.006] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.006] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.006] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.006] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.006] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.006] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.006] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.006] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.007] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.007] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.007] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.007] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.007] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.007] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.007] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.007] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.007] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.007] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.007] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.007] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.007] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.008] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a1e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.008] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0077.008] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x8da3, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x8da8) returned 1 [0077.008] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.008] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.008] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.008] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.008] CharLowerBuffW (in: lpsz="byte[36264]", cchLength=0xb | out: lpsz="byte[36264]") returned 0xb [0077.008] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.011] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.011] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.011] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.011] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.011] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.011] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.011] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a168, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.011] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0077.011] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ccf938*, pdwDataLen=0x8bef60*=0x8da3, dwBufLen=0x8da8 | out: pbData=0x2ccf938*, pdwDataLen=0x8bef60*=0x8da8) returned 1 [0077.013] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.013] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.013] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.013] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.013] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.013] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.013] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.013] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.013] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.013] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.013] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.013] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.013] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.014] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.014] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.014] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.014] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.014] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.014] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.014] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.014] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.014] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.014] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.014] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.014] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.014] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.014] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.020] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.020] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.020] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.021] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0x8da8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0x8da8, lpOverlapped=0x0) returned 1 [0077.023] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.023] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.023] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0077.023] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.023] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0077.023] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.024] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.024] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.024] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.024] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.024] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.024] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.024] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92808, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0077.024] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0077.024] CryptDestroyKey (hKey=0xa7d068) returned 1 [0077.024] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.024] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.025] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.025] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.025] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.025] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.025] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.025] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.025] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.025] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.025] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.025] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.025] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.025] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.025] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.025] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.025] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.025] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.025] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.026] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.026] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.026] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.026] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.026] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.026] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.026] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.026] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.026] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.026] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.043] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.043] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.044] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.044] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.044] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.044] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.044] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.044] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.044] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.044] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.044] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.044] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.044] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.044] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.044] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.044] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.044] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.045] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.045] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.045] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.045] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.045] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.045] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.045] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7abf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0077.045] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0077.045] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0077.045] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.045] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.045] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.046] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.046] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.046] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.046] FreeLibrary (hLibModule=0x76a10000) returned 1 [0077.046] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.046] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.046] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.046] CloseHandle (hObject=0x240) returned 1 [0077.049] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.049] CloseHandle (hObject=0x24c) returned 1 [0077.055] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.056] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.056] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.056] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.056] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/OHPAk7bl2NSxuhuQR7XV.flv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OHPAk7bl2NSxuhuQR7XV.flv", lpFilePart=0x8bedf4*="OHPAk7bl2NSxuhuQR7XV.flv") returned 0x36 [0077.057] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OHPAk7bl2NSxuhuQR7XV.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ohpak7bl2nsxuhuqr7xv.flv")) returned 0x20 [0077.057] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OHPAk7bl2NSxuhuQR7XV.flv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cc28 [0077.057] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OHPAk7bl2NSxuhuQR7XV.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ohpak7bl2nsxuhuqr7xv.flv")) returned 1 [0077.061] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0077.061] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0077.061] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.061] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.061] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.061] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/OHPAk7bl2NSxuhuQR7XV.flv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OHPAk7bl2NSxuhuQR7XV.flv", lpFilePart=0x8bf650*="OHPAk7bl2NSxuhuQR7XV.flv") returned 0x36 [0077.061] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OHPAk7bl2NSxuhuQR7XV.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ohpak7bl2nsxuhuqr7xv.flv")) returned 0xffffffff [0077.061] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.061] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.061] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.061] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oOD4uhzm Zkl2zk.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.061] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OD4uhzm Zkl2zk.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.061] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D4uhzm Zkl2zk.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.061] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4uhzm Zkl2zk.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.061] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uhzm Zkl2zk.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.061] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hzm Zkl2zk.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.061] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zm Zkl2zk.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.061] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m Zkl2zk.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.061] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Zkl2zk.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.061] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zkl2zk.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.061] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kl2zk.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l2zk.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2zk.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zk.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.062] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oOD4uhzm Zkl2zk.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OD4uhzm Zkl2zk.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D4uhzm Zkl2zk.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4uhzm Zkl2zk.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uhzm Zkl2zk.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hzm Zkl2zk.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zm Zkl2zk.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m Zkl2zk.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Zkl2zk.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zkl2zk.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kl2zk.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l2zk.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2zk.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zk.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.062] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.062] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0077.062] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.062] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.062] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.062] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.062] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.062] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0077.062] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.062] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.063] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.063] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.063] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.063] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/oOD4uhzm Zkl2zk.mp4", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cda8 [0077.063] FindClose (in: hFindFile=0xa7cda8 | out: hFindFile=0xa7cda8) returned 1 [0077.063] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.063] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.063] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.063] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.063] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.063] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.063] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.064] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.064] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.064] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.064] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.064] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.064] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0077.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.064] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0077.064] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.064] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0077.064] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.064] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.064] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.064] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0077.064] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0077.065] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.065] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.065] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.065] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.065] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.065] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.065] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0077.065] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0077.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0077.065] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0077.065] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0077.066] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.066] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.066] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0077.066] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.066] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0077.066] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.066] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.066] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.066] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.066] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.066] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.066] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.066] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.066] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.066] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.066] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.067] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.067] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.067] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.067] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.067] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.067] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0077.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.067] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0077.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.067] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.067] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.067] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.067] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.067] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.067] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.067] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.067] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.068] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.068] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.068] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.068] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.068] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.068] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.068] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.068] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.068] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.068] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.068] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.068] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.068] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.070] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.070] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.070] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.070] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.070] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.070] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.070] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.070] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.070] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0077.070] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0077.070] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0077.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983800, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0077.071] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0077.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x39838d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0077.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.071] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.071] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.071] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.071] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.071] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.071] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0077.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a150, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0077.071] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0077.071] CryptHashData (hHash=0xa7cd28, pbData=0x39836f0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0077.072] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.072] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.072] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.072] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.072] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.072] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.072] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.072] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.072] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.072] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.072] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.072] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.072] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.072] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0077.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a6d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0077.072] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0077.072] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cd28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cca8) returned 1 [0077.072] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.072] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.072] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.073] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.073] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.073] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.073] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.073] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.073] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.073] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.073] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.073] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0077.073] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0077.073] CryptDestroyHash (hHash=0xa7cd28) returned 1 [0077.073] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.073] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.073] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.073] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.073] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.074] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/oOD4uhzm Zkl2zk.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ood4uhzm zkl2zk.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0077.074] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.074] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0077.074] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.074] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.074] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.075] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0077.075] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.oOD4uhzm Zkl2zk.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.ood4uhzm zkl2zk.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0077.080] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.080] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.080] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.080] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.082] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0077.082] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0077.084] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x8f87, lpOverlapped=0x0) returned 1 [0077.084] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0077.088] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.088] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.088] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.088] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0077.089] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.089] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0077.089] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.089] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.089] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.089] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.089] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.089] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.089] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.089] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.089] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.089] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.089] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.090] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.090] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.090] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.090] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.090] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.090] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.090] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.090] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.090] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.090] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.090] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.090] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.090] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.090] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.090] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.090] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.090] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.090] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.090] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.090] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.090] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.090] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.090] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.090] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.091] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a2d0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.092] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0077.092] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x18f87, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x18f88) returned 1 [0077.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.092] CharLowerBuffW (in: lpsz="byte[102280]", cchLength=0xc | out: lpsz="byte[102280]") returned 0xc [0077.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.095] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.095] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.095] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.095] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.095] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.095] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.097] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a2e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.097] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0077.097] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x399cfe0*, pdwDataLen=0x8bef60*=0x18f87, dwBufLen=0x18f88 | out: pbData=0x399cfe0*, pdwDataLen=0x8bef60*=0x18f88) returned 1 [0077.100] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.100] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.100] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.100] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.101] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.101] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.101] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.101] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.101] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.102] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.102] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.102] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.102] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.102] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.102] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.102] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.102] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.102] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.102] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.102] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.102] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.107] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.107] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.107] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.107] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.107] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.107] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.120] WriteFile (in: hFile=0x240, lpBuffer=0x2ccdfb8*, nNumberOfBytesToWrite=0x18f88, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2ccdfb8*, lpNumberOfBytesWritten=0x8bf5e4*=0x18f88, lpOverlapped=0x0) returned 1 [0077.122] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.122] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.122] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0077.122] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.122] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0077.122] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.123] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.123] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.123] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.123] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.123] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.123] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.123] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c929b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0077.123] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0077.123] CryptDestroyKey (hKey=0xa7cca8) returned 1 [0077.123] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.123] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.123] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.123] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.123] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.123] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.123] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.123] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.124] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.124] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.124] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.124] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.124] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.124] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.124] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.124] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.124] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.124] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.124] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.124] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.124] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.124] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.124] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.124] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.124] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.124] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.124] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.124] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.124] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.124] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.124] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.125] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.125] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.125] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.125] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.125] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.125] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.125] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.125] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.125] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.125] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.125] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.125] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.125] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.125] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.125] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.125] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.125] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.200] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.201] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.201] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.201] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.201] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a9f8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0077.201] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0077.201] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0077.201] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.201] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.201] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.201] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.201] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.201] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.201] FreeLibrary (hLibModule=0x76a10000) returned 1 [0077.201] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.201] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.201] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.201] CloseHandle (hObject=0x24c) returned 1 [0077.202] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.202] CloseHandle (hObject=0x240) returned 1 [0077.206] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.207] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.207] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.207] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.207] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/oOD4uhzm Zkl2zk.mp4", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\oOD4uhzm Zkl2zk.mp4", lpFilePart=0x8bedf4*="oOD4uhzm Zkl2zk.mp4") returned 0x31 [0077.207] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\oOD4uhzm Zkl2zk.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ood4uhzm zkl2zk.mp4")) returned 0x20 [0077.207] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\oOD4uhzm Zkl2zk.mp4", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d128 [0077.207] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\oOD4uhzm Zkl2zk.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ood4uhzm zkl2zk.mp4")) returned 1 [0077.221] FindNextFileW (in: hFindFile=0xa7d128, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0077.221] FindClose (in: hFindFile=0xa7d128 | out: hFindFile=0xa7d128) returned 1 [0077.221] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.221] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.221] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.221] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/oOD4uhzm Zkl2zk.mp4", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\oOD4uhzm Zkl2zk.mp4", lpFilePart=0x8bf650*="oOD4uhzm Zkl2zk.mp4") returned 0x31 [0077.221] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\oOD4uhzm Zkl2zk.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ood4uhzm zkl2zk.mp4")) returned 0xffffffff [0077.221] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.221] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.221] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.221] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P6_LLd2-wg7.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.221] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6_LLd2-wg7.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.221] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_LLd2-wg7.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.221] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LLd2-wg7.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.221] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ld2-wg7.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.221] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d2-wg7.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.221] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2-wg7.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-wg7.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wg7.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g7.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.222] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P6_LLd2-wg7.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6_LLd2-wg7.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_LLd2-wg7.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LLd2-wg7.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ld2-wg7.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d2-wg7.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2-wg7.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-wg7.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wg7.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g7.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.222] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.222] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0077.222] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.222] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.222] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.222] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.222] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.222] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0077.222] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.222] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.223] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.223] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.223] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.223] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/P6_LLd2-wg7.gif", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7c9a8 [0077.223] FindClose (in: hFindFile=0xa7c9a8 | out: hFindFile=0xa7c9a8) returned 1 [0077.223] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.223] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.223] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.223] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.223] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.223] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.223] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.223] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.223] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.223] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.224] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.224] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.224] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.224] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0077.224] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.224] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.224] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0077.224] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.224] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0077.224] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.224] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.224] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.224] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.224] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.224] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.224] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0077.224] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0077.224] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.224] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.225] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.225] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.225] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.225] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.225] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0077.225] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0077.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0077.225] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0077.225] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0077.226] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.226] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.226] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0077.226] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.226] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0077.226] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.227] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.227] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.227] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.227] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.227] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.227] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.227] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.227] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.227] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.227] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.227] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.227] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.227] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.227] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.228] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.228] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0077.228] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.228] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0077.228] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.228] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.228] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.228] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.228] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.228] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.228] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.228] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.228] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.228] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.228] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.228] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.228] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.228] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.228] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.228] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.228] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.228] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.228] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.228] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.228] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.229] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.229] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.229] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.229] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.229] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.229] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.229] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.229] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.229] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.229] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.229] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.229] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.229] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.229] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.229] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.229] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.229] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.229] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e98, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0077.230] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0077.230] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0077.230] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.230] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.230] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.230] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x39814b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0077.230] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0077.230] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981340, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0077.230] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.230] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.230] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.230] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.230] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.230] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.230] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0077.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a138, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0077.231] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0077.231] CryptHashData (hHash=0xa7caa8, pbData=0x3981400, dwDataLen=0x3, dwFlags=0x1) returned 1 [0077.231] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.231] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.231] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.231] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.231] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.231] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.231] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.231] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.231] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.231] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.231] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.231] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.231] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.231] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0077.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a6d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0077.232] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0077.232] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7caa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cce8) returned 1 [0077.232] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.232] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.232] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.232] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.232] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.232] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.232] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.232] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.232] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.232] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.232] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.232] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0077.232] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0077.232] CryptDestroyHash (hHash=0xa7caa8) returned 1 [0077.232] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.232] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.233] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.233] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.233] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.233] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/P6_LLd2-wg7.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\p6_lld2-wg7.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0077.234] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.234] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0077.234] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.234] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.234] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.234] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0077.234] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.P6_LLd2-wg7.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.p6_lld2-wg7.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0077.234] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.234] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.234] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.234] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.238] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0077.238] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x9984, lpOverlapped=0x0) returned 1 [0077.240] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0077.243] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.243] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.243] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.243] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0077.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.243] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0077.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.243] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.243] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.244] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.244] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.244] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.244] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.244] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.244] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.244] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.244] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.244] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.244] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.246] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.246] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.246] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.246] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.246] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.246] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.246] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.246] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.246] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.246] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.246] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.246] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.246] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.246] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.246] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.246] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.247] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a0f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.247] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0077.247] CryptEncrypt (in: hKey=0xa7cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x9984, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x9988) returned 1 [0077.247] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.247] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.247] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.247] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.247] CharLowerBuffW (in: lpsz="byte[39304]", cchLength=0xb | out: lpsz="byte[39304]") returned 0xb [0077.248] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.249] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.249] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.249] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.249] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.249] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.249] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.249] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a150, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.250] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0077.250] CryptEncrypt (in: hKey=0xa7cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cd1cd8*, pdwDataLen=0x8bef60*=0x9984, dwBufLen=0x9988 | out: pbData=0x2cd1cd8*, pdwDataLen=0x8bef60*=0x9988) returned 1 [0077.252] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.252] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.252] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.252] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.253] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.253] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.253] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.253] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.253] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.253] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.253] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.253] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.253] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.253] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.253] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.253] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.253] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.253] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.253] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.253] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.254] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.254] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.254] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.254] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.254] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.254] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.254] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.256] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.256] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.256] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.256] WriteFile (in: hFile=0x24c, lpBuffer=0x398d9e0*, nNumberOfBytesToWrite=0x9988, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x398d9e0*, lpNumberOfBytesWritten=0x8bf5e4*=0x9988, lpOverlapped=0x0) returned 1 [0077.257] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.257] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.258] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0077.258] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.258] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0077.258] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.258] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.258] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.258] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.258] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.258] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.258] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.258] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92ac0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0077.258] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0077.258] CryptDestroyKey (hKey=0xa7cce8) returned 1 [0077.258] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.258] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.258] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.258] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.258] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.259] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.259] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.259] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.259] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.259] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.259] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.259] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.259] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.259] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.259] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.259] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.259] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.259] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.259] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.259] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.259] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.259] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.259] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.259] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.259] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.259] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.259] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.259] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.259] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.259] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.260] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.260] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.260] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.260] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.260] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.260] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.260] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.260] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.260] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.260] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.260] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.260] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.260] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.260] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.260] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.260] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.260] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.260] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.260] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.260] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.260] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.260] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.260] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7acb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0077.261] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0077.261] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0077.261] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.261] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.261] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.261] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.261] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.261] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.261] FreeLibrary (hLibModule=0x76a10000) returned 1 [0077.261] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.261] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.261] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.261] CloseHandle (hObject=0x240) returned 1 [0077.262] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.262] CloseHandle (hObject=0x24c) returned 1 [0077.264] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.265] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.265] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.265] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/P6_LLd2-wg7.gif", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P6_LLd2-wg7.gif", lpFilePart=0x8bedf4*="P6_LLd2-wg7.gif") returned 0x2d [0077.265] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P6_LLd2-wg7.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\p6_lld2-wg7.gif")) returned 0x20 [0077.265] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P6_LLd2-wg7.gif", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0077.265] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P6_LLd2-wg7.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\p6_lld2-wg7.gif")) returned 1 [0077.269] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0077.269] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0077.269] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.274] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.274] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.274] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/P6_LLd2-wg7.gif", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P6_LLd2-wg7.gif", lpFilePart=0x8bf650*="P6_LLd2-wg7.gif") returned 0x2d [0077.274] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P6_LLd2-wg7.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\p6_lld2-wg7.gif")) returned 0xffffffff [0077.274] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.274] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.274] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rDNk37jQ34m.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DNk37jQ34m.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nk37jQ34m.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k37jQ34m.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="37jQ34m.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7jQ34m.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jQ34m.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q34m.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="34m.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4m.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.275] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rDNk37jQ34m.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DNk37jQ34m.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nk37jQ34m.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k37jQ34m.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="37jQ34m.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7jQ34m.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jQ34m.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q34m.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="34m.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4m.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.275] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.275] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0077.275] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.275] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.275] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.275] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.275] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0077.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.275] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/rDNk37jQ34m.avi", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7caa8 [0077.276] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0077.276] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.276] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.276] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.276] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.276] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.276] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.276] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.276] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.276] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.276] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.276] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.276] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.276] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.276] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0077.276] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.276] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.276] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0077.276] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.277] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0077.277] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.277] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.277] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.277] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.277] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.277] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.277] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0077.277] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0077.277] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.277] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.277] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.277] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.277] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.277] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.277] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a998, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0077.277] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0077.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab98, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0077.278] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0077.278] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0077.278] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.278] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.278] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0077.278] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.278] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0077.278] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.278] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.278] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.278] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.279] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.279] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.279] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.279] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.279] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.279] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.279] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.279] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.279] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.279] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.279] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.279] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.279] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0077.279] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.279] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0077.279] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.279] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.279] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.279] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.279] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.279] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.279] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.279] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.279] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.279] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.280] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.280] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.280] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.280] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.280] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.280] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.280] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.280] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.280] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.280] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.280] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.280] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.280] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.280] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.280] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.280] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.280] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.280] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.280] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.280] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.281] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.281] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.281] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.281] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.281] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.281] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.281] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.281] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.281] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0077.281] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0077.281] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0077.281] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.281] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.281] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.281] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x39804b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0077.282] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0077.282] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3980440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0077.282] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.282] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.282] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.282] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.282] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.282] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.282] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0077.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a360, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0077.283] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0077.283] CryptHashData (hHash=0xa7cee8, pbData=0x3980320, dwDataLen=0x3, dwFlags=0x1) returned 1 [0077.283] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.283] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.283] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.283] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.283] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.283] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.283] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.283] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.283] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.283] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.283] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.283] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.283] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.283] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0077.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a6d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0077.283] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0077.284] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cee8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cca8) returned 1 [0077.284] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.284] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.284] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.306] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.306] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.306] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.307] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.307] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.307] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.307] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.307] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.307] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0077.307] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0077.307] CryptDestroyHash (hHash=0xa7cee8) returned 1 [0077.307] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.307] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.307] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.307] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.307] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.307] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/rDNk37jQ34m.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rdnk37jq34m.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0077.308] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.308] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0077.308] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.308] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.308] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.308] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0077.309] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.rDNk37jQ34m.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.rdnk37jq34m.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0077.309] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.309] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.309] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.309] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.311] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0077.311] ReadFile (in: hFile=0x24c, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0077.313] ReadFile (in: hFile=0x24c, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0x83bf, lpOverlapped=0x0) returned 1 [0077.314] ReadFile (in: hFile=0x24c, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0077.318] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.318] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.318] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.319] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0077.319] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.319] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0077.320] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.320] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.320] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.320] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.320] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.320] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.320] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.320] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.320] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.320] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.320] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.320] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.320] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.320] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.320] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.320] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.320] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.320] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.320] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.320] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.320] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.320] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.320] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.320] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.320] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.321] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.321] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.321] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.321] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.321] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.321] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.322] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a138, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.323] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0077.323] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x183bf, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x183c0) returned 1 [0077.323] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.323] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.323] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.323] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.323] CharLowerBuffW (in: lpsz="byte[99264]", cchLength=0xb | out: lpsz="byte[99264]") returned 0xb [0077.324] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.327] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.327] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.327] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.327] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.327] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.330] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a168, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.330] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0077.330] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x39ac420*, pdwDataLen=0x8bef60*=0x183bf, dwBufLen=0x183c0 | out: pbData=0x39ac420*, pdwDataLen=0x8bef60*=0x183c0) returned 1 [0077.333] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.333] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.333] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.333] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.335] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.336] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.336] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.336] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.336] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.336] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.336] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.336] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.336] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.336] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.336] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.336] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.336] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.336] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.336] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.336] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.336] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.336] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.336] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.336] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.336] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.336] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.336] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.353] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.353] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.353] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.354] WriteFile (in: hFile=0x240, lpBuffer=0x2cbd3e8*, nNumberOfBytesToWrite=0x183c0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cbd3e8*, lpNumberOfBytesWritten=0x8bf5e4*=0x183c0, lpOverlapped=0x0) returned 1 [0077.357] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.357] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.357] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0077.357] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.357] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0077.357] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.357] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.357] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.357] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.357] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.357] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.357] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.357] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92ac0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0077.357] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0077.358] CryptDestroyKey (hKey=0xa7cca8) returned 1 [0077.358] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.358] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.358] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.358] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.358] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.358] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.358] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.358] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.358] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.358] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.358] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.358] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.358] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.358] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.360] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.360] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.360] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.360] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.360] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.361] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.361] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.361] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.361] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.361] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.361] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.361] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.361] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.361] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.361] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.361] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.361] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.361] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.361] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.361] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.361] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.361] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.361] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.361] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.361] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.361] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.361] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.361] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.361] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.362] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.362] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.362] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.362] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.362] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.362] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.362] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.362] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.362] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.362] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ab18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0077.362] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0077.362] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0077.362] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.362] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.362] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.362] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.362] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.362] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.363] FreeLibrary (hLibModule=0x76a10000) returned 1 [0077.363] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.363] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.363] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.363] CloseHandle (hObject=0x24c) returned 1 [0077.363] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.363] CloseHandle (hObject=0x240) returned 1 [0077.367] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.368] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.368] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.368] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.369] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/rDNk37jQ34m.avi", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rDNk37jQ34m.avi", lpFilePart=0x8bedf4*="rDNk37jQ34m.avi") returned 0x2d [0077.369] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rDNk37jQ34m.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rdnk37jq34m.avi")) returned 0x20 [0077.369] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rDNk37jQ34m.avi", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7c9a8 [0077.369] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rDNk37jQ34m.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rdnk37jq34m.avi")) returned 1 [0077.392] FindNextFileW (in: hFindFile=0xa7c9a8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0077.392] FindClose (in: hFindFile=0xa7c9a8 | out: hFindFile=0xa7c9a8) returned 1 [0077.392] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.393] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.393] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.393] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/rDNk37jQ34m.avi", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rDNk37jQ34m.avi", lpFilePart=0x8bf650*="rDNk37jQ34m.avi") returned 0x2d [0077.393] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rDNk37jQ34m.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rdnk37jq34m.avi")) returned 0xffffffff [0077.393] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.393] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.393] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S0Njuyb0MbA8NPe7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0Njuyb0MbA8NPe7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Njuyb0MbA8NPe7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="juyb0MbA8NPe7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uyb0MbA8NPe7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yb0MbA8NPe7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0MbA8NPe7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0MbA8NPe7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MbA8NPe7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bA8NPe7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A8NPe7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8NPe7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NPe7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pe7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.394] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S0Njuyb0MbA8NPe7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0Njuyb0MbA8NPe7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Njuyb0MbA8NPe7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="juyb0MbA8NPe7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uyb0MbA8NPe7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yb0MbA8NPe7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0MbA8NPe7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0MbA8NPe7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MbA8NPe7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bA8NPe7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A8NPe7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8NPe7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NPe7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pe7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7f.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.394] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.394] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0077.394] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.394] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.395] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.395] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.395] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0077.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.395] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/S0Njuyb0MbA8NPe7f.odp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d0e8 [0077.395] FindClose (in: hFindFile=0xa7d0e8 | out: hFindFile=0xa7d0e8) returned 1 [0077.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.395] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.395] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.396] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.396] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.396] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.396] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.396] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.396] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.396] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.396] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.396] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.396] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0077.396] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.396] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.396] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0077.396] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.396] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0077.397] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.397] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.397] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.397] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.397] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.397] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.397] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0077.397] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0077.397] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.397] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.397] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.397] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.397] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.397] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.397] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a9b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0077.398] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0077.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0077.398] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0077.398] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0077.399] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.399] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.399] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0077.399] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.399] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0077.399] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.399] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.399] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.399] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.399] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.399] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.399] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.399] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.399] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.399] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.399] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.400] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.400] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.400] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.400] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.400] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.400] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0077.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.400] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0077.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.400] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.400] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.400] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.400] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.401] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.401] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.401] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.401] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.401] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.475] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.475] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.476] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.476] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.476] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.476] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.476] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.476] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.476] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.476] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.476] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.476] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.476] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.476] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.476] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.476] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.477] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.477] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.477] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.477] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.477] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.477] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.477] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e50, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0077.477] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0077.477] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0077.477] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.477] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.478] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.478] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3980680, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0077.478] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0077.478] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3980630, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0077.478] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.478] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.478] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.478] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.478] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.478] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.478] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0077.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a2e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0077.479] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0077.479] CryptHashData (hHash=0xa7cee8, pbData=0x3980610, dwDataLen=0x3, dwFlags=0x1) returned 1 [0077.479] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.479] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.479] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.479] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.479] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.479] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.479] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.479] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.479] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.479] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.479] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.479] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.479] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.479] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0077.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a468, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0077.480] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0077.480] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cee8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cfa8) returned 1 [0077.480] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.480] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.480] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.480] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.480] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.480] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.480] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.480] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.480] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.480] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.480] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.480] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a9b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0077.481] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0077.481] CryptDestroyHash (hHash=0xa7cee8) returned 1 [0077.481] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.481] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.481] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.481] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.481] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.481] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/S0Njuyb0MbA8NPe7f.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\s0njuyb0mba8npe7f.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0077.482] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.482] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0077.482] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.482] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.482] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.482] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0077.483] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.S0Njuyb0MbA8NPe7f.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.s0njuyb0mba8npe7f.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0077.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.487] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0077.487] ReadFile (in: hFile=0x240, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0xb343, lpOverlapped=0x0) returned 1 [0077.488] ReadFile (in: hFile=0x240, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0077.492] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.492] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.492] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.492] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0077.492] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.492] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0077.492] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.492] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.492] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.492] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.493] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.493] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.493] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.493] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.493] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.493] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.493] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.493] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.493] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.493] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.493] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.493] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.493] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.493] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.493] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.493] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.494] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.494] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.494] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.494] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.494] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.494] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.494] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.494] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.494] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.494] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.494] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.494] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.495] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a360, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.495] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0077.495] CryptEncrypt (in: hKey=0xa7cfa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xb343, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xb348) returned 1 [0077.495] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.495] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.495] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.495] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.495] CharLowerBuffW (in: lpsz="byte[45896]", cchLength=0xb | out: lpsz="byte[45896]") returned 0xb [0077.495] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.497] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.497] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.497] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.497] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.497] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.497] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.498] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a198, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.498] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0077.498] CryptEncrypt (in: hKey=0xa7cfa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cc6a10*, pdwDataLen=0x8bef60*=0xb343, dwBufLen=0xb348 | out: pbData=0x2cc6a10*, pdwDataLen=0x8bef60*=0xb348) returned 1 [0077.500] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.500] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.500] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.500] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.501] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.516] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.516] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.516] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.516] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.516] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.516] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.516] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.516] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.516] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.517] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.517] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.517] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.517] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.517] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.517] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.517] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.517] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.517] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.517] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.517] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.517] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.517] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.522] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.522] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.522] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.522] WriteFile (in: hFile=0x24c, lpBuffer=0x3994058*, nNumberOfBytesToWrite=0xb348, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3994058*, lpNumberOfBytesWritten=0x8bf5e4*=0xb348, lpOverlapped=0x0) returned 1 [0077.524] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.524] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.524] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0077.524] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.524] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0077.524] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.524] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.524] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.524] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.524] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.524] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.524] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.524] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92ac0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0077.525] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0077.525] CryptDestroyKey (hKey=0xa7cfa8) returned 1 [0077.525] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.525] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.525] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.525] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.525] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.525] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.525] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.525] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.525] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.525] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.525] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.525] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.525] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.525] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.525] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.525] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.526] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.526] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.526] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.526] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.526] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.526] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.526] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.526] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.526] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.526] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.526] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.526] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.526] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.526] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.526] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.526] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.526] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.526] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.526] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.527] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.527] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.527] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.527] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.527] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.527] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.527] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.527] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.527] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.527] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.527] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.527] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.527] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.527] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.527] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.527] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.527] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.527] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a998, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0077.528] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0077.529] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0077.530] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.530] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.530] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.530] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.530] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.530] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.530] FreeLibrary (hLibModule=0x76a10000) returned 1 [0077.530] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.530] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.530] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.530] CloseHandle (hObject=0x240) returned 1 [0077.531] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.531] CloseHandle (hObject=0x24c) returned 1 [0077.537] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.538] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.538] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.538] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.538] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/S0Njuyb0MbA8NPe7f.odp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\S0Njuyb0MbA8NPe7f.odp", lpFilePart=0x8bedf4*="S0Njuyb0MbA8NPe7f.odp") returned 0x33 [0077.538] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\S0Njuyb0MbA8NPe7f.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\s0njuyb0mba8npe7f.odp")) returned 0x20 [0077.538] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\S0Njuyb0MbA8NPe7f.odp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7c9a8 [0077.538] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\S0Njuyb0MbA8NPe7f.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\s0njuyb0mba8npe7f.odp")) returned 1 [0077.544] FindNextFileW (in: hFindFile=0xa7c9a8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0077.544] FindClose (in: hFindFile=0xa7c9a8 | out: hFindFile=0xa7c9a8) returned 1 [0077.544] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.544] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.544] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.544] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/S0Njuyb0MbA8NPe7f.odp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\S0Njuyb0MbA8NPe7f.odp", lpFilePart=0x8bf650*="S0Njuyb0MbA8NPe7f.odp") returned 0x33 [0077.544] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\S0Njuyb0MbA8NPe7f.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\s0njuyb0mba8npe7f.odp")) returned 0xffffffff [0077.544] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.544] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.544] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SN-7hPJVIjPbeSt.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N-7hPJVIjPbeSt.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-7hPJVIjPbeSt.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7hPJVIjPbeSt.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hPJVIjPbeSt.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PJVIjPbeSt.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JVIjPbeSt.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VIjPbeSt.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IjPbeSt.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jPbeSt.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PbeSt.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="beSt.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eSt.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="St.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.545] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SN-7hPJVIjPbeSt.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N-7hPJVIjPbeSt.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-7hPJVIjPbeSt.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7hPJVIjPbeSt.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hPJVIjPbeSt.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PJVIjPbeSt.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JVIjPbeSt.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VIjPbeSt.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IjPbeSt.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jPbeSt.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PbeSt.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="beSt.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eSt.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="St.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.545] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.545] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0077.545] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.546] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.546] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.546] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.546] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0077.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.546] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/SN-7hPJVIjPbeSt.mp3", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7ce28 [0077.546] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0077.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.547] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.547] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.547] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.547] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.547] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.547] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.547] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.547] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.547] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.547] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.547] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.547] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0077.548] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.548] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.548] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0077.548] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.548] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0077.548] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.548] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.548] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.551] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.551] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.551] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.551] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0077.551] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0077.551] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.551] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.552] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.552] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.552] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.552] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.552] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0077.552] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0077.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0077.552] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0077.552] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0077.553] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.553] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.553] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0077.553] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.553] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0077.553] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.553] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.553] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.553] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.553] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.553] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.553] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.554] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.554] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.554] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.554] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.554] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.554] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.554] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0077.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.554] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0077.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.555] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.555] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.555] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.555] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.555] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.555] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.555] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.555] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.555] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.555] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.555] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.557] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.557] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.557] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.557] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.557] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.557] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.557] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.557] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.557] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.557] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.557] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.557] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.557] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.557] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.557] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.557] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.557] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.558] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.558] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.558] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.558] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.558] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92f58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0077.558] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0077.558] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0077.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981130, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0077.559] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0077.559] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x39811a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0077.559] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.559] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.559] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.559] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.559] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.559] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.559] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0077.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a1e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0077.559] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0077.560] CryptHashData (hHash=0xa7d168, pbData=0x39811d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0077.560] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.560] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.560] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.560] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.560] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.560] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.560] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.560] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.560] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.560] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.560] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.560] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.560] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.560] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0077.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a600, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0077.561] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0077.561] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d168, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cce8) returned 1 [0077.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.561] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.561] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.561] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.561] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.561] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.561] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a978, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0077.562] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0077.562] CryptDestroyHash (hHash=0xa7d168) returned 1 [0077.562] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.562] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.562] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.562] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.562] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.562] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/SN-7hPJVIjPbeSt.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\sn-7hpjvijpbest.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0077.562] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.563] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0077.563] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.563] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.563] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.563] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0077.563] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.SN-7hPJVIjPbeSt.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.sn-7hpjvijpbest.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0077.564] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.564] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.564] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.564] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.566] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0077.567] ReadFile (in: hFile=0x24c, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0xaf3d, lpOverlapped=0x0) returned 1 [0077.568] ReadFile (in: hFile=0x24c, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0077.572] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.572] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.572] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.572] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0077.572] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.572] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0077.572] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.572] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.573] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.573] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.590] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.590] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.590] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.590] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.590] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.590] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.590] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.590] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.591] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.591] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.591] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.591] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.591] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.591] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.591] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.592] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.592] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.592] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.592] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.592] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.592] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.592] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.592] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.592] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.592] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.592] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.592] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.592] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.592] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.592] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.593] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.593] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a330, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.593] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0077.593] CryptEncrypt (in: hKey=0xa7cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xaf3d, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xaf40) returned 1 [0077.594] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.594] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.594] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.594] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.594] CharLowerBuffW (in: lpsz="byte[44864]", cchLength=0xb | out: lpsz="byte[44864]") returned 0xb [0077.594] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.595] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.595] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.595] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.595] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.595] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.595] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.595] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a108, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.596] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0077.596] CryptEncrypt (in: hKey=0xa7cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cbaeb0*, pdwDataLen=0x8bef60*=0xaf3d, dwBufLen=0xaf40 | out: pbData=0x2cbaeb0*, pdwDataLen=0x8bef60*=0xaf40) returned 1 [0077.598] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.598] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.598] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.598] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.598] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.598] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.598] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.598] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.598] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.598] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.598] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.598] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.599] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.599] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.599] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.599] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.599] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.599] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.599] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.599] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.599] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.599] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.599] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.599] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.599] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.599] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.599] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.603] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.603] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.603] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.604] WriteFile (in: hFile=0x240, lpBuffer=0x2ca5020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2ca5020*, lpNumberOfBytesWritten=0x8bf5e4*=0xaf40, lpOverlapped=0x0) returned 1 [0077.605] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.605] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.606] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0077.606] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.606] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0077.606] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.606] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.606] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.606] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.606] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.606] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.606] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.606] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92808, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0077.606] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0077.606] CryptDestroyKey (hKey=0xa7cce8) returned 1 [0077.606] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.607] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.607] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.607] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.607] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.607] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.607] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.607] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.607] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.607] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.607] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.607] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.607] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0077.607] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.607] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.607] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.607] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.607] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.607] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0077.607] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.607] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0077.608] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.608] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.608] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.608] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.608] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.608] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.608] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.608] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.608] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.608] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.608] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.608] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.608] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.608] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.608] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.608] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.608] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.608] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.608] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.608] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.609] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.609] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.609] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.609] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.609] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.609] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.609] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.609] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.609] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.609] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.609] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.655] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a9f8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0077.656] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0077.656] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0077.656] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 1 [0077.656] TranslateMessage (lpMsg=0x8bf4a8) returned 0 [0077.656] DispatchMessageW (lpMsg=0x8bf4a8) returned 0x0 [0077.656] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0077.656] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0077.656] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.656] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.656] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.656] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.656] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.656] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0077.656] FreeLibrary (hLibModule=0x76a10000) returned 1 [0077.656] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.656] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.656] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.656] CloseHandle (hObject=0x24c) returned 1 [0077.658] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.658] CloseHandle (hObject=0x240) returned 1 [0077.660] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.660] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.660] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.660] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.661] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/SN-7hPJVIjPbeSt.mp3", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SN-7hPJVIjPbeSt.mp3", lpFilePart=0x8bedf4*="SN-7hPJVIjPbeSt.mp3") returned 0x31 [0077.661] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SN-7hPJVIjPbeSt.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\sn-7hpjvijpbest.mp3")) returned 0x20 [0077.661] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SN-7hPJVIjPbeSt.mp3", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cca8 [0077.661] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SN-7hPJVIjPbeSt.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\sn-7hpjvijpbest.mp3")) returned 1 [0077.667] FindNextFileW (in: hFindFile=0xa7cca8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0077.667] FindClose (in: hFindFile=0xa7cca8 | out: hFindFile=0xa7cca8) returned 1 [0077.668] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.668] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.668] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.668] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/SN-7hPJVIjPbeSt.mp3", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SN-7hPJVIjPbeSt.mp3", lpFilePart=0x8bf650*="SN-7hPJVIjPbeSt.mp3") returned 0x31 [0077.668] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SN-7hPJVIjPbeSt.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\sn-7hpjvijpbest.mp3")) returned 0xffffffff [0077.668] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.668] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.668] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sUead_MVmaeTHpH.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Uead_MVmaeTHpH.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ead_MVmaeTHpH.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ad_MVmaeTHpH.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d_MVmaeTHpH.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_MVmaeTHpH.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MVmaeTHpH.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VmaeTHpH.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="maeTHpH.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aeTHpH.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eTHpH.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THpH.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HpH.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pH.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0077.669] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sUead_MVmaeTHpH.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Uead_MVmaeTHpH.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ead_MVmaeTHpH.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ad_MVmaeTHpH.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d_MVmaeTHpH.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_MVmaeTHpH.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MVmaeTHpH.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VmaeTHpH.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="maeTHpH.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aeTHpH.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eTHpH.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THpH.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HpH.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pH.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0077.669] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0077.669] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0077.669] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.669] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.669] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0077.669] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0077.669] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.669] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0077.670] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.670] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.670] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.670] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.670] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.670] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/sUead_MVmaeTHpH.bmp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cee8 [0077.670] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0077.670] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.670] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.670] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.670] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.670] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.670] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.670] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.670] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.670] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.670] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.670] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.671] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0077.671] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.671] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0077.671] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.671] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.671] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0077.671] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.671] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0077.671] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.671] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.671] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.671] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.671] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.671] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.671] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0077.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0077.813] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.813] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.813] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.814] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.814] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.814] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0077.814] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a9b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0077.814] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0077.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aaf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0077.814] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0077.814] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0077.815] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.815] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.815] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0077.815] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.815] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0077.815] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.815] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.815] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.815] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.815] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.815] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.815] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.815] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.815] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.815] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.816] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.816] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0077.816] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0077.816] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.816] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.816] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.816] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0077.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.816] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0077.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.816] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.816] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.816] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.816] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.816] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.816] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.816] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.817] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.817] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.817] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.817] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.817] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.817] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.817] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.817] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.817] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.817] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.817] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.817] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.817] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.817] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.817] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.817] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.817] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.817] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.817] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.817] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.817] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.817] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.818] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.818] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.818] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92fb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0077.818] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0077.818] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0077.818] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.818] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.818] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.818] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3982580, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0077.818] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0077.818] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3982600, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0077.819] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.819] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.819] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.819] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.819] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.819] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.819] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0077.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a2e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0077.819] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0077.819] CryptHashData (hHash=0xa7caa8, pbData=0x39826c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0077.819] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.819] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.819] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.819] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.819] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.819] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.820] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.820] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.820] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0077.820] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.820] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0077.820] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.820] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.820] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0077.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a6d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0077.820] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0077.820] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7caa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cee8) returned 1 [0077.820] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.820] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.820] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.820] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.820] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.820] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.820] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.820] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.820] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.821] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.821] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0077.821] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0077.821] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0077.821] CryptDestroyHash (hHash=0xa7caa8) returned 1 [0077.821] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.821] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.821] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.821] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.821] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.821] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/sUead_MVmaeTHpH.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\suead_mvmaethph.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0077.821] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.821] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0077.821] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.821] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.821] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.822] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0077.822] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.sUead_MVmaeTHpH.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.suead_mvmaethph.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0077.823] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.823] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.823] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.823] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.825] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0077.825] ReadFile (in: hFile=0x240, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0077.827] ReadFile (in: hFile=0x240, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0x1d27, lpOverlapped=0x0) returned 1 [0077.827] ReadFile (in: hFile=0x240, lpBuffer=0x3984050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0077.830] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.830] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.830] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.830] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0077.831] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.831] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0077.831] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.831] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.831] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.831] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.831] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.831] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.831] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.831] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0077.831] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.831] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0077.831] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.831] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.832] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.832] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.832] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.832] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.832] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.832] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.832] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.832] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0077.832] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.832] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0077.832] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.832] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.832] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.832] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.832] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.832] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.832] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.832] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.832] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.832] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.832] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.832] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.833] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.833] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a3d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.833] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0077.833] CryptEncrypt (in: hKey=0xa7cee8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x11d27, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x11d28) returned 1 [0077.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.834] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.834] CharLowerBuffW (in: lpsz="byte[73000]", cchLength=0xb | out: lpsz="byte[73000]") returned 0xb [0077.834] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.835] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.835] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.835] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.835] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.835] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.835] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0077.835] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a198, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.836] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0077.836] CryptEncrypt (in: hKey=0xa7cee8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3994058*, pdwDataLen=0x8bef60*=0x11d27, dwBufLen=0x11d28 | out: pbData=0x3994058*, pdwDataLen=0x8bef60*=0x11d28) returned 1 [0077.838] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.838] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.838] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.838] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.838] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.838] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.838] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.838] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0077.839] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.839] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0077.839] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.839] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.839] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0077.839] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.839] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0077.839] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.839] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.839] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0077.839] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.839] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0077.839] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.839] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0077.839] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.839] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0077.839] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.839] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0077.839] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0077.985] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.985] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.985] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.986] WriteFile (in: hFile=0x24c, lpBuffer=0x39a5d88*, nNumberOfBytesToWrite=0x11d28, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x39a5d88*, lpNumberOfBytesWritten=0x8bf5e4*=0x11d28, lpOverlapped=0x0) returned 1 [0077.988] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.988] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0077.988] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0077.988] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.988] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0077.988] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.988] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0077.988] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0077.988] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0077.988] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0077.988] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0078.048] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0078.048] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92808, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0078.048] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0078.048] CryptDestroyKey (hKey=0xa7cee8) returned 1 [0078.048] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.048] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.048] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0078.048] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.048] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0078.049] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.049] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.049] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0078.049] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.049] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0078.049] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.049] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.049] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.049] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.049] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.049] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.049] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.049] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.049] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.049] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.049] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.049] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.049] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.049] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.049] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0078.049] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.050] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0078.050] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.050] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.050] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0078.050] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.050] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0078.050] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.050] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.050] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.050] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.050] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.050] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.050] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.050] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.050] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.050] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.050] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.050] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.050] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.050] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.050] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.050] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0078.050] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.050] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0078.051] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.051] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.051] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a9f8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0078.051] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0078.051] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0078.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.051] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.051] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.051] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.051] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.051] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.051] FreeLibrary (hLibModule=0x76a10000) returned 1 [0078.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.051] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.051] CloseHandle (hObject=0x240) returned 1 [0078.053] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.053] CloseHandle (hObject=0x24c) returned 1 [0078.058] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.059] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.060] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.060] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.060] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/sUead_MVmaeTHpH.bmp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\sUead_MVmaeTHpH.bmp", lpFilePart=0x8bedf4*="sUead_MVmaeTHpH.bmp") returned 0x31 [0078.060] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\sUead_MVmaeTHpH.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\suead_mvmaethph.bmp")) returned 0x20 [0078.060] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\sUead_MVmaeTHpH.bmp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7ce28 [0078.060] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\sUead_MVmaeTHpH.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\suead_mvmaethph.bmp")) returned 1 [0078.136] FindNextFileW (in: hFindFile=0xa7ce28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0078.136] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0078.136] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.136] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.136] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.136] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/sUead_MVmaeTHpH.bmp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\sUead_MVmaeTHpH.bmp", lpFilePart=0x8bf650*="sUead_MVmaeTHpH.bmp") returned 0x31 [0078.137] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\sUead_MVmaeTHpH.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\suead_mvmaethph.bmp")) returned 0xffffffff [0078.137] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.137] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.137] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uQdlphYG1dbqk1.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QdlphYG1dbqk1.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dlphYG1dbqk1.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lphYG1dbqk1.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="phYG1dbqk1.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hYG1dbqk1.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YG1dbqk1.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G1dbqk1.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1dbqk1.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dbqk1.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bqk1.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qk1.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k1.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.137] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uQdlphYG1dbqk1.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QdlphYG1dbqk1.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dlphYG1dbqk1.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lphYG1dbqk1.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="phYG1dbqk1.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hYG1dbqk1.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YG1dbqk1.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G1dbqk1.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1dbqk1.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dbqk1.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bqk1.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0078.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qk1.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k1.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.138] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.138] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0078.138] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.138] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.138] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.138] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.138] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0078.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.138] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/uQdlphYG1dbqk1.jpg", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cda8 [0078.138] FindClose (in: hFindFile=0xa7cda8 | out: hFindFile=0xa7cda8) returned 1 [0078.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.139] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0078.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.139] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0078.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.139] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.139] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.139] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.139] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.139] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.139] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0078.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.139] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0078.139] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.139] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0078.139] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.139] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.139] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.140] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.140] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0078.140] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0078.140] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.140] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.140] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0078.140] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.140] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0078.140] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0078.140] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0078.140] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0078.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0078.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7abf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0078.140] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0078.141] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0078.141] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.141] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.142] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0078.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.142] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0078.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.142] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.142] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.142] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.142] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0078.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.142] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0078.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.142] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.142] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0078.143] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.143] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0078.143] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.180] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.180] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.180] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0078.180] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.180] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0078.181] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.181] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.181] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.181] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.181] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.181] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.181] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.181] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.181] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.181] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0078.181] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.181] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0078.181] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.181] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.181] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.181] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.181] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.181] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.181] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.181] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.181] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.181] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.181] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.181] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0078.182] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.182] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0078.182] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.182] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.182] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e98, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0078.182] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0078.182] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0078.182] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.182] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.182] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.182] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981ab0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0078.182] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0078.182] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981aa0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0078.183] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.183] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.183] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.183] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.183] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.183] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.183] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a2d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0078.183] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0078.183] CryptHashData (hHash=0xa7cee8, pbData=0x39819a0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0078.183] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.183] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.183] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.183] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.183] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.183] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.183] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.183] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.183] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0078.184] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.184] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0078.184] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.184] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.184] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0078.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a438, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0078.184] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0078.184] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cee8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cce8) returned 1 [0078.184] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.184] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.184] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.184] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.184] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.184] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.184] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.184] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0078.184] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.184] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0078.184] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0078.184] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a958, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0078.185] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0078.185] CryptDestroyHash (hHash=0xa7cee8) returned 1 [0078.185] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.185] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.185] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.185] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.185] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.186] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/uQdlphYG1dbqk1.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\uqdlphyg1dbqk1.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0078.186] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.186] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0078.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.186] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0078.186] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.uQdlphYG1dbqk1.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.uqdlphyg1dbqk1.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0078.187] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.187] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.187] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.187] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.194] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0078.194] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0078.195] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x1b6d, lpOverlapped=0x0) returned 1 [0078.195] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0078.199] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.200] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.200] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.200] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0078.201] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.201] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0078.201] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.201] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.201] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.201] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.201] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.201] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.201] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.201] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0078.201] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.201] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0078.202] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.202] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.202] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.202] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.202] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.202] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.202] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.202] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.202] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.202] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0078.202] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.202] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0078.202] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.202] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.202] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.202] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.202] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.202] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.202] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.202] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.202] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.202] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.202] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.202] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.203] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.203] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a330, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.203] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0078.203] CryptEncrypt (in: hKey=0xa7cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x11b6d, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x11b70) returned 1 [0078.204] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.204] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.204] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.233] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.234] CharLowerBuffW (in: lpsz="byte[72560]", cchLength=0xb | out: lpsz="byte[72560]") returned 0xb [0078.234] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.236] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.236] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.236] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.236] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.236] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.236] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.237] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a2d0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.238] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0078.238] CryptEncrypt (in: hKey=0xa7cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3995bc8*, pdwDataLen=0x8bef60*=0x11b6d, dwBufLen=0x11b70 | out: pbData=0x3995bc8*, pdwDataLen=0x8bef60*=0x11b70) returned 1 [0078.240] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.240] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.240] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.240] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.243] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0078.243] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.243] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0078.243] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.243] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.243] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0078.243] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.243] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0078.243] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.243] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.243] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.244] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.244] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.244] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.244] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.244] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.244] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.244] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.244] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.244] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.250] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.250] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.251] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.251] WriteFile (in: hFile=0x240, lpBuffer=0x2cc6ba0*, nNumberOfBytesToWrite=0x11b70, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cc6ba0*, lpNumberOfBytesWritten=0x8bf5e4*=0x11b70, lpOverlapped=0x0) returned 1 [0078.253] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.253] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.253] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0078.253] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.253] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0078.253] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.254] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.254] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.254] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0078.254] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.254] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0078.254] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0078.254] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c929b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0078.254] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0078.254] CryptDestroyKey (hKey=0xa7cce8) returned 1 [0078.254] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.254] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.254] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0078.255] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.255] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0078.255] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.255] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.255] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0078.255] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.255] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0078.255] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.255] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.255] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.255] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.255] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.255] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.255] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.255] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.255] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.255] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.255] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.256] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.256] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.256] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.256] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0078.256] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.256] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0078.256] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.256] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.256] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0078.256] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.256] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0078.256] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.256] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.256] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.256] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.256] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.256] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.256] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.256] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.257] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.257] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.257] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.257] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.257] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.257] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.257] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.257] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0078.257] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.257] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0078.257] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.257] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.257] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7acb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0078.257] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0078.257] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0078.257] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.257] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.257] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.258] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.258] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.258] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.258] FreeLibrary (hLibModule=0x76a10000) returned 1 [0078.258] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.258] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.258] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.258] CloseHandle (hObject=0x24c) returned 1 [0078.295] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.295] CloseHandle (hObject=0x240) returned 1 [0078.297] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.299] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.299] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.299] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.299] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/uQdlphYG1dbqk1.jpg", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uQdlphYG1dbqk1.jpg", lpFilePart=0x8bedf4*="uQdlphYG1dbqk1.jpg") returned 0x30 [0078.299] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uQdlphYG1dbqk1.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\uqdlphyg1dbqk1.jpg")) returned 0x20 [0078.299] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uQdlphYG1dbqk1.jpg", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0078.299] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uQdlphYG1dbqk1.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\uqdlphyg1dbqk1.jpg")) returned 1 [0078.314] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0078.314] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0078.314] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.314] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.314] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.314] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/uQdlphYG1dbqk1.jpg", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uQdlphYG1dbqk1.jpg", lpFilePart=0x8bf650*="uQdlphYG1dbqk1.jpg") returned 0x30 [0078.314] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uQdlphYG1dbqk1.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\uqdlphyg1dbqk1.jpg")) returned 0xffffffff [0078.314] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.314] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.314] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V9yoC.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9yoC.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yoC.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oC.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.315] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V9yoC.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9yoC.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0078.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yoC.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oC.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.315] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.315] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0078.315] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.315] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.315] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.315] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.315] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.315] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0078.315] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.315] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.315] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.315] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.315] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.315] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/V9yoC.mp3", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cca8 [0078.316] FindClose (in: hFindFile=0xa7cca8 | out: hFindFile=0xa7cca8) returned 1 [0078.316] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.316] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.316] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0078.316] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.316] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0078.316] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.363] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.363] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.363] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.363] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.363] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.363] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.363] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.363] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0078.363] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.364] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.364] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0078.364] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.364] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0078.364] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.364] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.364] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.364] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.364] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.364] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.364] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0078.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0078.364] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.364] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.364] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0078.364] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.364] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0078.364] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0078.364] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0078.365] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0078.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0078.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0078.365] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0078.365] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0078.365] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.365] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.366] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0078.366] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.366] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0078.366] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.366] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.366] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.366] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.366] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.366] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.366] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0078.366] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.366] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0078.366] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.366] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.366] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.366] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.366] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.366] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.366] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.366] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0078.366] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.367] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0078.367] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.367] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.367] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.367] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.367] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.367] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.367] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.367] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0078.367] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.367] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0078.367] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.367] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.367] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.367] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.367] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.367] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.367] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.367] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.367] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.367] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0078.368] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.368] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0078.368] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.368] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.368] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.368] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.368] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.368] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.368] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.368] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.368] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.368] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.368] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.368] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0078.368] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.368] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0078.368] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.368] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.368] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e98, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0078.369] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0078.369] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0078.369] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.369] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.369] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.369] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0078.369] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0078.369] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3981d00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0078.369] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.369] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.369] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.369] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.370] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.370] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.370] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a2e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0078.370] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0078.370] CryptHashData (hHash=0xa7d0e8, pbData=0x3981d90, dwDataLen=0x3, dwFlags=0x1) returned 1 [0078.370] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.370] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.370] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.370] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.370] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.370] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.370] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.370] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.370] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0078.370] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.370] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0078.371] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.371] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.371] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0078.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a4b0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0078.371] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0078.371] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d0e8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7ce28) returned 1 [0078.371] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.371] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.371] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.371] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.371] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.371] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.371] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.371] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0078.371] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.372] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0078.372] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0078.372] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0078.372] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0078.372] CryptDestroyHash (hHash=0xa7d0e8) returned 1 [0078.372] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.372] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.372] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.372] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.372] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.373] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/V9yoC.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\v9yoc.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0078.373] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.373] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0078.373] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.373] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.373] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.373] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0078.374] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.V9yoC.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.v9yoc.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0078.374] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.376] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.376] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.376] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.378] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0078.378] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0078.380] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x2859, lpOverlapped=0x0) returned 1 [0078.380] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0078.384] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.384] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.384] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.384] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0078.386] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.386] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0078.386] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.386] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.386] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.386] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.386] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.386] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.386] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.386] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0078.386] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.386] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0078.387] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.387] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.387] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.387] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.387] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.387] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.387] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.387] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.387] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.387] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0078.387] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.387] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0078.387] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.387] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.387] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.387] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.387] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.387] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.387] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.387] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.387] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.387] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.388] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.388] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.388] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.388] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a348, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.388] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0078.389] CryptEncrypt (in: hKey=0xa7ce28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x12859, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x12860) returned 1 [0078.389] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.389] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.389] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.389] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.389] CharLowerBuffW (in: lpsz="byte[75872]", cchLength=0xb | out: lpsz="byte[75872]") returned 0xb [0078.389] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.390] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.390] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.390] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.390] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.390] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.390] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a198, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.391] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0078.391] CryptEncrypt (in: hKey=0xa7ce28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x39968b8*, pdwDataLen=0x8bef60*=0x12859, dwBufLen=0x12860 | out: pbData=0x39968b8*, pdwDataLen=0x8bef60*=0x12860) returned 1 [0078.394] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.394] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.394] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.394] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.394] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.394] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.394] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.394] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0078.394] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.394] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0078.394] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.394] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.394] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0078.394] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.394] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0078.394] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.394] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.394] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.394] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.394] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.395] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.395] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.395] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.395] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.395] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.395] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.395] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.400] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.400] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.400] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.400] WriteFile (in: hFile=0x24c, lpBuffer=0x2cc7890*, nNumberOfBytesToWrite=0x12860, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cc7890*, lpNumberOfBytesWritten=0x8bf5e4*=0x12860, lpOverlapped=0x0) returned 1 [0078.404] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.404] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.404] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0078.404] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.404] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0078.404] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.404] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.404] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.404] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0078.404] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.404] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0078.404] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0078.404] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92ac0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0078.404] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0078.405] CryptDestroyKey (hKey=0xa7ce28) returned 1 [0078.405] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.405] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.405] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0078.405] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.405] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0078.405] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.405] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.405] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0078.405] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.405] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0078.405] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.405] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.405] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.405] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.405] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.405] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.405] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.405] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.405] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.405] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.406] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.406] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.406] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.406] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.406] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0078.406] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.406] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0078.406] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.406] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.406] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0078.406] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.406] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0078.406] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.406] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.406] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.417] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 1 [0078.417] TranslateMessage (lpMsg=0x8bf4a8) returned 0 [0078.417] DispatchMessageW (lpMsg=0x8bf4a8) returned 0x0 [0078.417] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0078.417] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0078.417] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.417] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.417] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.417] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.417] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.417] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.417] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.417] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.417] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.418] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.418] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.418] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.418] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0078.418] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.418] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0078.418] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.418] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.418] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a9d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0078.418] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0078.418] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0078.418] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.418] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.418] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.418] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.419] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.419] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.419] FreeLibrary (hLibModule=0x76a10000) returned 1 [0078.419] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.419] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.419] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.419] CloseHandle (hObject=0x240) returned 1 [0078.419] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.419] CloseHandle (hObject=0x24c) returned 1 [0078.421] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.423] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.423] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.423] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.423] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/V9yoC.mp3", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\V9yoC.mp3", lpFilePart=0x8bedf4*="V9yoC.mp3") returned 0x27 [0078.423] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\V9yoC.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\v9yoc.mp3")) returned 0x20 [0078.423] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\V9yoC.mp3", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0078.424] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\V9yoC.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\v9yoc.mp3")) returned 1 [0078.429] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0078.429] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0078.429] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.429] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.429] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.429] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/V9yoC.mp3", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\V9yoC.mp3", lpFilePart=0x8bf650*="V9yoC.mp3") returned 0x27 [0078.430] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\V9yoC.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\v9yoc.mp3")) returned 0xffffffff [0078.430] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.430] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.430] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VowNGbAt2Uc.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="owNGbAt2Uc.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wNGbAt2Uc.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NGbAt2Uc.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GbAt2Uc.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bAt2Uc.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="At2Uc.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t2Uc.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2Uc.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Uc.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.430] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VowNGbAt2Uc.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="owNGbAt2Uc.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wNGbAt2Uc.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NGbAt2Uc.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GbAt2Uc.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bAt2Uc.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="At2Uc.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t2Uc.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2Uc.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0078.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Uc.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.430] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.431] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0078.431] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.431] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.431] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.431] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.431] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0078.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.431] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/VowNGbAt2Uc.flv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7c9e8 [0078.431] FindClose (in: hFindFile=0xa7c9e8 | out: hFindFile=0xa7c9e8) returned 1 [0078.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.431] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0078.431] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.431] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0078.432] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.432] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.432] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.432] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.432] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.432] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.432] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.432] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.432] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0078.432] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.432] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.432] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0078.432] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.432] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0078.432] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.432] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.432] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.432] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.432] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.433] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.433] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0078.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0078.433] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.433] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.433] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0078.433] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.433] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0078.433] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0078.433] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0078.433] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0078.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0078.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac78, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0078.433] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0078.434] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0078.434] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.434] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.434] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0078.434] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.434] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0078.434] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.434] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.434] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.434] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.434] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.434] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.435] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0078.435] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.435] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0078.435] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.435] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.435] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.435] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.435] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.435] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.435] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.435] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0078.435] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.435] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0078.435] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.435] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.435] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.435] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.435] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.435] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.435] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.435] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0078.436] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.436] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0078.436] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.436] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.436] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.436] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.436] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.436] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.436] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.436] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.436] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.436] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0078.436] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.436] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0078.436] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.436] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.436] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.436] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.436] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.436] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.436] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.436] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.436] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.436] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.437] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.437] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0078.437] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.437] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0078.437] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.437] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.437] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e98, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0078.437] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0078.437] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0078.437] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.437] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.437] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.437] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3982a20, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0078.437] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0078.438] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3982980, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0078.438] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.438] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.438] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.438] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.450] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.450] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.451] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a2d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0078.451] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0078.451] CryptHashData (hHash=0xa7cda8, pbData=0x39829c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0078.451] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.451] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.451] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.451] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.451] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.451] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.451] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.451] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.451] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0078.451] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.451] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0078.451] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.451] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.451] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0078.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a4c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0078.452] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0078.452] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cda8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d128) returned 1 [0078.452] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.452] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.452] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.452] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.452] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.452] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.452] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.452] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0078.452] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.452] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0078.452] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0078.452] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0078.452] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0078.453] CryptDestroyHash (hHash=0xa7cda8) returned 1 [0078.453] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.454] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/VowNGbAt2Uc.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\vowngbat2uc.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0078.454] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.454] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0078.454] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.454] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.454] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.454] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0078.454] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.VowNGbAt2Uc.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.vowngbat2uc.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0078.455] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.455] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.455] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.455] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.457] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0078.457] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0078.459] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x7ec7, lpOverlapped=0x0) returned 1 [0078.459] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0078.463] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.464] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.464] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.464] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0078.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.466] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0078.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.467] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0078.467] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.467] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0078.467] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.467] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.467] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.467] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.467] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.467] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.467] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.467] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.467] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.467] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0078.467] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.467] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0078.467] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.467] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.467] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.467] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.467] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.467] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.467] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.467] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.467] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.467] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.468] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.468] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.468] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.468] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a108, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.469] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0078.469] CryptEncrypt (in: hKey=0xa7d128, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x17ec7, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x17ec8) returned 1 [0078.469] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.469] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.469] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.469] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.469] CharLowerBuffW (in: lpsz="byte[97992]", cchLength=0xb | out: lpsz="byte[97992]") returned 0xb [0078.469] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.474] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.474] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.475] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.475] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.475] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.475] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.476] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a150, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.476] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0078.476] CryptEncrypt (in: hKey=0xa7d128, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x399bf20*, pdwDataLen=0x8bef60*=0x17ec7, dwBufLen=0x17ec8 | out: pbData=0x399bf20*, pdwDataLen=0x8bef60*=0x17ec8) returned 1 [0078.479] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.480] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.480] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.480] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.481] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.481] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.481] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.481] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0078.481] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.481] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0078.481] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.481] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.481] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0078.481] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.481] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0078.481] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.481] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.481] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.481] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.481] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.481] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.481] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.481] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.481] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.481] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.481] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.483] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.490] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.490] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.491] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.491] WriteFile (in: hFile=0x240, lpBuffer=0x2cccef8*, nNumberOfBytesToWrite=0x17ec8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cccef8*, lpNumberOfBytesWritten=0x8bf5e4*=0x17ec8, lpOverlapped=0x0) returned 1 [0078.495] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.496] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.496] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0078.496] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.496] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0078.496] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.496] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.496] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.496] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0078.496] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.496] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0078.496] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0078.496] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c929b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0078.496] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0078.496] CryptDestroyKey (hKey=0xa7d128) returned 1 [0078.497] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.497] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.497] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0078.497] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.497] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0078.497] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.497] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.497] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0078.497] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.497] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0078.497] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.497] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.497] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.497] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.497] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.497] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.497] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.497] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.497] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.497] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.497] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.497] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.498] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.498] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.498] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0078.498] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.498] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0078.498] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.498] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.498] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0078.498] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.498] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0078.498] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.498] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.498] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.498] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.498] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.498] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.498] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.498] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.498] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.498] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.498] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.498] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.498] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.498] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.499] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.499] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0078.499] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.499] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0078.499] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.499] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.499] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0078.499] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0078.499] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0078.499] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.499] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.499] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.499] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.499] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.499] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.499] FreeLibrary (hLibModule=0x76a10000) returned 1 [0078.499] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.499] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.499] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.499] CloseHandle (hObject=0x24c) returned 1 [0078.500] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.500] CloseHandle (hObject=0x240) returned 1 [0078.503] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.504] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.504] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.504] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.504] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/VowNGbAt2Uc.flv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VowNGbAt2Uc.flv", lpFilePart=0x8bedf4*="VowNGbAt2Uc.flv") returned 0x2d [0078.504] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VowNGbAt2Uc.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\vowngbat2uc.flv")) returned 0x20 [0078.505] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VowNGbAt2Uc.flv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cd28 [0078.505] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VowNGbAt2Uc.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\vowngbat2uc.flv")) returned 1 [0078.510] FindNextFileW (in: hFindFile=0xa7cd28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0078.510] FindClose (in: hFindFile=0xa7cd28 | out: hFindFile=0xa7cd28) returned 1 [0078.510] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.510] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.511] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.511] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/VowNGbAt2Uc.flv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VowNGbAt2Uc.flv", lpFilePart=0x8bf650*="VowNGbAt2Uc.flv") returned 0x2d [0078.511] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VowNGbAt2Uc.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\vowngbat2uc.flv")) returned 0xffffffff [0078.511] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.511] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.511] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v_rOYmuVae.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_rOYmuVae.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rOYmuVae.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OYmuVae.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YmuVae.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="muVae.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uVae.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vae.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ae.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.511] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v_rOYmuVae.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_rOYmuVae.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rOYmuVae.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OYmuVae.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YmuVae.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="muVae.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uVae.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vae.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0078.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ae.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0078.511] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.512] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0078.512] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.512] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.512] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.512] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.512] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.512] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0078.512] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.512] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.512] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.512] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.512] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.512] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/v_rOYmuVae.mkv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cca8 [0078.512] FindClose (in: hFindFile=0xa7cca8 | out: hFindFile=0xa7cca8) returned 1 [0078.512] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.512] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.512] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0078.512] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.512] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0078.512] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.513] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.513] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.513] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.513] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.513] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.513] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.513] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.513] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0078.513] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.513] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.513] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0078.513] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.513] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0078.513] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.513] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.513] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.513] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.513] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.513] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.514] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0078.514] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0078.514] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.514] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.514] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0078.514] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.514] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0078.514] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0078.514] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0078.514] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0078.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0078.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aad8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0078.514] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0078.514] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0078.515] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.515] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.515] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0078.515] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.515] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0078.515] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.515] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.515] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.515] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.515] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.532] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.532] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0078.532] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.532] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0078.532] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.532] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.532] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.532] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.532] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.532] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.533] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0078.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.533] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0078.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.533] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0078.533] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.533] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0078.533] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.533] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.533] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.533] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.533] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.533] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0078.534] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.534] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0078.534] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.534] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.534] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.534] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.534] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.534] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.534] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.534] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.534] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.534] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.534] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.534] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0078.534] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.534] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0078.534] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.534] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.534] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e98, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0078.535] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0078.535] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0078.535] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.535] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.535] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.535] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983990, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0078.535] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0078.535] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983950, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0078.535] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.535] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.535] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.535] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.535] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.535] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.535] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a138, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0078.536] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0078.536] CryptHashData (hHash=0xa7cf68, pbData=0x39838f0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0078.536] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.536] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.536] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.536] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.536] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.536] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.536] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.536] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.536] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0078.536] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.536] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0078.536] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.536] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.536] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0078.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a438, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0078.537] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0078.537] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cf68, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cc28) returned 1 [0078.537] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.537] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.537] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.537] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.537] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.537] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.537] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.537] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0078.537] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.537] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0078.537] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0078.537] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0078.538] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0078.538] CryptDestroyHash (hHash=0xa7cf68) returned 1 [0078.538] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.538] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.538] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.538] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.538] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.539] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/v_rOYmuVae.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\v_roymuvae.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0078.539] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.539] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0078.539] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.539] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.539] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.539] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0078.539] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.v_rOYmuVae.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.v_roymuvae.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0078.569] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.569] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.569] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.569] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.572] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0078.572] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x135c, lpOverlapped=0x0) returned 1 [0078.573] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0078.575] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.575] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.575] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.576] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0078.576] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.576] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0078.576] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.576] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.576] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.576] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.576] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.576] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.576] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.576] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0078.576] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.576] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0078.576] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.576] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.576] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.577] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.577] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.577] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.577] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.577] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.577] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.577] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0078.577] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.577] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0078.577] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.577] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.577] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.585] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.585] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.585] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.585] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.585] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.585] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.585] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.585] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.585] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.585] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.585] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a2d0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.586] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0078.586] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x135c, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x1360) returned 1 [0078.586] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.586] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.586] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.586] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.586] CharLowerBuffW (in: lpsz="byte[4960]", cchLength=0xa | out: lpsz="byte[4960]") returned 0xa [0078.586] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.586] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.586] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.586] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.586] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.586] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.587] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0078.587] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a168, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.587] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0078.587] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cb8a60*, pdwDataLen=0x8bef60*=0x135c, dwBufLen=0x1360 | out: pbData=0x2cb8a60*, pdwDataLen=0x8bef60*=0x1360) returned 1 [0078.587] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.587] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.587] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.587] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.587] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.587] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.587] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.587] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0078.587] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.588] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0078.588] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.588] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0078.588] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.588] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0078.588] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.588] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.588] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.588] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.588] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.589] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb6390*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb6390*, lpNumberOfBytesWritten=0x8bf5e4*=0x1360, lpOverlapped=0x0) returned 1 [0078.590] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.590] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.590] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0078.590] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.590] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0078.590] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.590] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.590] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.590] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0078.590] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.590] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0078.590] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0078.590] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92ac0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0078.590] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0078.590] CryptDestroyKey (hKey=0xa7cc28) returned 1 [0078.590] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.590] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.591] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0078.591] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.591] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0078.591] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.591] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.591] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0078.591] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.591] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0078.591] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.591] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.591] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0078.591] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.591] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.591] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.591] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.591] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.591] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0078.591] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.591] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0078.591] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.591] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0078.591] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.592] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0078.592] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.592] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0078.592] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.592] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.592] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0078.592] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.592] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0078.592] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.592] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.592] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0078.592] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.592] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0078.592] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.592] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0078.592] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.592] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0078.592] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.592] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.592] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.592] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.592] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.593] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0078.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.593] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0078.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.593] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a958, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0078.593] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0078.593] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0078.593] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.593] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0078.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.593] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0078.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0078.593] FreeLibrary (hLibModule=0x76a10000) returned 1 [0078.594] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.594] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0078.594] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.594] CloseHandle (hObject=0x240) returned 1 [0078.595] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.595] CloseHandle (hObject=0x24c) returned 1 [0078.599] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0078.599] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.599] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.599] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/v_rOYmuVae.mkv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v_rOYmuVae.mkv", lpFilePart=0x8bedf4*="v_rOYmuVae.mkv") returned 0x2c [0078.600] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v_rOYmuVae.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\v_roymuvae.mkv")) returned 0x20 [0078.600] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v_rOYmuVae.mkv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7caa8 [0078.600] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v_rOYmuVae.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\v_roymuvae.mkv")) returned 1 [0078.812] FindNextFileW (in: hFindFile=0xa7caa8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0078.812] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0078.816] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.816] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0078.816] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0078.816] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/v_rOYmuVae.mkv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v_rOYmuVae.mkv", lpFilePart=0x8bf650*="v_rOYmuVae.mkv") returned 0x2c [0078.816] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v_rOYmuVae.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\v_roymuvae.mkv")) returned 0xffffffff [0078.816] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.816] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.816] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0078.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W9JWpaycQhp.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9JWpaycQhp.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JWpaycQhp.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WpaycQhp.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="paycQhp.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aycQhp.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ycQhp.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cQhp.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Qhp.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hp.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0078.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0078.817] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W9JWpaycQhp.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9JWpaycQhp.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0079.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JWpaycQhp.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WpaycQhp.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="paycQhp.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aycQhp.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0079.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ycQhp.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cQhp.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0079.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Qhp.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hp.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.130] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.130] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0079.130] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0079.130] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0079.130] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0079.130] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0079.130] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.130] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0079.130] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.130] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.130] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.130] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.130] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.130] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/W9JWpaycQhp.pptx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cb28 [0079.131] FindClose (in: hFindFile=0xa7cb28 | out: hFindFile=0xa7cb28) returned 1 [0079.131] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.131] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.131] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0079.131] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.131] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0079.131] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.131] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.131] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.131] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.131] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.131] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.131] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.131] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.131] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0079.131] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.131] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.132] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0079.132] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.132] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0079.132] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.132] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.132] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.132] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.132] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.132] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.132] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0079.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0079.132] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.132] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.132] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0079.132] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.132] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0079.132] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0079.132] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a958, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0079.133] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0079.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0079.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0079.133] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0079.133] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0079.133] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.133] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.133] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0079.133] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.134] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0079.134] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.134] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.134] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.134] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.134] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.134] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.134] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0079.134] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.134] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0079.134] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.134] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.134] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.134] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.134] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.134] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.134] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.134] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0079.134] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.134] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0079.134] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.134] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.135] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.135] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.135] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.135] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.135] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.135] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0079.135] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.135] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0079.135] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.135] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.135] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.135] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.135] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.135] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.135] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.135] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.135] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.135] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0079.135] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.135] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0079.135] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.135] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.136] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.136] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.136] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.136] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.136] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.136] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.136] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.136] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.136] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.136] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0079.136] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.136] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0079.136] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.136] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.136] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92f58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0079.136] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0079.137] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0079.137] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.137] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.137] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.137] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983420, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0079.137] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0079.137] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983420, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0079.137] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.137] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.137] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.137] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.137] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.137] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.137] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0079.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a198, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0079.138] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0079.138] CryptHashData (hHash=0xa7cda8, pbData=0x3983400, dwDataLen=0x3, dwFlags=0x1) returned 1 [0079.138] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.138] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.138] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.138] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.138] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.138] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.138] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.138] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.138] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0079.138] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.138] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0079.138] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.138] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.138] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0079.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a570, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0079.139] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0079.139] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cda8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7ce28) returned 1 [0079.139] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.139] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.139] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.139] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.139] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.139] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.139] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.139] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0079.217] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.217] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 1 [0079.217] TranslateMessage (lpMsg=0x8bef40) returned 0 [0079.217] DispatchMessageW (lpMsg=0x8bef40) returned 0x0 [0079.217] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0079.217] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0079.217] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0079.218] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0079.218] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0079.218] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0079.218] CryptDestroyHash (hHash=0xa7cda8) returned 1 [0079.218] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.218] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.218] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.218] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.218] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.219] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/W9JWpaycQhp.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\w9jwpaycqhp.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0079.219] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.219] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0079.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.220] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0079.221] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.W9JWpaycQhp.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.w9jwpaycqhp.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0079.298] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.298] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.298] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.298] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.301] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0079.301] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0xa65, lpOverlapped=0x0) returned 1 [0079.302] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0079.305] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.305] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.305] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.305] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0079.305] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.305] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0079.305] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.305] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.305] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.305] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.305] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.306] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.306] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.306] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0079.306] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.306] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0079.306] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.306] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.306] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.306] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.306] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.306] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.306] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.306] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.306] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.306] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0079.306] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.306] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0079.307] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.307] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.307] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.307] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.307] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.307] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.307] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.307] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.307] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.307] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.307] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.307] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.307] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.307] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a3d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.308] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0079.308] CryptEncrypt (in: hKey=0xa7ce28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xa65, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xa68) returned 1 [0079.308] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.308] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.308] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.308] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.308] CharLowerBuffW (in: lpsz="byte[2664]", cchLength=0xa | out: lpsz="byte[2664]") returned 0xa [0079.308] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.308] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.308] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.308] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.308] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.309] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.309] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.309] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a198, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.309] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0079.309] CryptEncrypt (in: hKey=0xa7ce28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cb6f78*, pdwDataLen=0x8bef60*=0xa65, dwBufLen=0xa68 | out: pbData=0x2cb6f78*, pdwDataLen=0x8bef60*=0xa68) returned 1 [0079.309] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.309] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.309] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.309] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.309] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.309] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.310] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.310] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0079.310] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.310] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0079.310] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.310] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.310] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0079.310] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.310] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0079.310] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.310] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.310] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.310] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.310] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.310] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.310] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.310] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.311] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.311] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.311] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.311] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.311] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.311] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.311] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.311] WriteFile (in: hFile=0x240, lpBuffer=0x2cb5a98*, nNumberOfBytesToWrite=0xa68, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5a98*, lpNumberOfBytesWritten=0x8bf5e4*=0xa68, lpOverlapped=0x0) returned 1 [0079.312] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.312] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.312] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0079.312] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.312] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0079.312] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.313] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.313] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.313] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0079.313] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.313] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0079.350] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0079.350] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92ac0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0079.350] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0079.350] CryptDestroyKey (hKey=0xa7ce28) returned 1 [0079.350] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.350] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.350] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0079.350] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.350] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0079.350] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.350] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.350] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0079.351] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0079.351] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0079.351] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.351] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.351] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0079.351] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.351] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.351] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0079.352] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.352] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0079.352] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.352] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.352] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0079.352] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.352] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0079.352] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.352] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.352] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.352] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.352] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.352] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.352] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.352] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.352] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.352] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.352] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.352] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.353] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.353] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.353] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.353] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0079.353] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.353] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0079.353] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.353] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.353] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a958, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0079.353] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0079.353] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0079.353] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.353] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.353] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.354] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.354] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.354] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.354] FreeLibrary (hLibModule=0x76a10000) returned 1 [0079.354] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.354] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.354] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.354] CloseHandle (hObject=0x24c) returned 1 [0079.355] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.355] CloseHandle (hObject=0x240) returned 1 [0079.428] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.429] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.429] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0079.429] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0079.429] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/W9JWpaycQhp.pptx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\W9JWpaycQhp.pptx", lpFilePart=0x8bedf4*="W9JWpaycQhp.pptx") returned 0x2e [0079.429] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\W9JWpaycQhp.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\w9jwpaycqhp.pptx")) returned 0x20 [0079.429] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\W9JWpaycQhp.pptx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cd28 [0079.430] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\W9JWpaycQhp.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\w9jwpaycqhp.pptx")) returned 1 [0079.445] FindNextFileW (in: hFindFile=0xa7cd28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0079.445] FindClose (in: hFindFile=0xa7cd28 | out: hFindFile=0xa7cd28) returned 1 [0079.445] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.445] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0079.445] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0079.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/W9JWpaycQhp.pptx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\W9JWpaycQhp.pptx", lpFilePart=0x8bf650*="W9JWpaycQhp.pptx") returned 0x2e [0079.446] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\W9JWpaycQhp.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\w9jwpaycqhp.pptx")) returned 0xffffffff [0079.446] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.446] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.446] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wxFZJI-.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xFZJI-.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FZJI-.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZJI-.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JI-.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I-.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.446] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wxFZJI-.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xFZJI-.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FZJI-.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZJI-.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JI-.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I-.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.446] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.446] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0079.446] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0079.446] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0079.446] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0079.446] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0079.447] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.447] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0079.447] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.447] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.447] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.447] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.447] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.447] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/wxFZJI-.mkv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7ce28 [0079.447] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0079.447] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.447] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.447] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0079.447] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.447] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0079.448] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.448] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.448] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.448] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.448] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.448] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.448] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.448] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.448] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0079.448] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.448] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.448] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0079.448] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.448] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0079.449] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.449] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.449] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.449] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.449] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.449] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.449] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0079.449] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0079.449] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.449] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.449] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0079.449] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.449] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0079.449] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0079.449] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0079.449] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0079.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0079.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aad8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0079.450] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0079.450] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0079.450] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.450] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.450] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0079.450] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.450] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0079.450] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.451] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0079.451] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.451] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0079.451] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.451] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0079.451] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.451] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0079.451] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.451] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.452] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0079.452] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.452] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0079.452] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.452] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.452] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.452] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.452] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.452] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.452] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.452] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.452] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.452] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0079.452] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.477] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0079.480] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.525] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.525] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.525] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.525] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.525] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.525] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.525] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.525] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.525] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.525] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.525] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0079.525] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.526] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0079.526] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.526] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.526] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e68, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0079.526] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0079.526] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0079.526] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.526] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.526] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.526] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3980c80, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0079.526] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0079.526] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3980c50, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0079.527] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.527] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.527] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.527] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.527] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.527] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.527] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0079.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a198, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0079.527] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0079.527] CryptHashData (hHash=0xa7d128, pbData=0x3980c40, dwDataLen=0x3, dwFlags=0x1) returned 1 [0079.527] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.527] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.527] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.527] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.527] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.527] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.528] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.528] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.528] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0079.528] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.528] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0079.528] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.528] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.528] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0079.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a588, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0079.528] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0079.528] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d128, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7c9a8) returned 1 [0079.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.528] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.528] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0079.529] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.529] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0079.529] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0079.529] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0079.529] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0079.529] CryptDestroyHash (hHash=0xa7d128) returned 1 [0079.529] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.529] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.529] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.529] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.529] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.529] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/wxFZJI-.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wxfzji-.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0079.530] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.530] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0079.530] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.530] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.530] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.530] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0079.530] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.wxFZJI-.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.wxfzji-.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0079.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.550] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0079.550] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x47cd, lpOverlapped=0x0) returned 1 [0079.551] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0079.553] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.553] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.553] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.553] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0079.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.554] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0079.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.554] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0079.554] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.554] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0079.554] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.554] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.554] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.554] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.554] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.554] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.555] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.555] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.555] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.555] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0079.555] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.555] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0079.555] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.555] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.555] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.555] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.555] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.555] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.555] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.555] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.555] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.555] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.555] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.555] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.555] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.555] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a150, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.556] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0079.556] CryptEncrypt (in: hKey=0xa7c9a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x47cd, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x47d0) returned 1 [0079.556] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.556] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.556] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.556] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.556] CharLowerBuffW (in: lpsz="byte[18384]", cchLength=0xb | out: lpsz="byte[18384]") returned 0xb [0079.556] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.556] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.556] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.556] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.556] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.557] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.557] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.557] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a168, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.557] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0079.557] CryptEncrypt (in: hKey=0xa7c9a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cc27b0*, pdwDataLen=0x8bef60*=0x47cd, dwBufLen=0x47d0 | out: pbData=0x2cc27b0*, pdwDataLen=0x8bef60*=0x47d0) returned 1 [0079.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.558] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0079.558] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.558] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0079.558] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.560] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.560] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0079.560] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.560] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0079.560] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.560] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.560] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.560] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.560] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.560] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.560] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.560] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.560] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.560] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.560] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.560] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.562] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.562] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.562] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.562] WriteFile (in: hFile=0x24c, lpBuffer=0x2cd8ee8*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cd8ee8*, lpNumberOfBytesWritten=0x8bf5e4*=0x47d0, lpOverlapped=0x0) returned 1 [0079.563] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.563] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.563] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0079.563] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.563] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0079.563] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.563] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.564] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.564] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0079.564] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.564] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0079.564] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0079.564] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92808, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0079.564] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0079.564] CryptDestroyKey (hKey=0xa7c9a8) returned 1 [0079.564] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.564] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.564] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0079.564] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.564] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0079.564] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.564] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.565] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0079.565] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0079.565] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0079.565] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0079.565] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0079.565] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0079.565] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.565] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.565] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0079.565] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.565] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0079.565] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0079.565] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.565] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.565] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.565] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.565] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.565] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0079.565] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.565] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0079.565] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.565] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.566] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0079.566] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.566] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0079.566] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.566] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.566] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.566] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.566] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.566] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.566] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.566] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.566] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.566] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.566] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.566] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.566] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.566] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.566] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.566] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0079.566] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.566] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0079.567] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.567] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.567] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7abf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0079.567] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0079.567] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0079.567] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.567] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.567] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.567] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.567] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.567] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.567] FreeLibrary (hLibModule=0x76a10000) returned 1 [0079.567] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.567] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.567] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.567] CloseHandle (hObject=0x240) returned 1 [0079.568] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.568] CloseHandle (hObject=0x24c) returned 1 [0079.608] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.609] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.609] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0079.609] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0079.609] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/wxFZJI-.mkv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\wxFZJI-.mkv", lpFilePart=0x8bedf4*="wxFZJI-.mkv") returned 0x29 [0079.609] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\wxFZJI-.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wxfzji-.mkv")) returned 0x20 [0079.609] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\wxFZJI-.mkv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7caa8 [0079.609] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\wxFZJI-.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wxfzji-.mkv")) returned 1 [0079.650] FindNextFileW (in: hFindFile=0xa7caa8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0079.650] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0079.653] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.653] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0079.653] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0079.653] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/wxFZJI-.mkv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\wxFZJI-.mkv", lpFilePart=0x8bf650*="wxFZJI-.mkv") returned 0x29 [0079.653] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\wxFZJI-.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wxfzji-.mkv")) returned 0xffffffff [0079.654] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.654] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.654] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xH2Q91hAXQ3Pfvttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H2Q91hAXQ3Pfvttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2Q91hAXQ3Pfvttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q91hAXQ3Pfvttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="91hAXQ3Pfvttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1hAXQ3Pfvttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hAXQ3Pfvttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AXQ3Pfvttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XQ3Pfvttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q3Pfvttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3Pfvttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pfvttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fvttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ttd_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="td_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.654] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xH2Q91hAXQ3Pfvttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H2Q91hAXQ3Pfvttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2Q91hAXQ3Pfvttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q91hAXQ3Pfvttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="91hAXQ3Pfvttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1hAXQ3Pfvttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hAXQ3Pfvttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AXQ3Pfvttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XQ3Pfvttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q3Pfvttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3Pfvttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pfvttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fvttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.655] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ttd_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.655] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="td_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.655] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0079.655] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_N.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0079.655] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.655] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0079.655] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0079.655] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0079.655] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0079.655] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0079.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.655] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0079.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.655] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/xH2Q91hAXQ3Pfvttd_N.wav", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7caa8 [0079.655] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0079.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.656] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.656] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0079.656] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.656] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0079.656] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.656] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.656] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.656] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.656] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.656] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.656] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.656] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.656] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0079.656] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.656] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.656] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0079.656] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.656] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0079.656] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.656] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.657] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.657] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.657] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.657] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.657] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0079.657] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0079.657] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.676] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.676] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0079.676] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.676] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0079.676] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0079.676] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0079.676] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0079.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0079.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0079.677] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0079.677] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0079.677] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.677] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.677] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0079.677] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.677] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0079.677] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.677] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.677] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.677] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.677] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.678] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0079.678] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.678] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0079.678] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.678] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0079.678] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.678] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0079.678] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.678] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0079.678] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.678] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0079.679] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.679] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.679] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.679] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.679] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.679] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.679] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.679] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.679] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.679] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0079.679] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.679] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0079.679] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.679] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.679] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.679] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.679] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.679] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.679] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.679] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.679] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.679] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.679] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.679] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0079.680] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.680] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0079.680] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.680] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.680] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92f58, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0079.680] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0079.680] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0079.680] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.680] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.680] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.680] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983670, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0079.680] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0079.680] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983680, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0079.681] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.681] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.681] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.681] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.681] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.681] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.681] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0079.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a198, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0079.681] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0079.681] CryptHashData (hHash=0xa7caa8, pbData=0x3983520, dwDataLen=0x3, dwFlags=0x1) returned 1 [0079.681] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.681] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.681] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.681] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.681] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.681] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.682] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.682] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.682] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0079.682] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.682] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0079.682] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.682] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.682] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0079.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a690, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0079.682] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0079.682] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7caa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7ce28) returned 1 [0079.682] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.682] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.682] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.682] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.682] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.682] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.682] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.683] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0079.683] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.683] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0079.683] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0079.683] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7acf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0079.683] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0079.683] CryptDestroyHash (hHash=0xa7caa8) returned 1 [0079.683] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.683] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.683] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.683] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.683] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.683] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/xH2Q91hAXQ3Pfvttd_N.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xh2q91haxq3pfvttd_n.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0079.684] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.684] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0079.684] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.684] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.684] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.684] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0079.684] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.xH2Q91hAXQ3Pfvttd_N.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.xh2q91haxq3pfvttd_n.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0079.758] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.758] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.758] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.758] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.760] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0079.760] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0079.762] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x6caa, lpOverlapped=0x0) returned 1 [0079.762] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0079.765] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.766] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.766] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.766] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0079.769] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.769] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0079.769] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.769] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.769] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.769] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.769] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.769] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.769] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.769] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0079.769] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.827] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0079.827] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.827] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.827] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.827] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.827] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.827] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.827] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.827] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.827] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.827] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0079.827] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.827] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0079.827] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.827] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.827] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.827] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.827] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.827] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.828] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.828] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.828] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.828] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.828] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.828] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.828] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.829] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a168, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.829] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0079.830] CryptEncrypt (in: hKey=0xa7ce28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x16caa, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x16cb0) returned 1 [0079.830] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.830] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.830] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.830] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.830] CharLowerBuffW (in: lpsz="byte[93360]", cchLength=0xb | out: lpsz="byte[93360]") returned 0xb [0079.830] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.832] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.832] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.832] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.832] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.832] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.832] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0079.834] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a1e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.834] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0079.834] CryptEncrypt (in: hKey=0xa7ce28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x399ad08*, pdwDataLen=0x8bef60*=0x16caa, dwBufLen=0x16cb0 | out: pbData=0x399ad08*, pdwDataLen=0x8bef60*=0x16cb0) returned 1 [0079.838] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.838] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.838] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.838] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.838] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.839] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.839] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.839] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0079.839] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.839] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0079.839] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.839] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.839] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0079.839] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.839] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0079.839] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.839] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.839] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0079.839] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.839] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.839] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.839] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.839] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.839] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0079.839] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.839] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0079.839] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0079.847] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.847] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.847] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.848] WriteFile (in: hFile=0x240, lpBuffer=0x2ccbce0*, nNumberOfBytesToWrite=0x16cb0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2ccbce0*, lpNumberOfBytesWritten=0x8bf5e4*=0x16cb0, lpOverlapped=0x0) returned 1 [0079.852] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.852] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.852] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0079.852] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.852] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0079.852] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.852] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.852] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.852] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0079.852] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.852] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0079.852] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0079.852] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c929a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0079.853] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0079.853] CryptDestroyKey (hKey=0xa7ce28) returned 1 [0079.853] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.853] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.853] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0079.853] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.853] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0079.853] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.853] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.853] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0079.853] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0079.853] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0079.853] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0079.853] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0079.853] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0079.853] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.854] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.854] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0079.854] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.854] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.854] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0079.854] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.854] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0079.854] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.854] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0079.854] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.854] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0079.854] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.855] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.855] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.855] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.855] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.855] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.855] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.855] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.855] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.855] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.855] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.855] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.855] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0079.855] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.855] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0079.855] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.855] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.855] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7abb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0079.855] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0079.856] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0079.856] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.856] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.856] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.856] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0079.856] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.856] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0079.863] FreeLibrary (hLibModule=0x76a10000) returned 1 [0079.863] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.863] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.863] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.863] CloseHandle (hObject=0x24c) returned 1 [0079.863] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.863] CloseHandle (hObject=0x240) returned 1 [0079.889] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.890] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.891] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0079.891] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0079.891] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/xH2Q91hAXQ3Pfvttd_N.wav", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xH2Q91hAXQ3Pfvttd_N.wav", lpFilePart=0x8bedf4*="xH2Q91hAXQ3Pfvttd_N.wav") returned 0x35 [0079.891] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xH2Q91hAXQ3Pfvttd_N.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xh2q91haxq3pfvttd_n.wav")) returned 0x20 [0079.891] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xH2Q91hAXQ3Pfvttd_N.wav", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cfa8 [0079.891] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xH2Q91hAXQ3Pfvttd_N.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xh2q91haxq3pfvttd_n.wav")) returned 1 [0079.994] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0079.994] FindClose (in: hFindFile=0xa7cfa8 | out: hFindFile=0xa7cfa8) returned 1 [0079.994] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 1 [0079.994] TranslateMessage (lpMsg=0x8bf968) returned 0 [0079.994] DispatchMessageW (lpMsg=0x8bf968) returned 0x0 [0079.994] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0079.994] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0079.995] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.995] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0079.995] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0079.995] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/xH2Q91hAXQ3Pfvttd_N.wav", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xH2Q91hAXQ3Pfvttd_N.wav", lpFilePart=0x8bf650*="xH2Q91hAXQ3Pfvttd_N.wav") returned 0x35 [0079.995] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xH2Q91hAXQ3Pfvttd_N.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xh2q91haxq3pfvttd_n.wav")) returned 0xffffffff [0079.995] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.995] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.995] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xJQWy0H5XjB.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JQWy0H5XjB.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QWy0H5XjB.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wy0H5XjB.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y0H5XjB.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0H5XjB.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H5XjB.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5XjB.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XjB.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0079.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jB.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0079.996] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xJQWy0H5XjB.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JQWy0H5XjB.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QWy0H5XjB.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wy0H5XjB.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y0H5XjB.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0H5XjB.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0079.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H5XjB.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5XjB.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0079.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XjB.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jB.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0079.996] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0079.996] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0079.996] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0079.996] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0079.996] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0079.996] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0079.996] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.996] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0079.997] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.997] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.997] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.997] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.997] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.997] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/xJQWy0H5XjB.bmp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cfa8 [0079.997] FindClose (in: hFindFile=0xa7cfa8 | out: hFindFile=0xa7cfa8) returned 1 [0079.997] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.997] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0079.997] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0079.997] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.997] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0079.997] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.998] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.998] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0079.998] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.998] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0079.998] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.998] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0079.998] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.998] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0079.998] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.998] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.998] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0079.998] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.999] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0079.999] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.999] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.999] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0079.999] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.999] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.999] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.999] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0079.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0079.999] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0079.999] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0079.999] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0079.999] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.000] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0080.000] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0080.000] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0080.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7abf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0080.000] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0080.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0080.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0080.001] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0080.001] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0080.002] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.002] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.002] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0080.002] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.002] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0080.002] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.002] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.002] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.002] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.002] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.002] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.002] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.002] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.002] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.002] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.002] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.003] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.003] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.003] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.003] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.003] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.003] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0080.003] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.003] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0080.003] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.003] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.003] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.003] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.003] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.003] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.003] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.003] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0080.003] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.004] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0080.004] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.004] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.004] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.004] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.004] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.004] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.004] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.004] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.004] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.004] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.004] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.004] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.004] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.004] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.004] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.004] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.005] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.005] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.005] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.005] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.005] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.005] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.005] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.005] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.005] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.005] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.005] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.005] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.005] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e68, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0080.006] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0080.006] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0080.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x39831f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0080.006] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0080.007] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983120, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0080.007] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.007] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.007] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.007] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.007] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.007] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.007] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0080.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a2d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0080.008] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0080.008] CryptHashData (hHash=0xa7d068, pbData=0x39832c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0080.008] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.008] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.008] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.008] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.008] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.008] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.008] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.008] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.008] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.008] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.008] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.008] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.009] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.009] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0080.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a600, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0080.009] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0080.009] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d068, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cb28) returned 1 [0080.009] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.009] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.009] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.009] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.009] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.009] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.009] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.009] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.010] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.010] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.010] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.010] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0080.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0080.010] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0080.010] CryptDestroyHash (hHash=0xa7d068) returned 1 [0080.010] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.010] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.010] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.010] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.010] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.011] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/xJQWy0H5XjB.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xjqwy0h5xjb.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0080.011] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.011] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0080.011] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.011] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.011] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.012] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0080.012] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.xJQWy0H5XjB.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.xjqwy0h5xjb.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0080.055] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.056] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.056] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.056] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.059] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0080.059] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0xff5d, lpOverlapped=0x0) returned 1 [0080.061] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0080.080] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.081] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.081] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.081] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0080.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.082] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0080.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.083] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.083] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.083] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.083] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.083] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.083] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0080.083] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.083] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0080.083] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.083] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.083] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.083] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.083] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.083] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.083] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.083] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.083] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.084] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.084] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.084] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.084] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.084] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.084] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.084] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.084] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.084] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.084] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.084] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.084] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.084] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.085] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.085] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.085] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.086] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a2d0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0080.087] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0080.087] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xff5d, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xff60) returned 1 [0080.087] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.087] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.087] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.087] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.087] CharLowerBuffW (in: lpsz="byte[65376]", cchLength=0xb | out: lpsz="byte[65376]") returned 0xb [0080.087] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.089] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.089] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.089] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.089] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.089] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.089] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.089] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a198, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0080.089] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0080.090] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3984050*, pdwDataLen=0x8bef60*=0xff5d, dwBufLen=0xff60 | out: pbData=0x3984050*, pdwDataLen=0x8bef60*=0xff60) returned 1 [0080.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.093] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.093] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.093] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.093] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.093] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.093] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.093] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.093] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.093] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.093] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.093] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.093] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.093] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.093] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.093] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.093] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.094] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.094] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.094] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.094] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.100] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.100] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.100] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.101] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0xff60, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0xff60, lpOverlapped=0x0) returned 1 [0080.105] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.106] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.106] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0080.106] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.106] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0080.106] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.106] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.106] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.106] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.106] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.106] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.106] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.106] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c92ac0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0080.107] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0080.107] CryptDestroyKey (hKey=0xa7cb28) returned 1 [0080.107] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.107] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.107] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.107] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.107] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.107] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.107] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.107] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.107] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.107] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.108] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.108] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.108] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.129] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.129] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.129] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.129] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.129] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.129] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.129] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.129] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.129] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.129] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.130] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.130] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.130] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.130] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.130] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.130] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.130] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.130] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.130] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.130] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.130] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.130] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.130] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.130] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.130] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.130] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.130] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.131] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.131] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.131] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.131] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.131] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.131] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.131] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.131] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.131] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.131] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.131] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.131] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.131] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0080.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a998, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0080.132] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0080.132] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0080.132] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.132] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.132] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.132] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.132] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.132] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.132] FreeLibrary (hLibModule=0x76a10000) returned 1 [0080.132] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.132] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.132] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.132] CloseHandle (hObject=0x240) returned 1 [0080.133] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.133] CloseHandle (hObject=0x24c) returned 1 [0080.151] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.153] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.154] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0080.154] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0080.154] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/xJQWy0H5XjB.bmp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xJQWy0H5XjB.bmp", lpFilePart=0x8bedf4*="xJQWy0H5XjB.bmp") returned 0x2d [0080.154] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xJQWy0H5XjB.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xjqwy0h5xjb.bmp")) returned 0x20 [0080.154] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xJQWy0H5XjB.bmp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cca8 [0080.154] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xJQWy0H5XjB.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xjqwy0h5xjb.bmp")) returned 1 [0080.162] FindNextFileW (in: hFindFile=0xa7cca8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0080.162] FindClose (in: hFindFile=0xa7cca8 | out: hFindFile=0xa7cca8) returned 1 [0080.162] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.162] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0080.162] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0080.162] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/xJQWy0H5XjB.bmp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xJQWy0H5XjB.bmp", lpFilePart=0x8bf650*="xJQWy0H5XjB.bmp") returned 0x2d [0080.162] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xJQWy0H5XjB.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xjqwy0h5xjb.bmp")) returned 0xffffffff [0080.162] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.162] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.162] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z0fFK_swV0a.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0fFK_swV0a.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fFK_swV0a.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FK_swV0a.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K_swV0a.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_swV0a.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="swV0a.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wV0a.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V0a.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0a.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.163] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z0fFK_swV0a.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0fFK_swV0a.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fFK_swV0a.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FK_swV0a.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K_swV0a.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_swV0a.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="swV0a.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wV0a.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V0a.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0a.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.163] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.163] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0080.163] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0080.163] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0080.163] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0080.163] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf3a8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0080.164] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.164] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0080.164] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.164] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.164] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.164] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.164] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.164] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/z0fFK_swV0a.wav", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cc28 [0080.164] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0080.164] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.164] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.164] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0080.165] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.165] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0080.165] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.165] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.165] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.165] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.165] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.165] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.165] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.165] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.165] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0080.165] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.165] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.165] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0080.165] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.166] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0080.166] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.166] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.166] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.166] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.166] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.166] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.166] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0080.166] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0080.166] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.166] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.166] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0080.166] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.166] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0080.166] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0080.166] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0080.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7acb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0080.167] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0080.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0080.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7abd8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0080.167] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0080.167] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0080.168] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.168] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.168] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0080.168] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.168] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0080.168] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.168] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.168] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.168] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.168] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.168] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.168] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.168] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.168] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.168] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.169] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.169] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.169] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.169] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.169] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.169] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.169] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0080.169] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.169] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0080.169] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.169] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.169] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.169] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.169] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.169] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.169] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.169] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0080.169] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.169] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0080.170] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.170] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.170] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.170] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.171] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.171] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.171] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.171] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.171] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.171] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.171] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.171] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.171] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.171] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.171] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.171] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.171] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.171] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.171] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.171] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.172] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.172] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.172] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.172] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.172] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.172] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.172] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.172] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.172] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c92e68, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0080.172] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0080.172] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0080.173] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.173] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.173] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.173] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x39835a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0080.173] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0080.173] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0080.173] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.173] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.173] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.173] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.245] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.245] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.245] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0080.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a1e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0080.245] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0080.245] CryptHashData (hHash=0xa7cb28, pbData=0x39836e0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0080.246] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.246] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.246] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.246] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.246] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.246] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.246] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.246] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.246] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.246] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.246] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.246] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.246] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.246] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0080.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8a4b0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0080.247] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0080.247] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cb28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cda8) returned 1 [0080.247] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.247] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.247] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.247] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.247] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.247] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.247] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.247] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.247] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.247] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.247] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.247] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0080.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a9f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0080.248] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0080.248] CryptDestroyHash (hHash=0xa7cb28) returned 1 [0080.248] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.248] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.248] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.248] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.248] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.249] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/z0fFK_swV0a.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\z0ffk_swv0a.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0080.249] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.249] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0080.249] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.249] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.249] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.249] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0080.250] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/Lock.z0fFK_swV0a.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lock.z0ffk_swv0a.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0080.250] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.251] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.251] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.251] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.254] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0080.254] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0080.256] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x1285, lpOverlapped=0x0) returned 1 [0080.256] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0080.260] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.261] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.261] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.261] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0080.262] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.262] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0080.263] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.263] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.263] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.263] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.263] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.263] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.263] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.263] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0080.263] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.263] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0080.263] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.263] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.263] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.263] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.263] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.263] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.263] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.263] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.264] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.264] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.264] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.264] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.264] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.264] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.264] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.264] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.264] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.264] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.264] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.264] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.264] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.264] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.264] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.264] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.264] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.267] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a198, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0080.267] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0080.267] CryptEncrypt (in: hKey=0xa7cda8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x11285, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x11288) returned 1 [0080.267] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.267] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.267] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.267] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.267] CharLowerBuffW (in: lpsz="byte[70280]", cchLength=0xb | out: lpsz="byte[70280]") returned 0xb [0080.268] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.269] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.269] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.269] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.269] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.269] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.269] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.269] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a168, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0080.270] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0080.270] CryptEncrypt (in: hKey=0xa7cda8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3984050*, pdwDataLen=0x8bef60*=0x11285, dwBufLen=0x11288 | out: pbData=0x3984050*, pdwDataLen=0x8bef60*=0x11288) returned 1 [0080.272] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.273] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.273] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.273] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.280] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.280] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.280] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.280] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.280] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.280] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.280] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.280] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.280] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.280] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.280] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.280] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.280] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.280] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.280] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.280] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.280] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.280] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.281] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.281] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.281] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.281] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.281] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.287] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.287] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.287] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.288] WriteFile (in: hFile=0x240, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0x11288, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0x11288, lpOverlapped=0x0) returned 1 [0080.293] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.293] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.293] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0080.293] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.293] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0080.293] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.293] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.293] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.293] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.293] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.294] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.294] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.294] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c928b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0080.294] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0080.294] CryptDestroyKey (hKey=0xa7cda8) returned 1 [0080.294] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.294] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.294] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.294] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.294] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.294] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.295] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.295] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.295] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.295] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.295] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.295] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.295] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.295] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.295] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.295] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.295] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.295] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.295] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.295] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.295] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.295] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.295] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.295] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.296] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.296] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.296] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.296] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.296] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.296] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.296] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.296] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.296] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.296] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.296] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.296] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.296] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.296] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.296] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.296] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.296] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.296] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.296] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.297] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.297] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.297] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.297] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.297] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.297] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.297] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.297] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.297] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.297] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0080.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7abb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0080.298] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0080.298] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0080.298] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.298] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.298] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.298] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.298] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.298] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.298] FreeLibrary (hLibModule=0x76a10000) returned 1 [0080.298] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.298] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.298] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.298] CloseHandle (hObject=0x24c) returned 1 [0080.299] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.299] CloseHandle (hObject=0x240) returned 1 [0080.303] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.306] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.306] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0080.306] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0080.306] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/z0fFK_swV0a.wav", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z0fFK_swV0a.wav", lpFilePart=0x8bedf4*="z0fFK_swV0a.wav") returned 0x2d [0080.306] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z0fFK_swV0a.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\z0ffk_swv0a.wav")) returned 0x20 [0080.306] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z0fFK_swV0a.wav", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0080.306] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z0fFK_swV0a.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\z0ffk_swv0a.wav")) returned 1 [0080.314] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0080.314] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0080.314] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.315] CharUpperBuffW (in: lpsz="DesktopDir", cchLength=0xa | out: lpsz="DESKTOPDIR") returned 0xa [0080.315] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8bf438 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0080.315] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop/z0fFK_swV0a.wav", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z0fFK_swV0a.wav", lpFilePart=0x8bf650*="z0fFK_swV0a.wav") returned 0x2d [0080.315] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z0fFK_swV0a.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\z0ffk_swv0a.wav")) returned 0xffffffff [0080.315] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.315] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.315] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.315] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.315] CharUpperBuffW (in: lpsz="A1600E02A1D", cchLength=0xb | out: lpsz="A1600E02A1D") returned 0xb [0080.315] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0080.315] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf2b8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0080.315] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.315] CharUpperBuffW (in: lpsz="SSA1600E02A1D", cchLength=0xd | out: lpsz="SSA1600E02A1D") returned 0xd [0080.315] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.315] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.316] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0080.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x2c91ed8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/]+\\z", lpUsedDefaultChar=0x0) returned 9 [0080.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0080.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming", cchWideChar=38, lpMultiByteStr=0x2c075f8, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming", lpUsedDefaultChar=0x0) returned 38 [0080.316] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.316] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0080.316] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0080.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x2c7a9b8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", lpUsedDefaultChar=0x0) returned 23 [0080.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x2c83830, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.*", lpUsedDefaultChar=0x0) returned 4 [0080.316] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.316] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.316] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming\\*.*", lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0xa7cb28 [0080.317] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.317] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.317] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.317] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.317] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.317] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.317] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.317] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.317] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.317] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.317] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.317] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.317] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.317] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.317] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.317] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.337] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.337] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.337] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.337] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.337] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.337] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.337] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.337] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.337] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.337] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.338] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.339] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.339] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.340] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.341] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.342] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.343] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.343] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.343] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.343] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.343] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.343] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.343] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.343] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.343] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.343] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.343] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.343] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.343] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.343] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.348] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.348] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.348] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.348] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.348] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.348] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.348] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.348] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.349] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.349] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.349] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.349] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.349] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.349] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.349] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.349] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.349] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.349] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.349] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.349] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.349] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.349] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.349] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.350] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.350] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.350] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.350] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.350] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.350] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.350] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.350] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.350] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.351] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.352] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.353] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.354] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.354] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.355] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.355] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.355] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.355] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.355] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.355] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.355] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.355] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.355] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.355] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.355] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0080.355] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.355] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.410] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.410] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.410] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.410] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0 [0080.411] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.411] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.411] FindClose (in: hFindFile=0xa7cb28 | out: hFindFile=0xa7cb28) returned 1 [0080.411] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.411] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0080.411] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.411] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.411] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.411] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="07iDkNP.swf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.411] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7iDkNP.swf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.411] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iDkNP.swf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.411] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DkNP.swf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.412] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kNP.swf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.412] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NP.swf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.412] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P.swf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.412] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.412] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="07iDkNP.swf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.412] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7iDkNP.swf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.412] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iDkNP.swf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.412] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DkNP.swf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.412] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kNP.swf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.412] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NP.swf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.412] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.412] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0080.412] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0080.412] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0080.412] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0080.412] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0080.412] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.412] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0080.412] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.413] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.413] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.413] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.413] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.413] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/07iDkNP.swf", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cf68 [0080.413] FindClose (in: hFindFile=0xa7cf68 | out: hFindFile=0xa7cf68) returned 1 [0080.413] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.413] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.413] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0080.413] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.413] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0080.413] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.414] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.414] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.414] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.414] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0080.414] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0080.414] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0080.414] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0080.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0080.414] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.414] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.414] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0080.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0080.415] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0080.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0080.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0080.415] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0080.415] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0080.416] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.416] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.416] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0080.416] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.416] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0080.416] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.416] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.416] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.416] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.416] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.416] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.417] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.417] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.417] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.417] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.417] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.417] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.417] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.417] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.417] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.417] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.417] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0080.417] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.417] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0080.417] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.417] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.417] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.417] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.418] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.418] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.418] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.418] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0080.418] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.418] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0080.418] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.418] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.418] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.418] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.418] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.418] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.418] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.418] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.418] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.418] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.418] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.419] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.419] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.419] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.419] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.419] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.419] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.419] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.419] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.419] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.419] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.419] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.419] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.419] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.419] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.419] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.419] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.419] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.420] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8aed0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0080.420] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0080.420] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0080.420] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.420] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.420] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.420] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983be0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0080.420] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0080.420] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0080.421] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.421] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.421] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.421] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.421] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.421] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.421] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0080.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8adb0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0080.421] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0080.421] CryptHashData (hHash=0xa7d0e8, pbData=0x3983be0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0080.421] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.422] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.422] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.422] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.422] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.422] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.422] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.471] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.471] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.471] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.471] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.471] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.471] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.471] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0080.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b4e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0080.471] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0080.472] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d0e8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cee8) returned 1 [0080.472] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.472] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.472] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.472] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.472] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.472] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.472] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.472] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.472] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.472] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.472] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.472] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0080.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0080.473] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0080.473] CryptDestroyHash (hHash=0xa7d0e8) returned 1 [0080.473] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.473] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/07iDkNP.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\07idknp.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0080.473] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.473] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0080.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.474] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.474] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0080.474] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.07iDkNP.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.07idknp.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0080.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.486] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0080.486] ReadFile (in: hFile=0x240, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0080.487] ReadFile (in: hFile=0x240, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0x2c43, lpOverlapped=0x0) returned 1 [0080.488] ReadFile (in: hFile=0x240, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0080.491] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.491] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.491] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.491] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0080.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.493] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0080.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.493] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.493] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0080.493] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.494] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0080.494] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.494] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.494] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.494] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.494] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.494] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.494] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.494] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.494] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.494] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.494] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.494] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.494] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.494] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.494] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.494] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.494] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.494] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.494] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.494] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.494] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.495] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.495] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.495] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.495] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.495] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b170, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0080.496] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0080.496] CryptEncrypt (in: hKey=0xa7cee8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x12c43, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x12c48) returned 1 [0080.496] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.496] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.496] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.496] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.496] CharLowerBuffW (in: lpsz="byte[76872]", cchLength=0xb | out: lpsz="byte[76872]") returned 0xb [0080.496] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.497] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.497] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.498] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.498] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.498] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.498] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.498] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0080.498] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0080.498] CryptEncrypt (in: hKey=0xa7cee8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3996ca0*, pdwDataLen=0x8bef60*=0x12c43, dwBufLen=0x12c48 | out: pbData=0x3996ca0*, pdwDataLen=0x8bef60*=0x12c48) returned 1 [0080.501] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.501] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.501] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.501] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.501] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.501] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.502] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.502] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.502] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.502] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.502] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.502] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.502] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.502] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.502] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.502] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.502] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.502] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.502] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.502] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.502] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.502] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.502] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.502] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.502] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.502] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.503] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.508] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.508] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.508] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.509] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb67d8*, nNumberOfBytesToWrite=0x12c48, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb67d8*, lpNumberOfBytesWritten=0x8bf5e4*=0x12c48, lpOverlapped=0x0) returned 1 [0080.511] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.511] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.511] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0080.511] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.511] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0080.511] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.511] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.511] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.511] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.511] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.511] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.511] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.511] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8abe8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0080.512] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0080.512] CryptDestroyKey (hKey=0xa7cee8) returned 1 [0080.512] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.512] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.512] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.512] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.517] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.517] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.517] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.517] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.517] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.517] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.517] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.517] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.517] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.518] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.518] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.518] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.518] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.518] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.518] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.518] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.518] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.518] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.518] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.518] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.518] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.518] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.518] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.518] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.518] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.518] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.518] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.518] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.518] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.518] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.519] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.519] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.519] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.519] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.519] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.519] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.519] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.519] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.519] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.519] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.519] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.519] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.519] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.519] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.519] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.519] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.519] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.519] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.519] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0080.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7abd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0080.520] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0080.520] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0080.520] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.520] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.520] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.520] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.520] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.520] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.520] FreeLibrary (hLibModule=0x76a10000) returned 1 [0080.520] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.520] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.520] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.520] CloseHandle (hObject=0x240) returned 1 [0080.522] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.522] CloseHandle (hObject=0x24c) returned 1 [0080.528] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.531] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.531] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0080.531] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0080.531] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/07iDkNP.swf", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\07iDkNP.swf", lpFilePart=0x8bedf4*="07iDkNP.swf") returned 0x31 [0080.531] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\07iDkNP.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\07idknp.swf")) returned 0x20 [0080.531] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\07iDkNP.swf", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cee8 [0080.532] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\07iDkNP.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\07idknp.swf")) returned 1 [0080.537] FindNextFileW (in: hFindFile=0xa7cee8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0080.537] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0080.538] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.538] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0080.538] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0080.538] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/07iDkNP.swf", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\07iDkNP.swf", lpFilePart=0x8bf650*="07iDkNP.swf") returned 0x31 [0080.538] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\07iDkNP.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\07idknp.swf")) returned 0xffffffff [0080.538] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.538] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.538] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.538] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2k9SgaKkgk9oGZO2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.538] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k9SgaKkgk9oGZO2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.538] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9SgaKkgk9oGZO2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.538] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SgaKkgk9oGZO2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.538] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gaKkgk9oGZO2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.538] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aKkgk9oGZO2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.538] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Kkgk9oGZO2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.538] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kgk9oGZO2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.538] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gk9oGZO2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.538] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k9oGZO2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9oGZO2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oGZO2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GZO2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZO2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eWO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WO.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.539] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2k9SgaKkgk9oGZO2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k9SgaKkgk9oGZO2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9SgaKkgk9oGZO2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SgaKkgk9oGZO2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gaKkgk9oGZO2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aKkgk9oGZO2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Kkgk9oGZO2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kgk9oGZO2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gk9oGZO2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k9oGZO2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9oGZO2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oGZO2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GZO2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZO2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eWO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WO.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.540] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.540] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0080.540] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0080.540] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0080.540] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0080.540] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0080.540] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.540] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0080.540] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.540] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.540] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.540] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.540] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.540] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/2k9SgaKkgk9oGZO2eWO.wav", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cf68 [0080.541] FindClose (in: hFindFile=0xa7cf68 | out: hFindFile=0xa7cf68) returned 1 [0080.541] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.541] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.541] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0080.541] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.541] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0080.541] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.541] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.541] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.541] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.541] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.541] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.541] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.541] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.541] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0080.541] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.541] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.541] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0080.542] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.542] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0080.542] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.542] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.542] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.542] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.542] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.542] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.542] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0080.542] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0080.542] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.542] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.542] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0080.542] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.542] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0080.542] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0080.542] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0080.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0080.542] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0080.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0080.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0080.543] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0080.543] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0080.543] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.543] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.543] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0080.543] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.543] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0080.544] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.544] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.544] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.544] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.544] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.544] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.544] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.544] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.544] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.544] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.544] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.544] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.544] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.544] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.544] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.544] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.544] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0080.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.544] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0080.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.545] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.545] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.546] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.546] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.546] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0080.546] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.546] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0080.546] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.546] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.546] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.546] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.546] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.546] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.547] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.547] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.547] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.547] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.547] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.547] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.547] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.547] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.547] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.547] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.547] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.547] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.547] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.547] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.547] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.547] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.547] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.548] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.548] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.548] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.548] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.548] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.548] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0080.548] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0080.548] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0080.548] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.548] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.548] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.548] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0080.549] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0080.549] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ba0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0080.549] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.549] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.549] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.549] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.549] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.549] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.549] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0080.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8adb0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0080.550] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0080.550] CryptHashData (hHash=0xa7d0e8, pbData=0x3983c60, dwDataLen=0x3, dwFlags=0x1) returned 1 [0080.550] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.550] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.550] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.550] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.550] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.550] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.550] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.550] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.550] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.550] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.550] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.550] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.550] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.550] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0080.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b4e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0080.551] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0080.551] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d0e8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cf68) returned 1 [0080.551] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.551] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.551] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.551] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.551] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.551] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.551] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.551] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.551] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.551] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.551] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.551] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0080.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0080.552] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0080.552] CryptDestroyHash (hHash=0xa7d0e8) returned 1 [0080.552] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.552] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.552] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.552] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.552] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.553] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/2k9SgaKkgk9oGZO2eWO.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\2k9sgakkgk9ogzo2ewo.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0080.553] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.553] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0080.553] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.554] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0080.554] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.2k9SgaKkgk9oGZO2eWO.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.2k9sgakkgk9ogzo2ewo.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0080.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.557] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0080.557] ReadFile (in: hFile=0x24c, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0x1cbb, lpOverlapped=0x0) returned 1 [0080.557] ReadFile (in: hFile=0x24c, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0080.560] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.560] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.560] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.560] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0080.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.561] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0080.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.561] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0080.561] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.561] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0080.561] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.561] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.561] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.561] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.561] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.561] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.562] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.562] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.562] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.562] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.562] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.562] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.562] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.562] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.562] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.562] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.562] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.562] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.562] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.562] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.562] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.562] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.562] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.562] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.562] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.563] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b1b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0080.563] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0080.563] CryptEncrypt (in: hKey=0xa7cf68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x1cbb, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x1cc0) returned 1 [0080.564] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.564] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.564] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.564] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.564] CharLowerBuffW (in: lpsz="byte[7360]", cchLength=0xa | out: lpsz="byte[7360]") returned 0xa [0080.564] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.564] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.564] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.564] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.567] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.567] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.567] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.567] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b140, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0080.567] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0080.567] CryptEncrypt (in: hKey=0xa7cf68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cbbe30*, pdwDataLen=0x8bef60*=0x1cbb, dwBufLen=0x1cc0 | out: pbData=0x2cbbe30*, pdwDataLen=0x8bef60*=0x1cc0) returned 1 [0080.567] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.568] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.568] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.568] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.568] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.568] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.568] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.568] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.568] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.568] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.568] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.568] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.568] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.568] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.568] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.568] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.568] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.568] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.568] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.568] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.568] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.568] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.569] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.569] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.569] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.569] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.569] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.569] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.569] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.569] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.569] WriteFile (in: hFile=0x240, lpBuffer=0x2cb84a0*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb84a0*, lpNumberOfBytesWritten=0x8bf5e4*=0x1cc0, lpOverlapped=0x0) returned 1 [0080.570] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.570] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.570] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0080.570] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.570] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0080.570] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.570] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.570] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.570] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.570] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.570] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.570] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.571] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac60, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0080.571] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0080.571] CryptDestroyKey (hKey=0xa7cf68) returned 1 [0080.571] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.571] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.571] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.571] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.571] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.571] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.571] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.571] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.571] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.571] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.572] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.572] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.572] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.572] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.572] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.572] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.572] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.572] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.572] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.572] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.572] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.572] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.572] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.572] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.572] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.572] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.572] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.572] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.572] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.573] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.573] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.573] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.573] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.573] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.573] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.573] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.573] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.573] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.573] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.573] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.573] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.573] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.573] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.573] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.573] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.573] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.573] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.573] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.574] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.574] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.574] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.574] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.574] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0080.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0080.574] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0080.574] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0080.574] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.574] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.574] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.574] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.574] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.575] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.575] FreeLibrary (hLibModule=0x76a10000) returned 1 [0080.575] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.575] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.575] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.575] CloseHandle (hObject=0x24c) returned 1 [0080.576] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.576] CloseHandle (hObject=0x240) returned 1 [0080.579] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.580] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.580] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0080.580] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0080.580] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/2k9SgaKkgk9oGZO2eWO.wav", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2k9SgaKkgk9oGZO2eWO.wav", lpFilePart=0x8bedf4*="2k9SgaKkgk9oGZO2eWO.wav") returned 0x3d [0080.580] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2k9SgaKkgk9oGZO2eWO.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\2k9sgakkgk9ogzo2ewo.wav")) returned 0x20 [0080.580] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2k9SgaKkgk9oGZO2eWO.wav", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cc28 [0080.581] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2k9SgaKkgk9oGZO2eWO.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\2k9sgakkgk9ogzo2ewo.wav")) returned 1 [0080.598] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0080.598] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0080.598] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.598] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0080.598] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0080.598] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/2k9SgaKkgk9oGZO2eWO.wav", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2k9SgaKkgk9oGZO2eWO.wav", lpFilePart=0x8bf650*="2k9SgaKkgk9oGZO2eWO.wav") returned 0x3d [0080.598] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2k9SgaKkgk9oGZO2eWO.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\2k9sgakkgk9ogzo2ewo.wav")) returned 0xffffffff [0080.598] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.599] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.599] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3- s1lsS.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="- s1lsS.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" s1lsS.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s1lsS.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1lsS.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lsS.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sS.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0080.599] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3- s1lsS.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="- s1lsS.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" s1lsS.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s1lsS.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1lsS.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lsS.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sS.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0080.599] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.599] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0080.599] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0080.599] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0080.599] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0080.600] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0080.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.600] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0080.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.600] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/3- s1lsS.gif", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cfa8 [0080.600] FindClose (in: hFindFile=0xa7cfa8 | out: hFindFile=0xa7cfa8) returned 1 [0080.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.600] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0080.600] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.601] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0080.601] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.601] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.601] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.601] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.601] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.601] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.601] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.614] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.614] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0080.614] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.614] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.614] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0080.614] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.614] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0080.614] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.614] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.614] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.614] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.615] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.615] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.615] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0080.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0080.615] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.615] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.615] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0080.615] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.615] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0080.615] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0080.615] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0080.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0080.615] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0080.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0080.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac78, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0080.616] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0080.616] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0080.616] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.617] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.617] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0080.617] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.617] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0080.617] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.617] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.617] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.617] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.617] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.617] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.617] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.617] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.617] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.617] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.617] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.617] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.617] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.617] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.617] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.618] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.618] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0080.618] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.618] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0080.618] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.618] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.618] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.618] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.618] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.618] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.618] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.618] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0080.618] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.618] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0080.618] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.618] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.618] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.618] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.619] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.619] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.619] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.619] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.619] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.619] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.619] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.619] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.619] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.619] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.619] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.619] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.619] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.619] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.619] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.619] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.619] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.619] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.619] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.620] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.620] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.620] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.620] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.620] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.620] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0080.620] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0080.620] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0080.620] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.620] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.620] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.620] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0080.621] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0080.621] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c20, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0080.621] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.621] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.621] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.621] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.621] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.621] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.621] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0080.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8adb0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0080.622] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0080.622] CryptHashData (hHash=0xa7ce28, pbData=0x3983cd0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0080.622] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.622] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.622] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.622] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.622] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.622] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.622] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.622] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.622] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.622] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.622] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.622] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.622] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.622] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0080.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0080.623] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0080.623] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7ce28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7c9a8) returned 1 [0080.623] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.623] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.623] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.623] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.623] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.623] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.623] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.623] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.623] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.623] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.623] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0080.623] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0080.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7acb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0080.624] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0080.624] CryptDestroyHash (hHash=0xa7ce28) returned 1 [0080.624] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.624] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.624] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.624] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.624] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.624] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/3- s1lsS.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\3- s1lss.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0080.628] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.628] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0080.628] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.628] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.628] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.628] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0080.629] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.3- s1lsS.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.3- s1lss.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0080.629] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.629] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.629] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.629] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.632] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0080.632] ReadFile (in: hFile=0x240, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0xe962, lpOverlapped=0x0) returned 1 [0080.634] ReadFile (in: hFile=0x240, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0080.638] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.647] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.647] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.647] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0080.649] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.649] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0080.649] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.649] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.649] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.649] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.649] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.649] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.649] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.649] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0080.649] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.649] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0080.649] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.649] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.649] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.649] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.650] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.650] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.650] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.650] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.650] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.650] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0080.650] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.650] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0080.650] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.650] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.650] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.650] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.650] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.650] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.650] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.650] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.650] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.650] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.650] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.650] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.651] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.652] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b218, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0080.653] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0080.653] CryptEncrypt (in: hKey=0xa7c9a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xe962, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xe968) returned 1 [0080.653] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.653] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.653] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.653] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.653] CharLowerBuffW (in: lpsz="byte[59752]", cchLength=0xb | out: lpsz="byte[59752]") returned 0xb [0080.653] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.654] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.654] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.654] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.654] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.655] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.655] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0080.655] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b0b0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0080.655] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0080.655] CryptEncrypt (in: hKey=0xa7c9a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3984050*, pdwDataLen=0x8bef60*=0xe962, dwBufLen=0xe968 | out: pbData=0x3984050*, pdwDataLen=0x8bef60*=0xe968) returned 1 [0080.658] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.658] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.658] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.658] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.659] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.659] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.659] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.659] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.659] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.659] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.659] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.659] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.659] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.659] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.659] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.659] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.659] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.659] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0080.659] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.659] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.659] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.659] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.659] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.660] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0080.660] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.660] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0080.660] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0080.665] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.665] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.665] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.666] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb67d8*, nNumberOfBytesToWrite=0xe968, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb67d8*, lpNumberOfBytesWritten=0x8bf5e4*=0xe968, lpOverlapped=0x0) returned 1 [0080.668] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.668] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.668] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0080.668] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.668] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0080.668] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.669] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.669] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.669] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.669] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.669] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.669] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0080.669] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac48, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0080.669] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0080.669] CryptDestroyKey (hKey=0xa7c9a8) returned 1 [0080.669] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.669] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.669] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.669] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.670] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.670] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.670] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.670] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.670] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.670] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.670] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.670] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.670] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0080.670] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.670] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.670] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.670] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.670] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.670] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0080.670] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.670] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0080.670] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.670] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0080.671] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.671] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0080.671] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.671] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0080.671] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.671] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.671] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0080.671] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.671] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0080.671] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.671] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.671] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0080.671] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.671] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0080.671] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.671] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0080.671] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.671] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0080.730] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.730] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.730] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.730] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.730] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.731] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.731] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0080.731] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.731] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0080.731] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.731] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.731] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0080.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a998, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0080.731] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0080.731] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0080.731] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.732] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0080.732] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.732] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0080.732] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.732] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0080.732] FreeLibrary (hLibModule=0x76a10000) returned 1 [0080.732] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.732] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0080.732] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.732] CloseHandle (hObject=0x240) returned 1 [0080.734] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.734] CloseHandle (hObject=0x24c) returned 1 [0080.740] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0080.743] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0080.743] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0080.743] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0080.743] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/3- s1lsS.gif", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3- s1lsS.gif", lpFilePart=0x8bedf4*="3- s1lsS.gif") returned 0x32 [0080.743] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3- s1lsS.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\3- s1lss.gif")) returned 0x20 [0080.743] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3- s1lsS.gif", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0080.743] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3- s1lsS.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\3- s1lss.gif")) returned 1 [0081.050] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0081.050] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0081.050] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 1 [0081.050] TranslateMessage (lpMsg=0x8bf968) returned 0 [0081.050] DispatchMessageW (lpMsg=0x8bf968) returned 0x0 [0081.050] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0081.050] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0081.050] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.050] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.050] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.051] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/3- s1lsS.gif", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3- s1lsS.gif", lpFilePart=0x8bf650*="3- s1lsS.gif") returned 0x32 [0081.051] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3- s1lsS.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\3- s1lss.gif")) returned 0xffffffff [0081.051] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.051] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.051] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4hX BzG8K.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hX BzG8K.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X BzG8K.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" BzG8K.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BzG8K.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zG8K.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G8K.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8K.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.051] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4hX BzG8K.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hX BzG8K.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X BzG8K.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" BzG8K.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BzG8K.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zG8K.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G8K.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8K.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.051] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.051] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0081.051] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.052] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.052] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.052] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.052] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.052] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0081.052] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.052] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.052] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.052] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.052] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.052] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/4hX BzG8K.gif", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d068 [0081.052] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0081.052] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.053] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.053] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0081.053] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.053] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0081.053] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.053] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.053] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.053] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.053] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.053] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.053] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.053] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.053] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0081.053] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.053] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.053] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0081.053] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.054] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0081.054] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.054] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.054] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.054] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.054] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.054] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.054] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0081.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0081.054] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.054] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.054] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0081.054] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.054] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0081.054] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0081.054] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0081.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0081.055] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0081.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0081.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7acd8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0081.055] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0081.055] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0081.056] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.056] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.056] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0081.056] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.056] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0081.056] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.056] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.056] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.056] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.056] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.056] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.056] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0081.057] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.057] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0081.057] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.057] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.057] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.057] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.057] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.057] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.057] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.057] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0081.057] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.057] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0081.057] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.057] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.057] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.057] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.057] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.057] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.057] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.057] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0081.058] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.058] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0081.058] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.058] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.058] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.058] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.058] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.058] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.058] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.058] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.058] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.058] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0081.058] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.058] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0081.058] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.058] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.058] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.058] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.059] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.059] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.059] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.059] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.059] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.059] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.059] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.059] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0081.059] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.059] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0081.059] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.059] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.059] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8aea0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0081.060] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0081.060] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0081.060] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.060] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.060] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.060] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0081.060] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0081.060] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c50, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0081.060] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.060] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.061] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.061] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.061] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.061] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.061] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0081.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8ae40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0081.061] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0081.061] CryptHashData (hHash=0xa7d0e8, pbData=0x3983b60, dwDataLen=0x3, dwFlags=0x1) returned 1 [0081.061] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.061] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.061] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.061] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.061] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.061] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.061] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.062] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.062] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0081.062] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.062] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0081.062] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.062] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.062] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0081.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b3c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0081.062] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0081.062] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d0e8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d168) returned 1 [0081.062] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.062] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.063] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.063] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.063] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.063] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.126] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.126] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0081.126] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.126] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0081.126] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0081.126] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0081.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0081.127] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0081.127] CryptDestroyHash (hHash=0xa7d0e8) returned 1 [0081.127] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.127] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.127] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.127] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.127] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.128] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/4hX BzG8K.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\4hx bzg8k.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0081.129] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.129] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0081.129] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.129] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.129] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.129] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0081.129] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.4hX BzG8K.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.4hx bzg8k.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0081.130] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.130] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.130] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.130] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.133] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0081.133] ReadFile (in: hFile=0x24c, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0081.135] ReadFile (in: hFile=0x24c, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0x3d6, lpOverlapped=0x0) returned 1 [0081.135] ReadFile (in: hFile=0x24c, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0081.140] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.140] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.140] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.140] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0081.141] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.141] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0081.141] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.141] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.141] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.141] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.141] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.141] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.141] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.141] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0081.142] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.142] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0081.142] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.142] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.142] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.142] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.142] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.142] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.142] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.142] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.142] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.142] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0081.142] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.142] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0081.142] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.142] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.143] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.143] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.143] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.143] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.143] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.143] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.143] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.143] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.143] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.143] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.143] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.145] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0081.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b218, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0081.146] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0081.146] CryptEncrypt (in: hKey=0xa7d168, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x103d6, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x103d8) returned 1 [0081.146] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.146] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.146] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.146] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.146] CharLowerBuffW (in: lpsz="byte[66520]", cchLength=0xb | out: lpsz="byte[66520]") returned 0xb [0081.146] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.148] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.148] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.148] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0081.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b1b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0081.149] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0081.149] CryptEncrypt (in: hKey=0xa7d168, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3984050*, pdwDataLen=0x8bef60*=0x103d6, dwBufLen=0x103d8 | out: pbData=0x3984050*, pdwDataLen=0x8bef60*=0x103d8) returned 1 [0081.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.152] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0081.152] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.152] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0081.152] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.152] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.152] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0081.152] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.152] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0081.152] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.152] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.153] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.153] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.153] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.153] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.153] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.153] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.153] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.153] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.153] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.153] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.158] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.159] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.159] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.160] WriteFile (in: hFile=0x240, lpBuffer=0x2cb67d8*, nNumberOfBytesToWrite=0x103d8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb67d8*, lpNumberOfBytesWritten=0x8bf5e4*=0x103d8, lpOverlapped=0x0) returned 1 [0081.162] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.162] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.162] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0081.162] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.162] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0081.162] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.162] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.162] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.163] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0081.163] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.163] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0081.163] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0081.163] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac48, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0081.163] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0081.163] CryptDestroyKey (hKey=0xa7d168) returned 1 [0081.163] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.163] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.163] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0081.163] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.163] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0081.163] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.164] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.164] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0081.164] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0081.164] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0081.164] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0081.164] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0081.164] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0081.205] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.205] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.205] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0081.205] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.205] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0081.205] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0081.205] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.205] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.205] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.205] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.205] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.205] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0081.205] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.205] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0081.205] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.206] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.206] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0081.206] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.206] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0081.206] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.206] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.206] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.206] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.206] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.206] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.206] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.206] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.206] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.206] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.206] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.206] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.206] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.206] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.206] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.206] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0081.207] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.207] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0081.207] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.207] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.207] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0081.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0081.207] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0081.207] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0081.207] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.207] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.207] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.207] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.207] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.208] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.208] FreeLibrary (hLibModule=0x76a10000) returned 1 [0081.208] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.208] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.208] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.208] CloseHandle (hObject=0x24c) returned 1 [0081.210] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.210] CloseHandle (hObject=0x240) returned 1 [0081.213] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.216] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.216] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.216] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.216] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/4hX BzG8K.gif", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4hX BzG8K.gif", lpFilePart=0x8bedf4*="4hX BzG8K.gif") returned 0x33 [0081.216] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4hX BzG8K.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\4hx bzg8k.gif")) returned 0x20 [0081.216] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4hX BzG8K.gif", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0081.217] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4hX BzG8K.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\4hx bzg8k.gif")) returned 1 [0081.362] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0081.362] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0081.363] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.363] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.363] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.363] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/4hX BzG8K.gif", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4hX BzG8K.gif", lpFilePart=0x8bf650*="4hX BzG8K.gif") returned 0x33 [0081.363] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4hX BzG8K.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\4hx bzg8k.gif")) returned 0xffffffff [0081.363] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.363] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.363] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ihl59F1EW3Dmio30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ihl59F1EW3Dmio30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hl59F1EW3Dmio30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l59F1EW3Dmio30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="59F1EW3Dmio30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9F1EW3Dmio30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F1EW3Dmio30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1EW3Dmio30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EW3Dmio30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W3Dmio30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3Dmio30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dmio30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mio30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="io30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="30.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.364] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ihl59F1EW3Dmio30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ihl59F1EW3Dmio30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hl59F1EW3Dmio30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l59F1EW3Dmio30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="59F1EW3Dmio30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9F1EW3Dmio30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F1EW3Dmio30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1EW3Dmio30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EW3Dmio30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W3Dmio30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3Dmio30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dmio30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mio30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="io30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.364] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="30.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.364] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.364] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0081.364] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.364] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.364] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.364] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.364] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.364] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0081.364] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.364] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.364] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.365] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.365] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.365] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/6Ihl59F1EW3Dmio30.mp3", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cfa8 [0081.365] FindClose (in: hFindFile=0xa7cfa8 | out: hFindFile=0xa7cfa8) returned 1 [0081.365] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.365] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.365] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0081.365] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.365] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0081.365] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.365] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.365] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.365] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.365] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.365] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.365] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.365] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.365] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0081.366] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.366] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.366] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0081.366] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.366] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0081.366] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.366] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.366] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.366] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.366] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.366] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.366] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0081.366] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0081.366] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.366] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.366] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0081.367] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.367] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0081.367] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0081.367] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0081.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0081.367] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0081.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0081.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac78, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0081.367] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0081.367] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0081.368] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.368] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.368] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0081.368] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.368] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0081.368] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.368] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.368] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.368] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.368] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.368] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.368] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0081.368] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.368] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0081.368] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.369] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.369] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.369] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.369] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.369] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.369] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.369] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0081.369] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.369] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0081.369] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.369] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.369] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.369] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.369] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.369] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.369] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.369] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0081.369] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.369] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0081.369] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.369] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.369] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.370] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.436] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.436] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.436] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.436] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.436] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.436] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0081.436] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.437] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0081.437] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.437] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.437] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.437] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.437] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.437] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.437] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.437] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.437] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.437] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.437] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.437] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0081.437] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.437] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0081.437] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.437] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.437] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0081.438] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0081.438] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0081.439] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.439] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.439] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.439] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0081.439] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0081.439] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c20, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0081.439] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.439] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.439] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.439] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.439] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.439] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.440] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0081.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8aee8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0081.440] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0081.440] CryptHashData (hHash=0xa7ce28, pbData=0x3983b00, dwDataLen=0x3, dwFlags=0x1) returned 1 [0081.440] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.440] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.440] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.440] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.440] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.440] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.440] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.440] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.440] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0081.441] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.441] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0081.441] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.441] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.441] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0081.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0081.441] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0081.441] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7ce28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cc28) returned 1 [0081.441] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.441] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.441] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.441] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.441] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.441] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.442] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.442] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0081.442] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.442] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0081.442] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0081.442] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0081.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0081.442] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0081.442] CryptDestroyHash (hHash=0xa7ce28) returned 1 [0081.442] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.442] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.442] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.442] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.443] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.444] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/6Ihl59F1EW3Dmio30.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6ihl59f1ew3dmio30.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0081.444] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.444] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0081.444] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.444] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.444] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.444] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0081.445] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.6Ihl59F1EW3Dmio30.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.6ihl59f1ew3dmio30.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0081.445] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.445] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.445] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.445] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.448] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0081.448] ReadFile (in: hFile=0x240, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0x5671, lpOverlapped=0x0) returned 1 [0081.449] ReadFile (in: hFile=0x240, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0081.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.453] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0081.453] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.453] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0081.474] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.474] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.474] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.474] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.474] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.474] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.474] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.474] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0081.474] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.474] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0081.475] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.475] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.475] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.475] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.475] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.475] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.475] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.475] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.475] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.475] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0081.475] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.475] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0081.475] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.475] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.475] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.475] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.475] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.476] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.476] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.476] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.476] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.476] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.476] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.476] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.476] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.476] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0081.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b260, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0081.477] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0081.477] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x5671, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x5678) returned 1 [0081.477] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.477] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.477] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.477] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.477] CharLowerBuffW (in: lpsz="byte[22136]", cchLength=0xb | out: lpsz="byte[22136]") returned 0xb [0081.477] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.478] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.478] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.478] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.478] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.478] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.478] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.478] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0081.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0081.478] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0081.478] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cc6b58*, pdwDataLen=0x8bef60*=0x5671, dwBufLen=0x5678 | out: pbData=0x2cc6b58*, pdwDataLen=0x8bef60*=0x5678) returned 1 [0081.479] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.479] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.479] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.479] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.489] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.489] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.489] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.489] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0081.489] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.489] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0081.489] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.489] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.489] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0081.489] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.489] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0081.489] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.489] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.489] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.489] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.489] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.489] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.490] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.490] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.490] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.490] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.490] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.490] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.492] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.492] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.492] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.492] WriteFile (in: hFile=0x24c, lpBuffer=0x2ccd1e0*, nNumberOfBytesToWrite=0x5678, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2ccd1e0*, lpNumberOfBytesWritten=0x8bf5e4*=0x5678, lpOverlapped=0x0) returned 1 [0081.494] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.494] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.494] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0081.494] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.494] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0081.494] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.494] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.494] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.494] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0081.494] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.494] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0081.494] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0081.494] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac60, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0081.495] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0081.495] CryptDestroyKey (hKey=0xa7cc28) returned 1 [0081.495] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.495] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.495] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0081.495] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.495] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0081.495] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.495] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.495] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0081.495] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0081.495] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0081.496] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0081.496] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0081.496] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0081.496] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.496] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.496] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0081.496] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.496] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0081.496] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0081.496] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.496] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.496] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.496] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.496] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.496] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0081.496] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.496] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0081.496] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.496] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.497] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0081.497] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.497] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0081.497] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.497] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.497] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.497] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.497] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.497] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.497] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.497] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.497] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.497] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.497] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.497] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.497] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.497] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.497] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.498] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0081.498] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.498] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0081.498] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.498] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.498] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0081.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a9d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0081.498] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0081.498] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0081.498] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.498] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.498] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.498] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.499] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.499] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.499] FreeLibrary (hLibModule=0x76a10000) returned 1 [0081.499] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.499] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.499] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.499] CloseHandle (hObject=0x240) returned 1 [0081.500] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.500] CloseHandle (hObject=0x24c) returned 1 [0081.561] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.561] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.561] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.561] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.561] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/6Ihl59F1EW3Dmio30.mp3", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6Ihl59F1EW3Dmio30.mp3", lpFilePart=0x8bedf4*="6Ihl59F1EW3Dmio30.mp3") returned 0x3b [0081.562] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6Ihl59F1EW3Dmio30.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6ihl59f1ew3dmio30.mp3")) returned 0x20 [0081.562] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6Ihl59F1EW3Dmio30.mp3", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0081.562] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6Ihl59F1EW3Dmio30.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6ihl59f1ew3dmio30.mp3")) returned 1 [0081.569] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0081.570] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0081.570] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.570] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.570] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.570] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/6Ihl59F1EW3Dmio30.mp3", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6Ihl59F1EW3Dmio30.mp3", lpFilePart=0x8bf650*="6Ihl59F1EW3Dmio30.mp3") returned 0x3b [0081.570] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6Ihl59F1EW3Dmio30.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6ihl59f1ew3dmio30.mp3")) returned 0xffffffff [0081.570] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.570] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.570] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6x1noCxpBp1mmFoeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x1noCxpBp1mmFoeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1noCxpBp1mmFoeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="noCxpBp1mmFoeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oCxpBp1mmFoeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CxpBp1mmFoeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xpBp1mmFoeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pBp1mmFoeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Bp1mmFoeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p1mmFoeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mmFoeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mmFoeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mFoeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FoeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oeCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eCN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CN6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.571] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6x1noCxpBp1mmFoeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x1noCxpBp1mmFoeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1noCxpBp1mmFoeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="noCxpBp1mmFoeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oCxpBp1mmFoeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CxpBp1mmFoeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xpBp1mmFoeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pBp1mmFoeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Bp1mmFoeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p1mmFoeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mmFoeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mmFoeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mFoeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FoeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oeCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eCN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CN6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6T.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.572] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.572] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0081.572] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.572] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.572] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.572] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.572] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.572] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0081.572] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.572] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.572] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.573] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.573] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.573] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/6x1noCxpBp1mmFoeCN6T.png", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7ce28 [0081.573] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0081.573] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.573] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.573] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0081.573] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.573] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0081.573] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.573] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.573] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.573] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.574] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.574] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.574] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.574] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.574] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0081.574] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.574] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.574] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0081.574] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.574] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0081.574] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.574] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.662] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.662] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.662] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.662] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.663] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0081.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0081.663] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.663] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.663] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0081.663] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.663] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0081.663] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0081.663] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0081.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7acf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0081.663] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0081.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0081.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0081.664] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0081.664] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0081.664] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.665] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.665] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0081.665] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.665] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0081.665] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.665] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.665] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.665] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.665] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.665] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.665] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0081.665] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.665] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0081.665] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.665] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.665] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.665] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.665] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.666] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.666] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.666] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0081.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.666] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0081.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.666] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0081.666] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.666] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0081.666] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.666] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.666] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.667] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.667] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.667] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.667] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.667] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.667] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.667] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0081.667] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.667] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0081.667] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.667] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.667] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.667] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.667] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.667] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.667] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.668] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.668] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.668] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0081.668] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.668] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0081.668] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.668] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.668] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0081.668] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0081.668] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0081.668] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.669] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.669] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.669] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cc0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0081.669] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0081.669] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0081.669] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.669] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.669] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.669] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.669] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.669] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.669] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0081.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8aee8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0081.669] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0081.670] CryptHashData (hHash=0xa7cfa8, pbData=0x3983c30, dwDataLen=0x3, dwFlags=0x1) returned 1 [0081.670] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.670] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.670] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.670] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.670] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.670] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.670] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.670] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.670] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0081.670] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.670] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0081.670] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.670] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.670] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0081.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b518, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0081.670] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0081.670] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cfa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d128) returned 1 [0081.671] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.671] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.671] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.671] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.671] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.671] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.671] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.671] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0081.671] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.671] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0081.671] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0081.671] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0081.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aa98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0081.671] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0081.671] CryptDestroyHash (hHash=0xa7cfa8) returned 1 [0081.671] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.671] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.672] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.672] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.672] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.672] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/6x1noCxpBp1mmFoeCN6T.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6x1nocxpbp1mmfoecn6t.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0081.672] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.672] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0081.672] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.672] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.677] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.677] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0081.678] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.6x1noCxpBp1mmFoeCN6T.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.6x1nocxpbp1mmfoecn6t.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0081.679] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.679] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.679] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.679] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.682] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0081.682] ReadFile (in: hFile=0x24c, lpBuffer=0x2ccd1e0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2ccd1e0*, lpNumberOfBytesRead=0x8bf4f8*=0x5c5a, lpOverlapped=0x0) returned 1 [0081.683] ReadFile (in: hFile=0x24c, lpBuffer=0x2ccd1e0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2ccd1e0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0081.685] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.685] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.685] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.685] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0081.686] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.686] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0081.686] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.686] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.686] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.927] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 1 [0081.927] TranslateMessage (lpMsg=0x8bf3b8) returned 0 [0081.927] DispatchMessageW (lpMsg=0x8bf3b8) returned 0x0 [0081.927] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0081.927] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0081.927] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.927] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.927] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.927] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.927] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0081.927] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.927] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0081.928] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.928] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.928] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.928] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.928] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.928] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.928] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.928] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.928] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.928] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0081.928] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.928] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0081.928] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.928] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.928] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.928] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.928] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.928] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.928] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.928] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.929] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.929] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.929] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.929] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.929] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.929] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0081.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b0b0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0081.929] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0081.929] CryptEncrypt (in: hKey=0xa7d128, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x5c5a, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x5c60) returned 1 [0081.929] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.930] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.930] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.930] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.930] CharLowerBuffW (in: lpsz="byte[23648]", cchLength=0xb | out: lpsz="byte[23648]") returned 0xb [0081.930] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.930] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.930] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.930] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.930] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.930] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.930] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.930] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0081.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b2c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0081.931] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0081.931] CryptEncrypt (in: hKey=0xa7d128, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cac438*, pdwDataLen=0x8bef60*=0x5c5a, dwBufLen=0x5c60 | out: pbData=0x2cac438*, pdwDataLen=0x8bef60*=0x5c60) returned 1 [0081.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.932] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0081.932] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.932] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0081.932] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.932] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.932] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0081.932] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.932] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0081.932] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.932] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.932] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.932] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.932] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.933] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.933] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.933] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.933] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.933] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.933] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.933] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.935] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.935] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.935] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.935] WriteFile (in: hFile=0x240, lpBuffer=0x2cac438*, nNumberOfBytesToWrite=0x5c60, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cac438*, lpNumberOfBytesWritten=0x8bf5e4*=0x5c60, lpOverlapped=0x0) returned 1 [0081.936] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.936] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.936] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0081.936] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.936] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0081.936] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.937] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.937] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.937] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0081.937] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.937] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0081.937] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0081.937] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac48, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0081.937] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0081.937] CryptDestroyKey (hKey=0xa7d128) returned 1 [0081.937] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.937] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.937] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0081.937] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.937] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0081.938] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.938] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.938] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0081.938] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0081.938] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0081.938] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0081.940] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0081.940] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0081.940] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.940] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.940] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0081.940] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.940] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0081.940] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0081.940] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.940] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0081.940] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.940] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0081.940] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.941] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0081.941] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.941] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0081.941] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.941] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.941] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0081.941] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.941] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0081.941] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.941] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.941] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.941] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.941] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.941] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.941] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.941] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.941] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.941] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.942] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.942] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.942] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.942] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.942] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.942] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0081.942] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.942] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0081.942] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.942] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.942] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0081.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0081.943] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0081.943] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0081.943] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.943] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.943] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.943] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.943] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.943] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0081.943] FreeLibrary (hLibModule=0x76a10000) returned 1 [0081.943] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.943] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.943] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.943] CloseHandle (hObject=0x24c) returned 1 [0081.944] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.944] CloseHandle (hObject=0x240) returned 1 [0081.947] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.947] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.947] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.947] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.947] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/6x1noCxpBp1mmFoeCN6T.png", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6x1noCxpBp1mmFoeCN6T.png", lpFilePart=0x8bedf4*="6x1noCxpBp1mmFoeCN6T.png") returned 0x3e [0081.947] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6x1noCxpBp1mmFoeCN6T.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6x1nocxpbp1mmfoecn6t.png")) returned 0x20 [0081.947] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6x1noCxpBp1mmFoeCN6T.png", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cf28 [0081.948] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6x1noCxpBp1mmFoeCN6T.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6x1nocxpbp1mmfoecn6t.png")) returned 1 [0081.964] FindNextFileW (in: hFindFile=0xa7cf28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0081.965] FindClose (in: hFindFile=0xa7cf28 | out: hFindFile=0xa7cf28) returned 1 [0081.965] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.965] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.965] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.965] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/6x1noCxpBp1mmFoeCN6T.png", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6x1noCxpBp1mmFoeCN6T.png", lpFilePart=0x8bf650*="6x1noCxpBp1mmFoeCN6T.png") returned 0x3e [0081.965] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6x1noCxpBp1mmFoeCN6T.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6x1nocxpbp1mmfoecn6t.png")) returned 0xffffffff [0081.965] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.965] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.965] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7NLT7b7.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NLT7b7.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.966] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LT7b7.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.966] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T7b7.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0081.966] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7b7.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.966] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b7.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.966] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0081.966] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.966] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7NLT7b7.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.966] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NLT7b7.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.966] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LT7b7.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.966] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T7b7.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0081.966] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7b7.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.966] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b7.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0081.966] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0081.966] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0081.966] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.966] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.966] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0081.966] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0081.966] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.966] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0081.967] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.967] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.967] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.967] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.967] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.967] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/7NLT7b7.bmp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7ce28 [0081.967] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0081.967] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.967] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.967] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0081.967] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.967] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0081.967] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.967] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.968] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.968] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.968] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.968] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.968] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0081.968] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.968] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0081.968] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.968] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.968] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0081.968] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.968] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0081.968] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.968] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.969] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.969] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.969] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.969] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.969] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0081.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0081.969] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.969] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.969] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0081.971] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.971] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0081.972] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0081.972] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0081.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0081.972] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0081.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0081.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac78, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0081.972] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0081.972] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0081.973] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.973] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.973] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0081.973] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.973] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0081.973] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.973] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.974] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.974] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.974] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.974] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.974] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0081.974] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.974] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0081.974] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.974] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.974] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0081.974] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0081.974] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.974] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.974] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.974] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0081.974] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.974] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0081.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.975] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0081.975] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.975] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0081.975] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.975] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.975] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0081.975] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.975] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0081.975] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.975] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0081.975] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.976] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.976] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0081.976] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.976] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0081.976] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.976] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.976] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0081.976] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0081.976] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.976] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.976] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.976] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.976] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.976] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.976] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.976] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0081.976] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.977] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0081.977] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.977] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.977] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad68, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0081.977] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0081.977] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0081.977] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.977] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.977] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.977] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0081.978] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0081.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0081.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.978] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.978] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.978] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.978] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.978] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.987] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0081.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8ad38, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0081.987] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0081.987] CryptHashData (hHash=0xa7d0a8, pbData=0x3983b10, dwDataLen=0x3, dwFlags=0x1) returned 1 [0081.987] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.988] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.988] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.988] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.988] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.988] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.988] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.988] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.988] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0081.988] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.988] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0081.988] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.988] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0081.988] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0081.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b500, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0081.989] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0081.989] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d0a8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cda8) returned 1 [0081.989] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.989] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.989] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.989] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.989] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.989] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.989] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0081.989] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0081.989] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0081.989] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0081.989] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0081.989] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0081.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0081.990] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0081.990] CryptDestroyHash (hHash=0xa7d0a8) returned 1 [0081.990] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0081.990] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.990] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.990] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.990] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.990] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/7NLT7b7.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\7nlt7b7.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0081.991] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.991] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0081.991] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.991] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.991] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.991] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0081.992] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.7NLT7b7.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.7nlt7b7.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0081.992] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.992] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.992] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.992] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0081.995] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0081.995] ReadFile (in: hFile=0x240, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0xf9d1, lpOverlapped=0x0) returned 1 [0081.997] ReadFile (in: hFile=0x240, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0082.002] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.002] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.003] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.003] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0082.005] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.005] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0082.005] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.005] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.006] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.006] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.006] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.006] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.006] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.006] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.006] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.006] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.006] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.006] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.006] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.007] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.007] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.007] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.007] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.007] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.007] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.007] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.007] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.007] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.007] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.007] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.007] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.007] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.007] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.007] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.007] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.007] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.008] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b218, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.009] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.009] CryptEncrypt (in: hKey=0xa7cda8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xf9d1, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xf9d8) returned 1 [0082.009] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.009] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.009] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.009] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.009] CharLowerBuffW (in: lpsz="byte[63960]", cchLength=0xb | out: lpsz="byte[63960]") returned 0xb [0082.009] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.011] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.011] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.011] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.011] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.011] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.011] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.011] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b128, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.012] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.012] CryptEncrypt (in: hKey=0xa7cda8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3993a30*, pdwDataLen=0x8bef60*=0xf9d1, dwBufLen=0xf9d8 | out: pbData=0x3993a30*, pdwDataLen=0x8bef60*=0xf9d8) returned 1 [0082.014] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.014] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.014] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.014] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.015] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.015] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.015] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.015] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.015] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.015] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.015] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.015] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.015] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.015] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.015] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.016] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.016] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.016] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.016] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.016] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.023] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.023] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.023] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.024] WriteFile (in: hFile=0x24c, lpBuffer=0x2cd2a90*, nNumberOfBytesToWrite=0xf9d8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cd2a90*, lpNumberOfBytesWritten=0x8bf5e4*=0xf9d8, lpOverlapped=0x0) returned 1 [0082.026] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.026] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.026] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0082.026] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.026] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0082.026] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.026] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.026] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.026] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.028] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.028] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.028] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.029] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac60, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0082.029] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0082.029] CryptDestroyKey (hKey=0xa7cda8) returned 1 [0082.029] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.029] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.029] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.029] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.029] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.029] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.029] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.029] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.030] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.030] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.030] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.030] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.030] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.030] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.030] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.030] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.030] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.030] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.030] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.030] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.030] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.030] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.030] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.030] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.031] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.031] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.031] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.031] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.031] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.031] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.031] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.031] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.031] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.031] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.031] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.031] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.031] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.031] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.031] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.031] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.031] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.032] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.032] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.032] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.032] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.032] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.032] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.032] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.032] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.032] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.032] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.032] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.032] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0082.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0082.033] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0082.033] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0082.033] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.033] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.033] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.033] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.033] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.033] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.033] FreeLibrary (hLibModule=0x76a10000) returned 1 [0082.033] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.033] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.033] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.033] CloseHandle (hObject=0x240) returned 1 [0082.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.036] CloseHandle (hObject=0x24c) returned 1 [0082.039] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.040] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.040] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.040] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.040] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/7NLT7b7.bmp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7NLT7b7.bmp", lpFilePart=0x8bedf4*="7NLT7b7.bmp") returned 0x31 [0082.040] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7NLT7b7.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\7nlt7b7.bmp")) returned 0x20 [0082.041] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7NLT7b7.bmp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7ce28 [0082.041] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7NLT7b7.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\7nlt7b7.bmp")) returned 1 [0082.048] FindNextFileW (in: hFindFile=0xa7ce28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0082.048] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0082.048] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.049] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.049] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.049] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/7NLT7b7.bmp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7NLT7b7.bmp", lpFilePart=0x8bf650*="7NLT7b7.bmp") returned 0x31 [0082.049] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7NLT7b7.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\7nlt7b7.bmp")) returned 0xffffffff [0082.049] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.049] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.049] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.049] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a59dR.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.049] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="59dR.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.049] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9dR.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.049] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dR.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.049] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.049] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.049] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a59dR.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.049] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="59dR.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.049] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9dR.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.049] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dR.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.049] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.049] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0082.049] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.049] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.050] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.050] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.050] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.050] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0082.050] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.050] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.050] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.050] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.050] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.050] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/a59dR.mp3", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7ce28 [0082.050] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0082.050] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.050] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.050] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.050] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.050] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.051] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.051] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.051] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.051] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.051] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.051] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0082.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.051] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0082.051] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.051] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0082.051] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.051] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.051] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.052] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.052] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0082.052] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0082.052] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.052] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.052] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.052] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.052] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.052] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.052] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0082.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a998, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0082.052] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0082.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0082.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0082.053] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0082.053] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0082.053] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.053] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.054] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0082.054] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.054] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0082.054] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.054] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.054] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.054] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.054] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.054] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.054] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.054] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.054] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.054] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.054] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.054] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.054] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.054] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.054] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.054] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.055] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0082.055] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.074] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0082.074] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.074] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.074] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.074] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.074] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.074] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.074] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.074] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.075] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.075] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.075] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.075] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.075] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.075] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.075] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.075] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.075] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.075] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.075] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.075] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.075] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.075] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.075] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.075] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.075] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.075] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.075] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.075] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.075] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.076] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.076] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.076] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.076] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.076] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.076] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.076] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.076] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.076] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.076] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8aea0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0082.076] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0082.076] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0082.076] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.076] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.077] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.077] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0082.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ba0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0082.077] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0082.077] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0082.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cc0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0082.077] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.077] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.077] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.077] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.077] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.077] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.077] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0082.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8aee8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0082.078] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0082.078] CryptHashData (hHash=0xa7caa8, pbData=0x3983cb0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0082.078] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.078] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.078] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.078] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.078] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.078] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.078] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.078] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.078] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.079] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.080] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.080] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.080] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.080] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0082.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b4e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0082.080] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0082.080] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7caa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cc28) returned 1 [0082.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.081] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.081] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.081] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.081] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.081] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.081] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0082.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0082.081] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0082.081] CryptDestroyHash (hHash=0xa7caa8) returned 1 [0082.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.081] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.081] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.081] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.082] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.082] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/a59dR.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\a59dr.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0082.083] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.083] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0082.083] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.083] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.083] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.083] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0082.083] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.a59dR.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.a59dr.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0082.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.087] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0082.087] ReadFile (in: hFile=0x24c, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0x856c, lpOverlapped=0x0) returned 1 [0082.088] ReadFile (in: hFile=0x24c, lpBuffer=0x2c967c8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c967c8*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0082.092] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.092] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.092] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.092] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0082.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.092] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0082.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.093] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.093] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.093] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.093] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.093] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.093] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.093] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.093] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.093] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.093] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.093] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.093] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.093] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.093] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.093] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.093] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.093] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.093] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.093] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.093] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.093] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.093] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.094] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.094] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.094] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.094] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.094] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.094] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.094] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b170, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.095] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.095] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x856c, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x8570) returned 1 [0082.095] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.095] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.099] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.099] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.099] CharLowerBuffW (in: lpsz="byte[34160]", cchLength=0xb | out: lpsz="byte[34160]") returned 0xb [0082.099] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.100] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.100] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.100] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.100] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.100] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.100] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.101] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b0b0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.101] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.101] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ccf840*, pdwDataLen=0x8bef60*=0x856c, dwBufLen=0x8570 | out: pbData=0x2ccf840*, pdwDataLen=0x8bef60*=0x8570) returned 1 [0082.102] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.102] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.102] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.102] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.103] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.103] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.103] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.103] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.103] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.103] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.103] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.103] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.103] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.103] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.103] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.103] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.103] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.103] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.104] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.104] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.104] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.104] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.104] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.104] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.104] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.104] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.104] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.109] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.109] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.109] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.109] WriteFile (in: hFile=0x240, lpBuffer=0x2cd8dc0*, nNumberOfBytesToWrite=0x8570, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cd8dc0*, lpNumberOfBytesWritten=0x8bf5e4*=0x8570, lpOverlapped=0x0) returned 1 [0082.112] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.112] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.112] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0082.112] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.112] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0082.112] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.112] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.112] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.112] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.112] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.112] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.112] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.112] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8abd0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0082.113] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0082.113] CryptDestroyKey (hKey=0xa7cc28) returned 1 [0082.113] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.113] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.113] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.113] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.113] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.113] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.113] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.113] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.113] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.113] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.113] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.113] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.113] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.113] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.113] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.114] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.114] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.114] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.114] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.114] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.114] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.114] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.114] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.114] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.114] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.114] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.114] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.114] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.114] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.114] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.114] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.114] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.114] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.115] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.115] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.115] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.115] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.115] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.115] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.115] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.115] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.115] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.115] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.115] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.115] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.115] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.115] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.115] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.115] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.115] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.115] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.115] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.116] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0082.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7abb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0082.116] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0082.116] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0082.116] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.116] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.116] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.116] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.116] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.116] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.116] FreeLibrary (hLibModule=0x76a10000) returned 1 [0082.116] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.116] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.116] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.116] CloseHandle (hObject=0x24c) returned 1 [0082.118] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.118] CloseHandle (hObject=0x240) returned 1 [0082.121] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.122] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.122] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.122] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.122] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/a59dR.mp3", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\a59dR.mp3", lpFilePart=0x8bedf4*="a59dR.mp3") returned 0x2f [0082.122] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\a59dR.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\a59dr.mp3")) returned 0x20 [0082.122] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\a59dR.mp3", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0082.123] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\a59dR.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\a59dr.mp3")) returned 1 [0082.133] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0082.133] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0082.134] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.134] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.134] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.134] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/a59dR.mp3", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\a59dR.mp3", lpFilePart=0x8bf650*="a59dR.mp3") returned 0x2f [0082.134] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\a59dR.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\a59dr.mp3")) returned 0xffffffff [0082.134] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.134] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.134] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CHfvN1bcW R8s7_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HfvN1bcW R8s7_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fvN1bcW R8s7_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vN1bcW R8s7_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N1bcW R8s7_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1bcW R8s7_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bcW R8s7_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cW R8s7_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W R8s7_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" R8s7_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R8s7_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8s7_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s7_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bOrn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Orn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rn.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.135] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CHfvN1bcW R8s7_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HfvN1bcW R8s7_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fvN1bcW R8s7_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vN1bcW R8s7_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N1bcW R8s7_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1bcW R8s7_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bcW R8s7_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cW R8s7_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W R8s7_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" R8s7_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R8s7_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8s7_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s7_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bOrn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Orn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.135] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rn.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.135] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.135] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0082.135] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.135] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.135] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.136] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.136] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.136] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0082.136] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.136] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.136] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.136] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.136] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.136] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/CHfvN1bcW R8s7_bOrn.xls", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d068 [0082.136] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0082.136] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.136] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.136] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.136] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.140] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.140] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.140] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.140] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.140] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.141] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.141] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.141] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.141] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.141] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0082.141] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.141] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.141] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0082.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.142] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0082.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.142] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.142] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.142] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.142] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0082.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0082.142] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.142] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.142] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.142] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.142] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.142] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.142] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0082.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a998, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0082.143] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0082.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0082.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0082.143] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0082.143] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0082.143] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.144] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0082.144] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.144] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0082.144] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.144] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.144] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.144] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.144] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.145] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0082.145] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.145] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0082.145] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.145] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.145] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.145] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.145] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.145] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.145] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.145] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.145] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.145] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.145] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.145] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.145] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.145] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.145] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.145] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.145] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.146] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.146] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.146] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.146] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.146] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.146] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.146] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.146] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.146] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.146] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.146] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.146] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.146] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.146] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.146] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.146] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.146] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.146] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.146] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.146] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.146] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.147] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8aeb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0082.147] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0082.147] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0082.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0082.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983af0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0082.147] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0082.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0082.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983bf0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0082.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.147] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.148] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.148] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0082.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8ad80, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0082.148] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0082.148] CryptHashData (hHash=0xa7cee8, pbData=0x3983b90, dwDataLen=0x3, dwFlags=0x1) returned 1 [0082.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.148] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.148] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.148] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.149] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.149] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.149] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.149] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.149] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0082.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b320, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0082.149] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0082.149] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cee8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cce8) returned 1 [0082.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.149] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.149] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.150] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.150] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.150] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.150] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0082.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0082.150] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0082.150] CryptDestroyHash (hHash=0xa7cee8) returned 1 [0082.150] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.150] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.150] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.150] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.150] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.150] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/CHfvN1bcW R8s7_bOrn.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\chfvn1bcw r8s7_born.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0082.151] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.151] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0082.151] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.151] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.151] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.155] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0082.156] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.CHfvN1bcW R8s7_bOrn.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.chfvn1bcw r8s7_born.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0082.156] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.156] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.156] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.156] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.159] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0082.159] ReadFile (in: hFile=0x240, lpBuffer=0x2cd8dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2cd8dc0*, lpNumberOfBytesRead=0x8bf4f8*=0x74ad, lpOverlapped=0x0) returned 1 [0082.160] ReadFile (in: hFile=0x240, lpBuffer=0x2cd8dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2cd8dc0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0082.163] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.163] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.163] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.163] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0082.163] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.163] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0082.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.164] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.164] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.164] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.164] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.164] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.164] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.164] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.164] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.164] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.164] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.165] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.165] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.165] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.165] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.165] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.165] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.165] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.165] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.165] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.165] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.165] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.165] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.165] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.165] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.165] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b1d0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.166] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.166] CryptEncrypt (in: hKey=0xa7cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x74ad, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x74b0) returned 1 [0082.166] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.166] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.166] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.166] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.166] CharLowerBuffW (in: lpsz="byte[29872]", cchLength=0xb | out: lpsz="byte[29872]") returned 0xb [0082.166] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.167] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.167] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.167] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.167] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.167] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.167] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b260, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.167] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.167] CryptEncrypt (in: hKey=0xa7cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cbc5f8*, pdwDataLen=0x8bef60*=0x74ad, dwBufLen=0x74b0 | out: pbData=0x2cbc5f8*, pdwDataLen=0x8bef60*=0x74b0) returned 1 [0082.168] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.168] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.168] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.169] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.169] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.169] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.169] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.169] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.169] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.169] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.169] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.169] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.169] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.169] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.169] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.169] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.169] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.169] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.169] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.169] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.169] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.169] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.170] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.170] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.170] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.170] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.170] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.174] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.174] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.174] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.175] WriteFile (in: hFile=0x24c, lpBuffer=0x2cadc88*, nNumberOfBytesToWrite=0x74b0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cadc88*, lpNumberOfBytesWritten=0x8bf5e4*=0x74b0, lpOverlapped=0x0) returned 1 [0082.176] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.176] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.177] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0082.177] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.177] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0082.177] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.177] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.177] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.177] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.177] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.177] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.177] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.177] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac48, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0082.178] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0082.178] CryptDestroyKey (hKey=0xa7cce8) returned 1 [0082.178] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.178] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.178] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.178] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.178] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.178] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.178] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.178] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.178] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.178] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.178] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.178] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.178] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.178] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.179] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.179] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.179] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.179] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.179] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.179] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.179] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.179] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.179] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.179] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.179] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.179] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.179] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.179] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.179] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.179] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.179] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.180] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.180] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.180] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.187] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.187] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.187] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.187] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.187] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.187] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.187] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.187] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.187] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.187] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.187] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.187] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.187] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.188] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.188] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.188] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.188] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.188] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.190] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0082.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ab58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0082.190] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0082.190] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0082.190] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.190] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.190] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.190] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.190] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.191] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.191] FreeLibrary (hLibModule=0x76a10000) returned 1 [0082.191] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.191] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.191] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.191] CloseHandle (hObject=0x240) returned 1 [0082.193] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.193] CloseHandle (hObject=0x24c) returned 1 [0082.199] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.199] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.199] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.199] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.199] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/CHfvN1bcW R8s7_bOrn.xls", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CHfvN1bcW R8s7_bOrn.xls", lpFilePart=0x8bedf4*="CHfvN1bcW R8s7_bOrn.xls") returned 0x3d [0082.199] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CHfvN1bcW R8s7_bOrn.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\chfvn1bcw r8s7_born.xls")) returned 0x20 [0082.200] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CHfvN1bcW R8s7_bOrn.xls", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cc28 [0082.200] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CHfvN1bcW R8s7_bOrn.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\chfvn1bcw r8s7_born.xls")) returned 1 [0082.214] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0082.214] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0082.215] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.215] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.215] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.215] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/CHfvN1bcW R8s7_bOrn.xls", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CHfvN1bcW R8s7_bOrn.xls", lpFilePart=0x8bf650*="CHfvN1bcW R8s7_bOrn.xls") returned 0x3d [0082.215] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CHfvN1bcW R8s7_bOrn.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\chfvn1bcw r8s7_born.xls")) returned 0xffffffff [0082.215] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.215] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.215] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dCV6-VAR1Amz0.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CV6-VAR1Amz0.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V6-VAR1Amz0.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6-VAR1Amz0.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-VAR1Amz0.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VAR1Amz0.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AR1Amz0.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R1Amz0.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Amz0.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Amz0.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mz0.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z0.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.215] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dCV6-VAR1Amz0.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CV6-VAR1Amz0.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V6-VAR1Amz0.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6-VAR1Amz0.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-VAR1Amz0.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VAR1Amz0.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AR1Amz0.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R1Amz0.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Amz0.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Amz0.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mz0.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z0.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.216] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.216] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0082.216] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.216] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.216] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.216] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.216] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.216] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0082.216] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.216] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.216] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.216] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.217] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.217] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/dCV6-VAR1Amz0.mp4", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7ce28 [0082.217] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0082.217] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.217] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.217] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.217] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.217] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.217] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.217] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.217] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.217] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.217] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.217] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.217] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.217] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.218] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0082.218] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.218] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.218] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0082.218] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.218] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0082.218] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.218] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.218] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.218] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.218] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.218] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.218] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0082.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0082.218] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.218] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.218] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.219] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.219] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.219] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.219] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0082.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0082.219] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0082.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0082.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7abd8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0082.220] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0082.220] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0082.220] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.220] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.220] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0082.220] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.220] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0082.220] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.220] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.221] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.221] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.221] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.221] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.221] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0082.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.221] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0082.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.222] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.222] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.222] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.222] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.222] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.222] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.222] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.222] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.222] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.222] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.222] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.222] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.222] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.222] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.222] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.222] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.222] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.222] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.222] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.222] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.223] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.223] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.223] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.223] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.223] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.223] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.223] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.233] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.233] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.233] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.233] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af48, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0082.233] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0082.234] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0082.234] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.234] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.234] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.234] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0082.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983be0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0082.234] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0082.234] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0082.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0082.234] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.234] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.234] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.234] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.234] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.234] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.234] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0082.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8aea0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0082.235] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0082.235] CryptHashData (hHash=0xa7cc28, pbData=0x3983c20, dwDataLen=0x3, dwFlags=0x1) returned 1 [0082.235] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.235] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.235] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.235] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.235] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.235] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.235] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.235] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.235] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.235] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.235] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.235] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.235] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.235] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0082.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b518, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0082.236] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0082.236] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cc28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7caa8) returned 1 [0082.236] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.236] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.236] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.236] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.236] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.236] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.236] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.236] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.236] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.236] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.236] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.236] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0082.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aa98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0082.237] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0082.237] CryptDestroyHash (hHash=0xa7cc28) returned 1 [0082.237] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.237] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.237] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.237] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.237] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.237] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/dCV6-VAR1Amz0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\dcv6-var1amz0.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0082.238] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.238] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0082.238] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.238] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.238] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.238] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0082.238] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.dCV6-VAR1Amz0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.dcv6-var1amz0.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0082.247] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.247] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.247] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.247] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.249] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0082.250] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x729, lpOverlapped=0x0) returned 1 [0082.250] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0082.253] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.253] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.253] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.253] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0082.253] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.253] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0082.254] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.254] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.254] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.254] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.254] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.254] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.254] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.254] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.254] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.255] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.255] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.255] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.255] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.255] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.255] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.255] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.255] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.255] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.255] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.255] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.255] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.255] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.255] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.255] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.255] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.255] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b158, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.256] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.256] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x729, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x730) returned 1 [0082.256] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.256] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.256] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.256] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.256] CharLowerBuffW (in: lpsz="byte[1840]", cchLength=0xa | out: lpsz="byte[1840]") returned 0xa [0082.256] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.256] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.256] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.256] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.256] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.256] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.256] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.257] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b0f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.257] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.257] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cb8650*, pdwDataLen=0x8bef60*=0x729, dwBufLen=0x730 | out: pbData=0x2cb8650*, pdwDataLen=0x8bef60*=0x730) returned 1 [0082.257] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.257] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.257] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.257] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.257] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.257] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.257] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.257] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.257] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.257] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.257] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.258] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.258] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.258] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.258] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.258] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.258] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.258] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.258] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.258] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.258] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.258] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.258] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.258] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.258] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.277] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.277] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.277] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.277] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.277] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.277] WriteFile (in: hFile=0x240, lpBuffer=0x2cb77e0*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb77e0*, lpNumberOfBytesWritten=0x8bf5e4*=0x730, lpOverlapped=0x0) returned 1 [0082.279] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.279] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.279] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0082.279] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.279] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0082.279] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.279] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.279] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.279] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.279] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.280] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.280] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.280] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8aa98, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0082.280] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0082.280] CryptDestroyKey (hKey=0xa7caa8) returned 1 [0082.280] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.280] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.280] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.280] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.280] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.281] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.281] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.281] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.281] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.281] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.281] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.281] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.281] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.281] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.281] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.281] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.281] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.281] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.281] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.281] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.281] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.281] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.281] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.281] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.281] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.282] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.282] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.282] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.282] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.283] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.283] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.283] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.283] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.283] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.283] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.283] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.283] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.283] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.283] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.283] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.283] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.283] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.283] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.283] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.283] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.283] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.283] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.283] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.283] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.283] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.283] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.284] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.284] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0082.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0082.284] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0082.284] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0082.284] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.284] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.284] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.284] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.284] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.284] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.284] FreeLibrary (hLibModule=0x76a10000) returned 1 [0082.284] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.284] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.284] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.284] CloseHandle (hObject=0x24c) returned 1 [0082.285] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.285] CloseHandle (hObject=0x240) returned 1 [0082.288] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.288] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.288] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.288] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.288] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/dCV6-VAR1Amz0.mp4", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dCV6-VAR1Amz0.mp4", lpFilePart=0x8bedf4*="dCV6-VAR1Amz0.mp4") returned 0x37 [0082.288] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dCV6-VAR1Amz0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\dcv6-var1amz0.mp4")) returned 0x20 [0082.288] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dCV6-VAR1Amz0.mp4", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cf68 [0082.289] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dCV6-VAR1Amz0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\dcv6-var1amz0.mp4")) returned 1 [0082.304] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0082.304] FindClose (in: hFindFile=0xa7cf68 | out: hFindFile=0xa7cf68) returned 1 [0082.304] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.304] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.304] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.304] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/dCV6-VAR1Amz0.mp4", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dCV6-VAR1Amz0.mp4", lpFilePart=0x8bf650*="dCV6-VAR1Amz0.mp4") returned 0x37 [0082.304] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dCV6-VAR1Amz0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\dcv6-var1amz0.mp4")) returned 0xffffffff [0082.304] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.305] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.305] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DlhsKoDumMDb.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lhsKoDumMDb.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hsKoDumMDb.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sKoDumMDb.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KoDumMDb.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oDumMDb.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DumMDb.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="umMDb.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mMDb.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MDb.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Db.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.305] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DlhsKoDumMDb.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lhsKoDumMDb.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hsKoDumMDb.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sKoDumMDb.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KoDumMDb.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oDumMDb.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DumMDb.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="umMDb.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mMDb.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MDb.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Db.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.305] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.306] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0082.306] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.306] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.306] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.306] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.306] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.306] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0082.306] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.306] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.306] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.306] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.306] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.306] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/DlhsKoDumMDb.bmp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cee8 [0082.307] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0082.307] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.307] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.307] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.307] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.307] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.307] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.307] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.307] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.307] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.307] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.307] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.307] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.307] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.307] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0082.308] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.308] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.308] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0082.308] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.308] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0082.308] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.308] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.308] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.308] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.308] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.308] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.308] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0082.308] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0082.308] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.308] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.309] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.309] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.309] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.309] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.309] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0082.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0082.309] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0082.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0082.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa98, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0082.309] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0082.309] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0082.310] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.310] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.310] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0082.310] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.310] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0082.310] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.310] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.310] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.310] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.378] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.378] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.378] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.378] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.379] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.379] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.379] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.379] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.379] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.379] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.379] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.379] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.379] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0082.379] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.379] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0082.379] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.379] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.379] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.379] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.379] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.379] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.379] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.380] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.380] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.380] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.380] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.380] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.380] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.380] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.380] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.380] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.380] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.380] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.380] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.380] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.380] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.380] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.380] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.380] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.381] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.381] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.381] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.381] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.381] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.381] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.381] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.381] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.381] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.381] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.381] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.381] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.381] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.381] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.381] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0082.382] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0082.382] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0082.382] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.382] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.382] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.382] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0082.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b80, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0082.382] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0082.382] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0082.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983af0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0082.382] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.382] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.383] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.383] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.383] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.383] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.383] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0082.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8aea0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0082.383] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0082.383] CryptHashData (hHash=0xa7cfa8, pbData=0x3983c80, dwDataLen=0x3, dwFlags=0x1) returned 1 [0082.383] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.383] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.383] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.383] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.384] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.384] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.384] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.384] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.384] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.384] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.384] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.384] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.384] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.384] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0082.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b380, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0082.384] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0082.384] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cfa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d068) returned 1 [0082.385] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.385] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.385] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.385] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.385] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.385] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.385] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.385] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.385] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.385] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.385] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.385] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0082.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aaf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0082.385] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0082.386] CryptDestroyHash (hHash=0xa7cfa8) returned 1 [0082.386] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.386] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.386] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.386] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.386] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.387] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/DlhsKoDumMDb.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\dlhskodummdb.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0082.387] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.387] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0082.387] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.387] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.387] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.387] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0082.388] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.DlhsKoDumMDb.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.dlhskodummdb.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0082.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.389] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.392] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0082.392] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0082.394] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x67a1, lpOverlapped=0x0) returned 1 [0082.394] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0082.399] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.399] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.399] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.399] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0082.403] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.403] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0082.403] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.403] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.403] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.403] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.403] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.403] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.403] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.403] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.403] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.403] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.403] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.404] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.404] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.404] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.404] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.404] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.404] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.404] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.404] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.404] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.404] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.404] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.404] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.404] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.409] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.409] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.409] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.409] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.409] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.409] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.409] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.409] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.409] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.409] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.409] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.410] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b158, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.411] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.411] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x167a1, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x167a8) returned 1 [0082.411] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.411] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.411] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.411] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.411] CharLowerBuffW (in: lpsz="byte[92072]", cchLength=0xb | out: lpsz="byte[92072]") returned 0xb [0082.411] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.415] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.415] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.415] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.415] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.415] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.415] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.417] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b128, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.417] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.418] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x399a800*, pdwDataLen=0x8bef60*=0x167a1, dwBufLen=0x167a8 | out: pbData=0x399a800*, pdwDataLen=0x8bef60*=0x167a8) returned 1 [0082.421] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.421] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.421] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.421] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.423] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.423] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.423] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.424] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.424] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.424] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.424] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.424] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.424] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.424] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.424] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.424] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.424] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.424] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.424] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.424] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.424] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.424] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.424] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.424] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.425] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.425] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.425] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.437] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.437] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.437] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.438] WriteFile (in: hFile=0x24c, lpBuffer=0x2ccdf90*, nNumberOfBytesToWrite=0x167a8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2ccdf90*, lpNumberOfBytesWritten=0x8bf5e4*=0x167a8, lpOverlapped=0x0) returned 1 [0082.440] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.441] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.441] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0082.441] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.441] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0082.441] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.441] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.441] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.441] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.441] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.441] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.441] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.441] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac30, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0082.442] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0082.442] CryptDestroyKey (hKey=0xa7d068) returned 1 [0082.442] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.442] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.442] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.442] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.442] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.442] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.442] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.442] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.442] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.442] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.442] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.442] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.442] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.442] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.442] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.442] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.443] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.443] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.443] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.443] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.443] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.443] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.443] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.443] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.443] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.443] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.443] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.443] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.443] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.443] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.443] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.443] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.443] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.443] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.443] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.443] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.443] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.444] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.444] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.444] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.444] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.444] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.444] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.444] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.444] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.444] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.444] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.444] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.444] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.444] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.444] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.444] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.444] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0082.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7acb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0082.445] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0082.445] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0082.445] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.445] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.445] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.445] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.445] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.445] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.445] FreeLibrary (hLibModule=0x76a10000) returned 1 [0082.445] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.445] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.445] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.445] CloseHandle (hObject=0x240) returned 1 [0082.447] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.447] CloseHandle (hObject=0x24c) returned 1 [0082.450] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.452] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.452] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.452] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.452] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/DlhsKoDumMDb.bmp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\DlhsKoDumMDb.bmp", lpFilePart=0x8bedf4*="DlhsKoDumMDb.bmp") returned 0x36 [0082.452] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\DlhsKoDumMDb.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\dlhskodummdb.bmp")) returned 0x20 [0082.453] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\DlhsKoDumMDb.bmp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cd28 [0082.453] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\DlhsKoDumMDb.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\dlhskodummdb.bmp")) returned 1 [0082.504] FindNextFileW (in: hFindFile=0xa7cd28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0082.505] FindClose (in: hFindFile=0xa7cd28 | out: hFindFile=0xa7cd28) returned 1 [0082.505] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.505] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.505] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.505] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/DlhsKoDumMDb.bmp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\DlhsKoDumMDb.bmp", lpFilePart=0x8bf650*="DlhsKoDumMDb.bmp") returned 0x36 [0082.505] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\DlhsKoDumMDb.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\dlhskodummdb.bmp")) returned 0xffffffff [0082.505] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.505] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.505] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e47Ptw.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="47Ptw.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7Ptw.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ptw.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tw.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.536] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e47Ptw.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="47Ptw.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7Ptw.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ptw.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tw.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.536] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.536] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0082.536] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.536] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.536] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.536] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.536] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.536] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0082.536] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.537] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.537] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.537] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.537] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.537] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/e47Ptw.gif", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d0a8 [0082.537] FindClose (in: hFindFile=0xa7d0a8 | out: hFindFile=0xa7d0a8) returned 1 [0082.537] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.537] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.537] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.537] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.537] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.537] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.537] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.538] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.538] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.538] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.538] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.538] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.538] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.538] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0082.538] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.538] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.538] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0082.538] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.538] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0082.538] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.539] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.539] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.539] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.539] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.539] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.539] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0082.539] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0082.539] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.539] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.539] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.539] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.539] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.539] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.539] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0082.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7abb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0082.540] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0082.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0082.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac98, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0082.540] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0082.540] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0082.541] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.541] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.541] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0082.541] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.541] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0082.541] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.541] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.541] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.541] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.541] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.541] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.541] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.541] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.542] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.542] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.542] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.542] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.542] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.542] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.542] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.542] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.542] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0082.542] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.542] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0082.542] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.542] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.542] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.542] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.543] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.543] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.543] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.543] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.543] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.543] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.543] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.543] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.543] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.543] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.543] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.543] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.543] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.543] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.543] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.543] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.543] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.543] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.543] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.544] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.544] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.544] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.544] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.544] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.544] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.544] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.544] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.544] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.544] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.544] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.544] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.544] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.544] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af48, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0082.545] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0082.545] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0082.545] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.545] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.545] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.545] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0082.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0082.545] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0082.545] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0082.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c20, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0082.546] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.546] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.546] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.546] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.546] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.546] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.546] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0082.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8aed0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0082.546] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0082.546] CryptHashData (hHash=0xa7c9e8, pbData=0x3983c00, dwDataLen=0x3, dwFlags=0x1) returned 1 [0082.546] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.546] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.546] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.546] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.547] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.547] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.547] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.547] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.547] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.547] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.547] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.547] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.547] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.547] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0082.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b3c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0082.548] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0082.548] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7c9e8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d0a8) returned 1 [0082.548] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.548] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.548] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.548] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.548] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.549] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.552] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.552] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.552] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.552] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.552] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.552] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0082.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0082.553] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0082.553] CryptDestroyHash (hHash=0xa7c9e8) returned 1 [0082.553] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.553] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.553] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.553] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.553] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.554] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/e47Ptw.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\e47ptw.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0082.554] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.554] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0082.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.555] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0082.555] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.e47Ptw.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.e47ptw.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0082.555] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.555] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.555] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.555] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.558] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0082.558] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x2a84, lpOverlapped=0x0) returned 1 [0082.559] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0082.562] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.562] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.562] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.562] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0082.562] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.562] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0082.562] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.562] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.563] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.563] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.563] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.563] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.563] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.563] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.563] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.563] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.563] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.696] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 1 [0082.696] TranslateMessage (lpMsg=0x8bf158) returned 0 [0082.696] DispatchMessageW (lpMsg=0x8bf158) returned 0x0 [0082.696] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0082.696] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0082.696] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.696] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.696] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.696] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.696] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.696] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.696] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.696] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.696] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.697] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.697] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.697] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.697] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.697] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.697] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.697] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.697] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.697] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.697] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.697] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.697] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.697] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.697] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.697] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.698] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b1e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.698] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.698] CryptEncrypt (in: hKey=0xa7d0a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x2a84, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x2a88) returned 1 [0082.698] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.698] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.698] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.698] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.698] CharLowerBuffW (in: lpsz="byte[10888]", cchLength=0xb | out: lpsz="byte[10888]") returned 0xb [0082.698] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.699] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.699] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.699] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.699] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.699] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.699] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.699] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b128, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.699] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.700] CryptEncrypt (in: hKey=0xa7d0a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cbf790*, pdwDataLen=0x8bef60*=0x2a84, dwBufLen=0x2a88 | out: pbData=0x2cbf790*, pdwDataLen=0x8bef60*=0x2a88) returned 1 [0082.700] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.700] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.700] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.700] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.700] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.700] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.700] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.700] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.701] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.701] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.701] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.701] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.701] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.701] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.701] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.701] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.701] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.701] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.701] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.701] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.701] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.701] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.701] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.701] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.701] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.702] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.702] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.703] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.703] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.703] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.703] WriteFile (in: hFile=0x240, lpBuffer=0x2cba270*, nNumberOfBytesToWrite=0x2a88, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cba270*, lpNumberOfBytesWritten=0x8bf5e4*=0x2a88, lpOverlapped=0x0) returned 1 [0082.707] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.707] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.707] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0082.708] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.708] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0082.708] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.708] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.708] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.708] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.708] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.708] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.708] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.708] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8abb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0082.708] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0082.709] CryptDestroyKey (hKey=0xa7d0a8) returned 1 [0082.709] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.709] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.709] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.709] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.709] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.709] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.709] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.709] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.709] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.709] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.709] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.709] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.709] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.709] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.709] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.710] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.710] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.710] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.710] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.710] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.710] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.710] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.710] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.710] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.710] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.710] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.710] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.710] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.710] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.710] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.710] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.710] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.710] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.711] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.711] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.711] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.711] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.711] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.711] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.711] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.711] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.711] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.711] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.711] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.711] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.711] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.711] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.711] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.711] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.711] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.712] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.712] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.712] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0082.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0082.712] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0082.712] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0082.712] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.712] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.712] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.712] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.712] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.713] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.713] FreeLibrary (hLibModule=0x76a10000) returned 1 [0082.713] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.713] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.713] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.713] CloseHandle (hObject=0x24c) returned 1 [0082.714] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.714] CloseHandle (hObject=0x240) returned 1 [0082.719] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.727] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.727] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.727] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.727] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/e47Ptw.gif", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\e47Ptw.gif", lpFilePart=0x8bedf4*="e47Ptw.gif") returned 0x30 [0082.727] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\e47Ptw.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\e47ptw.gif")) returned 0x20 [0082.727] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\e47Ptw.gif", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d128 [0082.728] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\e47Ptw.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\e47ptw.gif")) returned 1 [0082.739] FindNextFileW (in: hFindFile=0xa7d128, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0082.739] FindClose (in: hFindFile=0xa7d128 | out: hFindFile=0xa7d128) returned 1 [0082.739] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.739] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.739] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.739] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/e47Ptw.gif", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\e47Ptw.gif", lpFilePart=0x8bf650*="e47Ptw.gif") returned 0x30 [0082.739] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\e47Ptw.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\e47ptw.gif")) returned 0xffffffff [0082.739] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.740] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.740] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eA3aYZlB_n2DMgb4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A3aYZlB_n2DMgb4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3aYZlB_n2DMgb4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYZlB_n2DMgb4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YZlB_n2DMgb4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZlB_n2DMgb4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lB_n2DMgb4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B_n2DMgb4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_n2DMgb4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n2DMgb4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2DMgb4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DMgb4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mgb4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gb4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vCUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CUM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UM.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.740] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eA3aYZlB_n2DMgb4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A3aYZlB_n2DMgb4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3aYZlB_n2DMgb4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYZlB_n2DMgb4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YZlB_n2DMgb4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZlB_n2DMgb4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lB_n2DMgb4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B_n2DMgb4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_n2DMgb4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n2DMgb4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2DMgb4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DMgb4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mgb4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gb4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vCUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CUM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UM.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.741] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.741] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0082.741] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.741] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.741] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.741] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.741] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.742] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0082.742] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.742] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.742] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.742] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.742] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.742] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/eA3aYZlB_n2DMgb4vCUM.bmp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d0a8 [0082.742] FindClose (in: hFindFile=0xa7d0a8 | out: hFindFile=0xa7d0a8) returned 1 [0082.742] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.742] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.742] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.743] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.743] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.743] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.743] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.743] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.743] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.743] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.743] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.743] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.743] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.743] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0082.743] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.743] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.744] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0082.744] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.744] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0082.744] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.744] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.744] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.744] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.744] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.744] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.744] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0082.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0082.744] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.744] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.744] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.744] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.744] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.744] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.745] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0082.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0082.745] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0082.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0082.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0082.745] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0082.745] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0082.746] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.746] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.746] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0082.746] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.746] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0082.746] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.746] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.746] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.746] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.746] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.747] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.747] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.747] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.747] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.747] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.747] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.747] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.747] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.747] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.747] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.747] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.747] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0082.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.747] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0082.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.748] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.748] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.748] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.748] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.748] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.748] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.748] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.748] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.748] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.748] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.748] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.748] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.748] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.748] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.748] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.748] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.748] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.748] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.749] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.749] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.749] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.749] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.749] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.749] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.749] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.749] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.749] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.749] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.749] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.749] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.749] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.749] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.749] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.749] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.749] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8afc0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0082.750] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0082.750] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0082.750] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.750] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.750] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.750] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0082.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b30, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0082.750] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0082.750] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0082.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0082.751] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.751] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.751] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.751] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.751] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.751] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.751] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0082.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8adb0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0082.751] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0082.751] CryptHashData (hHash=0xa7cda8, pbData=0x3983b80, dwDataLen=0x3, dwFlags=0x1) returned 1 [0082.752] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.752] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.752] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.752] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.752] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.752] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.752] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.752] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.772] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.772] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.772] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.772] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.772] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.772] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0082.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b320, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0082.773] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0082.773] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cda8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7ce28) returned 1 [0082.773] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.773] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.773] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.773] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.773] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.773] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.773] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.773] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.773] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.774] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.774] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.774] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0082.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a998, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0082.774] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0082.774] CryptDestroyHash (hHash=0xa7cda8) returned 1 [0082.774] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.774] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.774] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.774] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.774] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.775] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/eA3aYZlB_n2DMgb4vCUM.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ea3ayzlb_n2dmgb4vcum.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0082.775] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.775] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0082.775] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.775] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.775] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.775] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0082.775] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.eA3aYZlB_n2DMgb4vCUM.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.ea3ayzlb_n2dmgb4vcum.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0082.776] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.777] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.777] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.777] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.780] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0082.780] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0xc7f1, lpOverlapped=0x0) returned 1 [0082.781] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0082.789] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.789] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.789] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.789] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0082.790] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.790] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0082.790] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.790] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.790] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.790] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.790] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.790] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.790] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.790] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.790] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.790] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.790] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.790] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.790] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.791] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.791] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.791] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.791] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.791] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.791] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.791] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.791] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.791] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.791] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.791] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.791] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.791] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.791] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.791] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.791] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.791] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.791] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.792] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.792] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.792] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.792] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.793] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b200, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.794] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.794] CryptEncrypt (in: hKey=0xa7ce28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xc7f1, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xc7f8) returned 1 [0082.794] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.794] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.794] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.794] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.794] CharLowerBuffW (in: lpsz="byte[51192]", cchLength=0xb | out: lpsz="byte[51192]") returned 0xb [0082.794] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.797] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.797] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.797] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.797] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.797] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.797] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.799] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b158, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.799] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.799] CryptEncrypt (in: hKey=0xa7ce28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3984050*, pdwDataLen=0x8bef60*=0xc7f1, dwBufLen=0xc7f8 | out: pbData=0x3984050*, pdwDataLen=0x8bef60*=0xc7f8) returned 1 [0082.801] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.801] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.801] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.801] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.801] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.801] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.801] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.801] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.802] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.802] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.802] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.802] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.802] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.802] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.802] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.802] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.802] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.802] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.802] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.802] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.802] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.802] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.802] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.802] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.802] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.802] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.802] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.807] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.807] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.807] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.808] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb77e0*, nNumberOfBytesToWrite=0xc7f8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb77e0*, lpNumberOfBytesWritten=0x8bf5e4*=0xc7f8, lpOverlapped=0x0) returned 1 [0082.810] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.810] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.810] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0082.810] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.810] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0082.810] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.810] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.810] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.810] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.811] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.811] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.811] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0082.811] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8abb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0082.811] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0082.811] CryptDestroyKey (hKey=0xa7ce28) returned 1 [0082.811] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.811] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.811] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.811] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.811] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.811] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.885] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.885] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.885] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.885] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.885] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.885] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.885] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0082.885] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.885] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.885] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.885] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.885] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.885] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0082.885] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.885] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0082.885] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.886] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0082.886] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.886] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0082.886] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.886] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0082.886] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.886] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.886] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0082.886] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.886] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0082.886] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.886] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.886] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.886] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.886] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.886] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.886] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.886] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.886] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.886] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.886] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.887] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.887] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.887] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.887] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.887] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.887] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.887] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.887] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.887] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.887] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0082.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0082.887] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0082.887] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0082.887] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.887] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.887] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.888] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.888] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.888] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0082.888] FreeLibrary (hLibModule=0x76a10000) returned 1 [0082.888] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.888] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.888] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.888] CloseHandle (hObject=0x240) returned 1 [0082.890] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.890] CloseHandle (hObject=0x24c) returned 1 [0082.895] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.897] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.897] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.897] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.897] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/eA3aYZlB_n2DMgb4vCUM.bmp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\eA3aYZlB_n2DMgb4vCUM.bmp", lpFilePart=0x8bedf4*="eA3aYZlB_n2DMgb4vCUM.bmp") returned 0x3e [0082.897] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\eA3aYZlB_n2DMgb4vCUM.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ea3ayzlb_n2dmgb4vcum.bmp")) returned 0x20 [0082.897] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\eA3aYZlB_n2DMgb4vCUM.bmp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cc28 [0082.897] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\eA3aYZlB_n2DMgb4vCUM.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ea3ayzlb_n2dmgb4vcum.bmp")) returned 1 [0082.906] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0082.906] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0082.906] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.906] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.907] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.907] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/eA3aYZlB_n2DMgb4vCUM.bmp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\eA3aYZlB_n2DMgb4vCUM.bmp", lpFilePart=0x8bf650*="eA3aYZlB_n2DMgb4vCUM.bmp") returned 0x3e [0082.907] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\eA3aYZlB_n2DMgb4vCUM.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ea3ayzlb_n2dmgb4vcum.bmp")) returned 0xffffffff [0082.907] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.907] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.907] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eZG2gw6YILMiFluj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZG2gw6YILMiFluj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G2gw6YILMiFluj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gw6YILMiFluj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gw6YILMiFluj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w6YILMiFluj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6YILMiFluj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YILMiFluj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ILMiFluj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LMiFluj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MiFluj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iFluj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Fluj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="luj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0082.908] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eZG2gw6YILMiFluj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZG2gw6YILMiFluj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G2gw6YILMiFluj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gw6YILMiFluj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gw6YILMiFluj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w6YILMiFluj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6YILMiFluj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YILMiFluj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ILMiFluj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LMiFluj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MiFluj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iFluj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Fluj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="luj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0082.908] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0082.908] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0082.908] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.908] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.908] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0082.908] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0082.908] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.908] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0082.909] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.909] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.909] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.909] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.909] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.909] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/eZG2gw6YILMiFluj.csv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cce8 [0082.909] FindClose (in: hFindFile=0xa7cce8 | out: hFindFile=0xa7cce8) returned 1 [0082.909] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.909] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.909] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.909] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.909] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.909] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.909] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.909] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.909] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.910] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.910] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.910] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0082.910] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.910] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0082.910] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.910] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.910] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0082.910] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.910] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0082.910] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.910] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.910] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.910] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.910] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.910] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.910] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0082.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0082.911] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.911] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.911] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.911] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.911] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.911] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0082.911] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0082.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0082.911] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0082.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0082.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a978, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0082.912] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0082.912] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0082.912] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.912] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.912] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0082.912] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.913] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0082.913] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.913] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.913] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.913] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.913] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.913] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.913] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.913] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.913] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.913] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.913] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.913] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0082.913] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0082.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.914] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0082.914] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.914] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0082.914] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.914] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.914] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.914] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.914] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.914] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.946] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.946] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.946] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.946] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.946] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.946] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.946] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.947] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.947] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.947] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.947] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.947] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.947] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.947] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.947] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.947] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.947] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.947] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.947] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.947] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.947] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.947] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.947] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.947] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.947] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.947] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.947] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.947] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.947] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.948] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.948] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.948] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.948] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af30, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0082.948] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0082.948] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0082.948] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.948] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.948] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.948] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0082.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b50, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0082.948] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0082.949] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0082.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0082.949] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.949] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.949] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.949] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.949] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.949] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.949] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0082.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8ad80, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0082.949] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0082.949] CryptHashData (hHash=0xa7cee8, pbData=0x3983bb0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0082.949] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.949] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.949] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.950] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.950] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.950] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.950] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.950] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.950] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0082.950] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.950] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0082.950] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.950] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.950] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0082.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b4e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0082.950] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0082.950] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cee8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cce8) returned 1 [0082.950] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.950] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.950] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.950] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.951] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.951] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.951] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.951] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.951] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.951] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.951] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0082.951] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0082.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a978, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0082.951] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0082.951] CryptDestroyHash (hHash=0xa7cee8) returned 1 [0082.951] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.951] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.951] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.951] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.951] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.952] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/eZG2gw6YILMiFluj.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ezg2gw6yilmifluj.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0082.952] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.952] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0082.953] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.953] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.953] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.953] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0082.953] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.eZG2gw6YILMiFluj.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.ezg2gw6yilmifluj.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0082.953] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.953] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.955] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.956] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.958] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0082.958] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x1af9, lpOverlapped=0x0) returned 1 [0082.959] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0082.961] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.961] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.961] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0082.961] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0082.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.961] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0082.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.961] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0082.962] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.962] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0082.962] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.962] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.962] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0082.962] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.962] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0082.962] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.962] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0082.962] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.962] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.962] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0082.962] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.962] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0082.962] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.962] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.962] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0082.962] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0082.962] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.962] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.962] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.963] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.963] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.963] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.963] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.963] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.963] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.963] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0082.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0082.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b218, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0082.963] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0082.963] CryptEncrypt (in: hKey=0xa7cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x1af9, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x1b00) returned 1 [0082.963] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.963] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.964] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.964] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.964] CharLowerBuffW (in: lpsz="byte[6912]", cchLength=0xa | out: lpsz="byte[6912]") returned 0xa [0082.964] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.964] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0082.964] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0082.964] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0082.964] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0082.964] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.014] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.014] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b260, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.015] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.015] CryptEncrypt (in: hKey=0xa7cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cbc8f8*, pdwDataLen=0x8bef60*=0x1af9, dwBufLen=0x1b00 | out: pbData=0x2cbc8f8*, pdwDataLen=0x8bef60*=0x1b00) returned 1 [0083.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.015] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.015] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.015] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.015] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.015] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.015] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.016] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.016] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.016] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.016] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.016] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.016] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.017] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.017] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.017] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.017] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.017] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.017] WriteFile (in: hFile=0x240, lpBuffer=0x2cb92e8*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb92e8*, lpNumberOfBytesWritten=0x8bf5e4*=0x1b00, lpOverlapped=0x0) returned 1 [0083.018] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.018] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.018] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0083.018] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.018] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0083.018] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.018] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.018] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.018] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.018] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.018] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.018] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.018] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8abb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0083.019] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0083.019] CryptDestroyKey (hKey=0xa7cce8) returned 1 [0083.019] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.019] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.019] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.019] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.019] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.019] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.019] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.019] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.019] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.019] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.019] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.019] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.019] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.019] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.019] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.019] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.020] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.020] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.020] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.020] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.020] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.020] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.020] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.020] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.020] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.020] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.020] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.020] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.020] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.020] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.020] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.020] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.020] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.020] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.020] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.020] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.020] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.021] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.021] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.021] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.021] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.021] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.021] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.021] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.021] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.021] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.021] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.021] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0083.022] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0083.022] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0083.022] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.022] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.022] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.022] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.022] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.022] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.022] FreeLibrary (hLibModule=0x76a10000) returned 1 [0083.022] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.022] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.022] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.022] CloseHandle (hObject=0x24c) returned 1 [0083.023] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.023] CloseHandle (hObject=0x240) returned 1 [0083.027] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.028] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.028] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.028] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.028] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/eZG2gw6YILMiFluj.csv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\eZG2gw6YILMiFluj.csv", lpFilePart=0x8bedf4*="eZG2gw6YILMiFluj.csv") returned 0x3a [0083.028] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\eZG2gw6YILMiFluj.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ezg2gw6yilmifluj.csv")) returned 0x20 [0083.028] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\eZG2gw6YILMiFluj.csv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cda8 [0083.028] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\eZG2gw6YILMiFluj.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ezg2gw6yilmifluj.csv")) returned 1 [0083.033] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0083.033] FindClose (in: hFindFile=0xa7cda8 | out: hFindFile=0xa7cda8) returned 1 [0083.033] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.033] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.033] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.033] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/eZG2gw6YILMiFluj.csv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\eZG2gw6YILMiFluj.csv", lpFilePart=0x8bf650*="eZG2gw6YILMiFluj.csv") returned 0x3a [0083.033] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\eZG2gw6YILMiFluj.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ezg2gw6yilmifluj.csv")) returned 0xffffffff [0083.033] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.033] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.033] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HD1FLLNmLPJ7igO2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D1FLLNmLPJ7igO2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1FLLNmLPJ7igO2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FLLNmLPJ7igO2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LLNmLPJ7igO2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LNmLPJ7igO2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NmLPJ7igO2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mLPJ7igO2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LPJ7igO2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PJ7igO2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J7igO2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7igO2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="igO2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gO2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XSQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SQ.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.034] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HD1FLLNmLPJ7igO2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D1FLLNmLPJ7igO2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1FLLNmLPJ7igO2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FLLNmLPJ7igO2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LLNmLPJ7igO2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LNmLPJ7igO2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NmLPJ7igO2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mLPJ7igO2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LPJ7igO2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PJ7igO2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J7igO2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7igO2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="igO2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gO2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XSQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SQ.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.035] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.035] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0083.035] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.035] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.035] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.035] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.035] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.035] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0083.035] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.035] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.036] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/HD1FLLNmLPJ7igO2XSQ.png", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cca8 [0083.036] FindClose (in: hFindFile=0xa7cca8 | out: hFindFile=0xa7cca8) returned 1 [0083.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.036] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.036] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.036] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.036] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.036] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.036] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.037] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.037] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.037] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.037] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.037] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.056] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0083.057] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.057] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0083.057] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.057] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0083.057] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.057] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0083.057] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0083.057] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.057] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.057] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.057] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.057] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.057] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.057] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7abb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0083.058] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0083.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0083.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0083.058] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0083.058] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0083.059] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.059] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.059] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0083.059] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.059] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0083.059] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.059] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.059] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.059] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.059] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.059] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.059] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.060] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.060] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.060] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.060] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.060] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.060] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.060] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.060] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.060] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.060] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0083.060] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.060] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0083.060] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.060] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.060] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.060] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.060] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.060] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.061] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.061] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.061] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.061] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.061] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.061] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.061] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.061] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.061] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.061] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.061] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.061] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.061] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.062] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.062] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.062] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.062] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.062] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.062] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.062] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.062] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.062] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.062] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0083.063] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0083.063] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0083.063] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.063] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983bf0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.064] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0083.064] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ce0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.064] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.064] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.064] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.064] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.064] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.064] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.064] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0083.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8aed0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0083.065] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0083.065] CryptHashData (hHash=0xa7c9e8, pbData=0x3983af0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0083.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.065] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.065] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.065] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.065] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.065] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.065] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.065] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.065] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.065] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.066] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.066] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b3c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0083.066] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0083.066] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7c9e8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cee8) returned 1 [0083.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.066] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.067] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.067] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.067] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.067] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.067] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0083.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aa58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0083.067] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0083.067] CryptDestroyHash (hHash=0xa7c9e8) returned 1 [0083.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.067] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.067] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.067] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.067] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.068] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/HD1FLLNmLPJ7igO2XSQ.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\hd1fllnmlpj7igo2xsq.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0083.068] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.068] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0083.068] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.068] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.068] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.068] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0083.068] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.HD1FLLNmLPJ7igO2XSQ.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.hd1fllnmlpj7igo2xsq.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0083.069] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.069] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.069] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.069] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.072] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0083.072] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x8875, lpOverlapped=0x0) returned 1 [0083.073] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0083.076] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.076] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.078] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.079] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0083.079] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.079] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0083.079] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.079] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.079] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.080] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.080] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.080] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.080] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.080] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.080] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.080] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.080] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.080] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.080] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.080] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.080] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.080] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.080] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.081] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.081] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.081] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.081] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.081] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.081] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.081] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.082] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b1a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.082] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.082] CryptEncrypt (in: hKey=0xa7cee8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x8875, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x8878) returned 1 [0083.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.082] CharLowerBuffW (in: lpsz="byte[34936]", cchLength=0xb | out: lpsz="byte[34936]") returned 0xb [0083.083] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.084] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.085] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.085] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.085] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.085] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.085] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.085] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b110, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.085] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.085] CryptEncrypt (in: hKey=0xa7cee8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cd1160*, pdwDataLen=0x8bef60*=0x8875, dwBufLen=0x8878 | out: pbData=0x2cd1160*, pdwDataLen=0x8bef60*=0x8878) returned 1 [0083.087] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.087] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.087] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.087] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.087] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.087] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.087] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.087] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.087] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.087] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.087] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.087] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.087] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.087] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.088] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.088] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.088] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.088] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.088] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.088] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.088] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.088] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.088] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.088] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.088] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.088] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.088] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.092] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.093] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.093] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.093] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb77e0*, nNumberOfBytesToWrite=0x8878, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb77e0*, lpNumberOfBytesWritten=0x8bf5e4*=0x8878, lpOverlapped=0x0) returned 1 [0083.095] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.095] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.095] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0083.095] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.095] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0083.095] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.095] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.095] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.096] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.096] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.096] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.096] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.096] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac30, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0083.096] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0083.096] CryptDestroyKey (hKey=0xa7cee8) returned 1 [0083.096] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.096] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.096] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.096] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.097] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.097] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.097] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.097] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.097] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.097] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.097] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.097] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.097] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.097] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.097] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.097] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.097] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.097] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.097] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.097] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.097] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.097] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.098] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.098] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.098] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.098] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.098] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.098] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.098] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.098] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.098] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.098] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.098] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.098] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.098] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.098] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.098] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.098] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.098] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.098] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.099] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.099] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.101] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.101] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.101] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.101] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.101] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.101] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.102] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.102] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.102] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.102] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.102] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7abb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0083.102] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0083.102] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0083.102] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.102] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.102] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.102] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.102] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.103] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.103] FreeLibrary (hLibModule=0x76a10000) returned 1 [0083.103] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.103] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.103] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.103] CloseHandle (hObject=0x240) returned 1 [0083.105] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.105] CloseHandle (hObject=0x24c) returned 1 [0083.109] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.111] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.111] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.111] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.111] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/HD1FLLNmLPJ7igO2XSQ.png", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HD1FLLNmLPJ7igO2XSQ.png", lpFilePart=0x8bedf4*="HD1FLLNmLPJ7igO2XSQ.png") returned 0x3d [0083.111] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HD1FLLNmLPJ7igO2XSQ.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\hd1fllnmlpj7igo2xsq.png")) returned 0x20 [0083.111] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HD1FLLNmLPJ7igO2XSQ.png", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7caa8 [0083.111] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HD1FLLNmLPJ7igO2XSQ.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\hd1fllnmlpj7igo2xsq.png")) returned 1 [0083.117] FindNextFileW (in: hFindFile=0xa7caa8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0083.117] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0083.117] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.118] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.118] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.118] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/HD1FLLNmLPJ7igO2XSQ.png", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HD1FLLNmLPJ7igO2XSQ.png", lpFilePart=0x8bf650*="HD1FLLNmLPJ7igO2XSQ.png") returned 0x3d [0083.118] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HD1FLLNmLPJ7igO2XSQ.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\hd1fllnmlpj7igo2xsq.png")) returned 0xffffffff [0083.118] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.118] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.118] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HPiFfUsmobc0kOQ6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PiFfUsmobc0kOQ6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iFfUsmobc0kOQ6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FfUsmobc0kOQ6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fUsmobc0kOQ6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Usmobc0kOQ6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="smobc0kOQ6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mobc0kOQ6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="obc0kOQ6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bc0kOQ6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c0kOQ6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0kOQ6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kOQ6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OQ6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rzg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zg.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g.flv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.119] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HPiFfUsmobc0kOQ6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PiFfUsmobc0kOQ6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iFfUsmobc0kOQ6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FfUsmobc0kOQ6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fUsmobc0kOQ6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Usmobc0kOQ6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="smobc0kOQ6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mobc0kOQ6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="obc0kOQ6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bc0kOQ6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c0kOQ6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0kOQ6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kOQ6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OQ6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rzg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zg.flv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.119] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.119] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0083.119] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.119] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.119] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.119] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.119] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0083.120] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.120] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.120] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.120] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.120] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.120] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/HPiFfUsmobc0kOQ6Rzg.flv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cc28 [0083.120] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0083.120] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.120] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.120] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.120] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.120] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.120] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.120] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.120] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.120] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.120] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.120] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.121] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.121] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.121] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0083.121] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.121] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.121] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0083.121] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.121] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0083.121] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.121] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.121] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.121] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.121] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.121] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.121] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0083.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0083.122] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.122] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.122] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.122] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.122] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.122] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.122] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7abd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0083.122] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0083.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0083.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0083.123] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0083.123] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0083.123] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.123] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.123] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0083.124] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.124] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0083.124] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.124] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.124] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.124] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.124] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.124] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.124] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.124] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.124] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.124] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.124] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.124] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.124] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.124] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.124] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.124] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.125] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0083.125] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.125] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0083.125] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.125] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.125] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.125] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.125] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.125] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.125] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.125] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.125] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.125] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.125] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.125] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.126] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.126] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.126] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.126] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.126] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.126] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.126] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.126] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.126] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.126] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.126] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.126] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.126] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.126] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.127] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.127] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.127] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.127] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.127] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.127] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.127] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.127] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.127] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.127] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.127] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.127] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.127] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad38, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0083.128] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0083.128] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0083.128] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.128] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.128] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.128] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.147] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0083.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c50, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.147] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.147] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.147] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.147] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.147] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.147] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0083.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8aeb8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0083.148] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0083.148] CryptHashData (hHash=0xa7cf68, pbData=0x3983bd0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0083.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.148] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.148] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.148] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.148] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.148] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.148] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b4e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0083.149] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0083.149] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cf68, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7caa8) returned 1 [0083.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.149] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.149] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.149] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.149] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.149] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.150] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0083.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a958, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0083.150] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0083.150] CryptDestroyHash (hHash=0xa7cf68) returned 1 [0083.150] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.150] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.150] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.150] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.150] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.151] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/HPiFfUsmobc0kOQ6Rzg.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\hpiffusmobc0koq6rzg.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0083.151] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.151] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0083.152] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.152] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.152] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.152] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0083.152] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.HPiFfUsmobc0kOQ6Rzg.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.hpiffusmobc0koq6rzg.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0083.152] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.153] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.153] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.153] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.155] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0083.155] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0xc8ab, lpOverlapped=0x0) returned 1 [0083.160] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0083.163] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.163] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.163] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.163] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0083.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.164] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0083.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.164] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.164] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.164] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.164] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.165] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.165] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.165] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.165] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.165] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.165] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.165] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.165] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.165] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.165] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.165] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.165] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.165] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.165] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.165] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.165] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.165] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.165] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.165] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.166] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.166] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.166] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.166] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.166] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.166] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b260, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.166] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.166] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xc8ab, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xc8b0) returned 1 [0083.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.167] CharLowerBuffW (in: lpsz="byte[51376]", cchLength=0xb | out: lpsz="byte[51376]") returned 0xb [0083.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.168] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.168] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.168] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.168] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.168] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.168] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.168] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b128, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.169] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.169] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3984050*, pdwDataLen=0x8bef60*=0xc8ab, dwBufLen=0xc8b0 | out: pbData=0x3984050*, pdwDataLen=0x8bef60*=0xc8b0) returned 1 [0083.171] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.171] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.171] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.171] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.171] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.171] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.171] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.171] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.171] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.171] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.171] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.171] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.171] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.171] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.171] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.172] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.172] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.172] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.172] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.172] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.172] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.172] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.172] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.172] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.172] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.172] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.172] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.179] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.179] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.179] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.180] WriteFile (in: hFile=0x240, lpBuffer=0x2cb77e0*, nNumberOfBytesToWrite=0xc8b0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb77e0*, lpNumberOfBytesWritten=0x8bf5e4*=0xc8b0, lpOverlapped=0x0) returned 1 [0083.182] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.182] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.182] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0083.182] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.183] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0083.183] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.183] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.183] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.183] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.183] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.183] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.183] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.183] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac30, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0083.183] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0083.183] CryptDestroyKey (hKey=0xa7caa8) returned 1 [0083.184] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.184] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.184] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.184] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.184] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.184] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.184] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.184] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.184] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.184] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.184] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.184] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.184] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.184] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.184] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.184] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.184] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.184] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.184] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.184] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.184] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.185] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.185] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.185] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.185] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.185] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.185] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.185] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.185] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.185] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.185] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.185] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.185] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.185] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.185] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.185] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.185] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.185] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.185] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.185] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.185] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.185] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.186] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.186] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.186] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.186] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.186] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.186] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.186] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.186] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.186] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.186] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.186] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7abb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0083.186] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0083.187] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0083.187] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.187] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.187] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.187] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.187] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.187] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.187] FreeLibrary (hLibModule=0x76a10000) returned 1 [0083.187] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.187] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.187] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.187] CloseHandle (hObject=0x24c) returned 1 [0083.231] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.231] CloseHandle (hObject=0x240) returned 1 [0083.235] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.239] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.240] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.240] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.240] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/HPiFfUsmobc0kOQ6Rzg.flv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HPiFfUsmobc0kOQ6Rzg.flv", lpFilePart=0x8bedf4*="HPiFfUsmobc0kOQ6Rzg.flv") returned 0x3d [0083.240] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HPiFfUsmobc0kOQ6Rzg.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\hpiffusmobc0koq6rzg.flv")) returned 0x20 [0083.240] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HPiFfUsmobc0kOQ6Rzg.flv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7caa8 [0083.240] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HPiFfUsmobc0kOQ6Rzg.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\hpiffusmobc0koq6rzg.flv")) returned 1 [0083.243] FindNextFileW (in: hFindFile=0xa7caa8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0083.243] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0083.243] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.243] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.243] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.243] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/HPiFfUsmobc0kOQ6Rzg.flv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HPiFfUsmobc0kOQ6Rzg.flv", lpFilePart=0x8bf650*="HPiFfUsmobc0kOQ6Rzg.flv") returned 0x3d [0083.243] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HPiFfUsmobc0kOQ6Rzg.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\hpiffusmobc0koq6rzg.flv")) returned 0xffffffff [0083.243] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.243] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.243] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j3xOnM3C5H UUFiE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3xOnM3C5H UUFiE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xOnM3C5H UUFiE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OnM3C5H UUFiE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nM3C5H UUFiE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M3C5H UUFiE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3C5H UUFiE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C5H UUFiE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5H UUFiE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H UUFiE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" UUFiE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UUFiE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UFiE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FiE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iE2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.244] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j3xOnM3C5H UUFiE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3xOnM3C5H UUFiE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xOnM3C5H UUFiE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OnM3C5H UUFiE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nM3C5H UUFiE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M3C5H UUFiE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3C5H UUFiE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C5H UUFiE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5H UUFiE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H UUFiE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" UUFiE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UUFiE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UFiE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FiE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iE2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E2.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.245] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.245] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0083.245] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.245] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.245] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.245] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.245] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.245] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0083.245] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.245] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.245] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.245] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.245] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.245] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/j3xOnM3C5H UUFiE2.pps", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cda8 [0083.246] FindClose (in: hFindFile=0xa7cda8 | out: hFindFile=0xa7cda8) returned 1 [0083.246] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.246] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.246] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.246] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.246] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.246] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.246] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.246] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.246] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.246] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.246] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.246] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.246] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.246] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0083.247] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.247] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.247] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0083.247] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.247] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0083.247] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.247] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.247] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.247] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.247] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.247] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.247] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0083.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0083.247] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.247] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.248] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.248] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.248] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.248] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.248] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0083.248] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0083.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0083.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0083.248] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0083.249] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0083.249] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.249] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.249] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0083.249] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.249] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0083.249] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.249] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.249] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.250] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.250] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.250] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.250] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.250] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.250] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.250] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.250] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.250] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.251] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.251] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.251] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.252] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.252] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0083.252] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.252] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0083.252] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.252] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.252] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.252] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.252] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.252] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.252] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.252] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.252] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.252] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.252] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.252] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.252] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.252] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.252] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.253] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.253] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.253] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.253] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.253] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.253] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.253] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.253] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.253] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.253] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.253] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.253] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.253] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.253] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.253] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.253] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.253] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.253] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.254] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.254] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.254] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.254] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.254] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.254] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad38, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0083.254] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0083.254] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0083.254] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.254] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.254] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.254] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cc0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.255] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0083.255] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.255] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.255] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.255] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.255] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.255] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.255] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.255] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0083.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8aeb8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0083.255] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0083.255] CryptHashData (hHash=0xa7cf68, pbData=0x3983b40, dwDataLen=0x3, dwFlags=0x1) returned 1 [0083.256] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.256] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.256] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.256] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.256] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.256] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.256] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.256] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.256] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.256] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.256] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.256] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.256] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.256] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b4e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0083.256] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0083.256] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cf68, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cf28) returned 1 [0083.257] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.257] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.257] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.257] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.257] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.257] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.257] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.257] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.257] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.257] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.257] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.257] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0083.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aab8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0083.257] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0083.257] CryptDestroyHash (hHash=0xa7cf68) returned 1 [0083.257] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.257] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.258] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.258] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.258] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.258] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/j3xOnM3C5H UUFiE2.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\j3xonm3c5h uufie2.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0083.259] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.259] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0083.259] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.259] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.259] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.259] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0083.259] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.j3xOnM3C5H UUFiE2.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.j3xonm3c5h uufie2.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0083.260] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.260] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.260] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.260] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.262] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0083.262] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x4475, lpOverlapped=0x0) returned 1 [0083.263] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0083.265] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.265] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.265] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.265] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0083.265] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.265] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0083.266] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.266] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.266] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.266] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.266] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.266] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.266] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.266] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.267] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.267] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.267] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.267] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.267] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.267] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.267] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.267] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.267] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.267] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.267] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.268] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.268] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.268] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.268] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.268] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.268] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.268] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.268] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.268] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.268] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.268] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.269] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.269] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.269] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.269] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.269] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.269] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b260, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.269] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.269] CryptEncrypt (in: hKey=0xa7cf28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x4475, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x4478) returned 1 [0083.269] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.269] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.269] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.270] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.270] CharLowerBuffW (in: lpsz="byte[17528]", cchLength=0xb | out: lpsz="byte[17528]") returned 0xb [0083.270] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.270] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.270] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.270] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.270] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.270] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.270] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.270] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b260, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.270] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.271] CryptEncrypt (in: hKey=0xa7cf28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cc4560*, pdwDataLen=0x8bef60*=0x4475, dwBufLen=0x4478 | out: pbData=0x2cc4560*, pdwDataLen=0x8bef60*=0x4478) returned 1 [0083.271] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.271] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.271] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.271] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.271] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.271] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.271] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.271] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.271] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.272] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.272] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.272] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.272] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.272] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.272] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.272] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.272] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.272] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.272] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.272] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.272] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.272] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.272] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.272] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.272] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.272] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.272] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.273] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.273] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.273] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.273] WriteFile (in: hFile=0x24c, lpBuffer=0x2cd9be0*, nNumberOfBytesToWrite=0x4478, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cd9be0*, lpNumberOfBytesWritten=0x8bf5e4*=0x4478, lpOverlapped=0x0) returned 1 [0083.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.275] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0083.275] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.275] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0083.275] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.275] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.275] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.275] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.275] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.275] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.275] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.275] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8aa98, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0083.275] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0083.275] CryptDestroyKey (hKey=0xa7cf28) returned 1 [0083.275] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.276] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.276] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.276] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.276] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.276] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.276] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.276] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.276] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.276] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.276] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.276] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.276] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.276] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.276] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.276] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.276] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.276] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.276] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.276] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.276] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.276] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.276] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.276] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.277] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.277] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.277] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.277] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.277] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.277] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.277] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.277] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.277] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.277] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.277] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.277] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.277] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.277] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.277] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.277] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.277] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.277] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.277] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.277] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.277] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.277] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.277] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.277] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.278] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.278] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.278] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.278] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.278] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a978, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0083.278] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0083.278] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0083.278] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.278] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.278] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.279] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.279] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.279] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.279] FreeLibrary (hLibModule=0x76a10000) returned 1 [0083.279] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.279] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.279] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.279] CloseHandle (hObject=0x240) returned 1 [0083.280] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.280] CloseHandle (hObject=0x24c) returned 1 [0083.284] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.285] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.285] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.285] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.285] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/j3xOnM3C5H UUFiE2.pps", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\j3xOnM3C5H UUFiE2.pps", lpFilePart=0x8bedf4*="j3xOnM3C5H UUFiE2.pps") returned 0x3b [0083.285] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\j3xOnM3C5H UUFiE2.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\j3xonm3c5h uufie2.pps")) returned 0x20 [0083.286] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\j3xOnM3C5H UUFiE2.pps", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cb28 [0083.286] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\j3xOnM3C5H UUFiE2.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\j3xonm3c5h uufie2.pps")) returned 1 [0083.288] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0083.289] FindClose (in: hFindFile=0xa7cb28 | out: hFindFile=0xa7cb28) returned 1 [0083.289] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.289] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.289] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.289] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/j3xOnM3C5H UUFiE2.pps", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\j3xOnM3C5H UUFiE2.pps", lpFilePart=0x8bf650*="j3xOnM3C5H UUFiE2.pps") returned 0x3b [0083.289] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\j3xOnM3C5H UUFiE2.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\j3xonm3c5h uufie2.pps")) returned 0xffffffff [0083.289] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.289] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.289] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K1kWG.swf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1kWG.swf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kWG.swf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WG.swf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G.swf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.289] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K1kWG.swf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1kWG.swf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kWG.swf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WG.swf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.290] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.290] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0083.290] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.290] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.290] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.290] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.290] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.290] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0083.290] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.290] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.290] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.292] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.292] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.292] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/K1kWG.swf", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cfa8 [0083.292] FindClose (in: hFindFile=0xa7cfa8 | out: hFindFile=0xa7cfa8) returned 1 [0083.292] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.292] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.292] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.292] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.292] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.292] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.292] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.292] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.292] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.292] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.292] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.292] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.292] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.293] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0083.293] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.293] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.293] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0083.293] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.293] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0083.293] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.293] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.293] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.293] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.293] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.293] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.293] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0083.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0083.293] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.293] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.293] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.293] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.294] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.294] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.294] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0083.294] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0083.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0083.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab98, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0083.294] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0083.294] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0083.295] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.295] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.295] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0083.295] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.295] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0083.295] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.295] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.295] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.295] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.295] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.295] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.295] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.295] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.295] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.295] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.295] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.296] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.296] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.296] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.296] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.296] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.296] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0083.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.296] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0083.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.296] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.296] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.296] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.296] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.296] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.296] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.296] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.296] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.297] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.297] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.297] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.297] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.297] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.297] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.297] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.297] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.297] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.297] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.297] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.297] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.297] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.297] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.297] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.297] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.298] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.298] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.298] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.298] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.298] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.298] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.298] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.298] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0083.298] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0083.298] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0083.298] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.298] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.298] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.298] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983bc0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.299] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0083.299] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.299] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.299] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.299] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.299] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.299] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.299] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.299] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0083.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8aeb8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0083.299] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0083.299] CryptHashData (hHash=0xa7cda8, pbData=0x3983bc0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0083.299] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.299] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.299] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.299] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.299] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.300] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.300] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.300] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.300] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.300] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.300] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.300] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.300] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.300] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b3f8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0083.300] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0083.300] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cda8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d128) returned 1 [0083.300] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.300] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.300] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.300] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.300] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.301] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.301] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.301] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.301] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.301] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.301] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.301] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0083.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0083.301] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0083.301] CryptDestroyHash (hHash=0xa7cda8) returned 1 [0083.301] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.301] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.301] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.308] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.308] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.308] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/K1kWG.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\k1kwg.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0083.308] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.309] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0083.309] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.309] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.309] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.309] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0083.309] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.K1kWG.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.k1kwg.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0083.309] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.309] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.309] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.309] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.312] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0083.312] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0083.314] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x85b5, lpOverlapped=0x0) returned 1 [0083.315] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0083.320] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.321] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.322] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.322] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0083.324] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.324] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0083.324] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.324] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.324] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.324] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.324] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.325] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.325] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.325] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.325] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.325] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.325] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.325] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.325] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.325] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.325] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.325] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.325] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.325] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.325] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.325] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.325] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.325] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.326] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.326] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.326] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.326] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.326] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.326] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.326] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.326] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.326] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.326] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.326] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.326] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.326] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.329] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b158, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.330] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.330] CryptEncrypt (in: hKey=0xa7d128, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x185b5, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x185b8) returned 1 [0083.330] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.330] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.330] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.330] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.330] CharLowerBuffW (in: lpsz="byte[99768]", cchLength=0xb | out: lpsz="byte[99768]") returned 0xb [0083.332] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.337] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.337] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.337] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.337] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.337] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.337] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.340] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b068, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.340] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.341] CryptEncrypt (in: hKey=0xa7d128, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x399c610*, pdwDataLen=0x8bef60*=0x185b5, dwBufLen=0x185b8 | out: pbData=0x399c610*, pdwDataLen=0x8bef60*=0x185b8) returned 1 [0083.346] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.346] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.346] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.346] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.349] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.349] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.349] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.349] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.349] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.349] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.350] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.350] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.350] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.350] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.350] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.350] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.350] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.350] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.350] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.350] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.350] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.350] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.350] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.350] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.350] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.350] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.350] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.362] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.362] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.363] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.364] WriteFile (in: hFile=0x240, lpBuffer=0x2ccfda0*, nNumberOfBytesToWrite=0x185b8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2ccfda0*, lpNumberOfBytesWritten=0x8bf5e4*=0x185b8, lpOverlapped=0x0) returned 1 [0083.369] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.369] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.369] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0083.369] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.369] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0083.369] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.369] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.369] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.369] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.369] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.369] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.369] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.369] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8aa08, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0083.370] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0083.370] CryptDestroyKey (hKey=0xa7d128) returned 1 [0083.370] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.370] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.370] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.370] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.370] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.370] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.370] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.371] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.371] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.371] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.371] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.371] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.371] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.371] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.371] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.371] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.371] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.371] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.371] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.371] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.371] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.371] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.371] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.371] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.372] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.372] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.373] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.373] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.373] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.373] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.373] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.373] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.373] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.373] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.373] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.373] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.373] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.374] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.374] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.374] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.374] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.374] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.374] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.374] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.374] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.374] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.374] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.374] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.374] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.374] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.374] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.374] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.374] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aab8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0083.375] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0083.375] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0083.375] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.375] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.375] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.375] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.375] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.375] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.376] FreeLibrary (hLibModule=0x76a10000) returned 1 [0083.376] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.376] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.376] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.376] CloseHandle (hObject=0x24c) returned 1 [0083.377] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.377] CloseHandle (hObject=0x240) returned 1 [0083.382] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.384] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.384] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.384] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.384] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/K1kWG.swf", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\K1kWG.swf", lpFilePart=0x8bedf4*="K1kWG.swf") returned 0x2f [0083.384] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\K1kWG.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\k1kwg.swf")) returned 0x20 [0083.384] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\K1kWG.swf", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cc28 [0083.384] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\K1kWG.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\k1kwg.swf")) returned 1 [0083.386] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0083.386] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0083.387] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.387] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.387] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.387] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/K1kWG.swf", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\K1kWG.swf", lpFilePart=0x8bf650*="K1kWG.swf") returned 0x2f [0083.387] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\K1kWG.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\k1kwg.swf")) returned 0xffffffff [0083.387] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.387] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.387] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lcXeGR.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cXeGR.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XeGR.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eGR.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GR.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.387] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lcXeGR.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cXeGR.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XeGR.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eGR.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GR.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.388] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.388] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0083.388] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.388] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.388] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.388] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.388] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0083.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.388] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/lcXeGR.jpg", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cda8 [0083.388] FindClose (in: hFindFile=0xa7cda8 | out: hFindFile=0xa7cda8) returned 1 [0083.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.389] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.389] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.389] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.389] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.389] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.389] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.389] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.389] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.389] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.389] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.389] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.389] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.389] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0083.389] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.389] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.389] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0083.389] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.389] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0083.389] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.390] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.390] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.390] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.390] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.390] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.390] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0083.390] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0083.390] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.390] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.390] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.390] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.390] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.390] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.390] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a978, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0083.390] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0083.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0083.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0083.391] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0083.391] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0083.392] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.392] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.392] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0083.392] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.392] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0083.392] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.392] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.392] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.392] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.392] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.393] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.393] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.393] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.393] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.393] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.393] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.393] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.393] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.393] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.393] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.393] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.393] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0083.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.393] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0083.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.394] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.394] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.394] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.394] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.394] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.394] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.394] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.394] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.394] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.394] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.394] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.394] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.394] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.394] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.394] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.394] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.394] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.394] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.395] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.395] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.395] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.395] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.397] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.397] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.397] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.397] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.397] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.397] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.398] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.398] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.398] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.398] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.398] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.398] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad68, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0083.398] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0083.398] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0083.398] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.398] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.398] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.398] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.399] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0083.399] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ce0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.399] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.399] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.399] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.399] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.399] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.399] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.399] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0083.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8adb0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0083.399] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0083.399] CryptHashData (hHash=0xa7cda8, pbData=0x3983bb0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0083.399] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.399] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.399] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.399] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.400] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.400] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.400] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.400] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.400] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.400] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.400] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.400] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.400] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.400] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b338, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0083.400] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0083.400] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cda8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cb68) returned 1 [0083.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.401] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.401] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.401] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.401] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.401] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.401] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.401] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0083.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0083.401] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0083.401] CryptDestroyHash (hHash=0xa7cda8) returned 1 [0083.401] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.401] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.401] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.401] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.401] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.402] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/lcXeGR.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lcxegr.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0083.402] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.402] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0083.403] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.403] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.403] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.403] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0083.403] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.lcXeGR.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.lcxegr.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0083.404] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.404] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.404] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.404] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.406] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0083.406] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x2a80, lpOverlapped=0x0) returned 1 [0083.408] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0083.410] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.410] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.410] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.410] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0083.410] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.410] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0083.410] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.410] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.410] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.411] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.411] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.411] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.411] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.411] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.411] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.411] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.411] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.411] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.411] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.411] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.411] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.411] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.411] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.411] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.411] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.411] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.411] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.411] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.411] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.411] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.412] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.412] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.412] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.412] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.412] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.412] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.412] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.412] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b050, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.413] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.413] CryptEncrypt (in: hKey=0xa7cb68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x2a80, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x2a88) returned 1 [0083.413] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.413] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.413] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.413] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.413] CharLowerBuffW (in: lpsz="byte[10888]", cchLength=0xb | out: lpsz="byte[10888]") returned 0xb [0083.413] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.413] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.413] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.414] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.414] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.414] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.414] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.414] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b0e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.414] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.414] CryptEncrypt (in: hKey=0xa7cb68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cbf778*, pdwDataLen=0x8bef60*=0x2a80, dwBufLen=0x2a88 | out: pbData=0x2cbf778*, pdwDataLen=0x8bef60*=0x2a88) returned 1 [0083.415] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.415] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.415] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.415] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.415] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.415] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.415] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.415] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.415] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.415] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.415] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.415] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.415] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.415] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.416] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.416] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.416] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.416] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.420] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.420] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.420] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.420] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.420] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.420] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.420] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.420] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.420] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.421] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.421] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.422] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.422] WriteFile (in: hFile=0x24c, lpBuffer=0x2cba270*, nNumberOfBytesToWrite=0x2a88, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cba270*, lpNumberOfBytesWritten=0x8bf5e4*=0x2a88, lpOverlapped=0x0) returned 1 [0083.423] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.423] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.423] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0083.423] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.423] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0083.424] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.424] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.424] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.424] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.424] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.424] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.424] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.424] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac48, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0083.424] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0083.424] CryptDestroyKey (hKey=0xa7cb68) returned 1 [0083.424] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.424] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.424] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.425] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.425] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.425] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.425] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.425] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.425] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.425] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.425] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.425] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.425] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.425] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.425] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.425] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.425] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.425] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.425] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.425] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.425] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.425] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.425] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.425] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.425] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.426] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.426] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.426] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.426] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.426] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.426] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.426] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.426] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.426] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.426] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.426] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.426] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.426] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.426] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.426] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.426] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.426] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.426] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.426] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.426] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.426] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.426] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.427] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.427] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.427] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.427] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.427] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.427] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ab58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0083.427] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0083.427] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0083.427] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.427] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.427] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.427] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.427] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.427] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.427] FreeLibrary (hLibModule=0x76a10000) returned 1 [0083.428] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.428] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.428] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.428] CloseHandle (hObject=0x240) returned 1 [0083.428] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.429] CloseHandle (hObject=0x24c) returned 1 [0083.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.432] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.432] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.432] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.432] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/lcXeGR.jpg", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lcXeGR.jpg", lpFilePart=0x8bedf4*="lcXeGR.jpg") returned 0x30 [0083.432] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lcXeGR.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lcxegr.jpg")) returned 0x20 [0083.432] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lcXeGR.jpg", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cc28 [0083.432] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lcXeGR.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lcxegr.jpg")) returned 1 [0083.456] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0083.456] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0083.456] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 1 [0083.456] TranslateMessage (lpMsg=0x8bf968) returned 0 [0083.456] DispatchMessageW (lpMsg=0x8bf968) returned 0x0 [0083.457] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0083.457] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0083.457] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.457] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.457] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.457] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/lcXeGR.jpg", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lcXeGR.jpg", lpFilePart=0x8bf650*="lcXeGR.jpg") returned 0x30 [0083.457] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lcXeGR.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lcxegr.jpg")) returned 0xffffffff [0083.457] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.457] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.457] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.458] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LRfe.m4a", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.458] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rfe.m4a", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.458] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fe.m4a", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.458] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e.m4a", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.458] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.458] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LRfe.m4a", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.458] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rfe.m4a", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.458] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fe.m4a", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.458] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.458] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0083.458] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.458] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.458] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.458] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.458] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.458] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0083.458] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.458] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.458] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.458] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.459] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.459] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/LRfe.m4a", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cda8 [0083.459] FindClose (in: hFindFile=0xa7cda8 | out: hFindFile=0xa7cda8) returned 1 [0083.459] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.459] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.459] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.459] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.459] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.459] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.459] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.459] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.459] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.459] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.459] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.459] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.459] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.459] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0083.460] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.460] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.460] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0083.460] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.460] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0083.460] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.460] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.460] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.460] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.460] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.460] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.460] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0083.460] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0083.460] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.460] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.460] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.460] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.461] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.461] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.461] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7acb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0083.461] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0083.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0083.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0083.461] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0083.461] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0083.462] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.462] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.462] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0083.462] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.462] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0083.462] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.462] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.462] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.462] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.462] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.462] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.462] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.462] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.462] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.462] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.462] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.462] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.463] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.463] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.463] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.463] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.463] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0083.463] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.463] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0083.463] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.463] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.463] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.463] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.463] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.463] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.463] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.463] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.463] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.463] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.463] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.463] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.463] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.463] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.463] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.464] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.464] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.464] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.464] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.464] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.464] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.464] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.464] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.464] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.464] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.464] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.464] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.464] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.464] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.464] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.464] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.464] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.464] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.464] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.464] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.464] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.464] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.464] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.464] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ae40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0083.465] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0083.465] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0083.465] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.465] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.465] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.465] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.465] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0083.465] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.465] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.465] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.466] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.466] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.466] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.466] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.466] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0083.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8ad80, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0083.466] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0083.466] CryptHashData (hHash=0xa7d128, pbData=0x3983c40, dwDataLen=0x3, dwFlags=0x1) returned 1 [0083.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.466] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.466] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.466] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.466] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.466] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.466] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.466] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.466] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.467] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.467] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.467] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.467] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b4b8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0083.467] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0083.467] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d128, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cd28) returned 1 [0083.467] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.467] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.527] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.527] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.527] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.527] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.527] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.527] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.527] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.527] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.528] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.528] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0083.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7abb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0083.528] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0083.528] CryptDestroyHash (hHash=0xa7d128) returned 1 [0083.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.528] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.528] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.528] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.528] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.529] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/LRfe.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lrfe.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0083.529] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.529] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0083.529] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.529] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.529] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.529] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0083.529] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.LRfe.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.lrfe.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0083.530] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.530] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.530] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.530] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.533] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0083.533] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x9bb0, lpOverlapped=0x0) returned 1 [0083.534] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0083.537] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.537] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.537] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.537] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0083.537] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.537] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0083.537] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.537] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.538] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.538] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.538] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.538] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.538] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.538] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.538] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.538] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.538] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.538] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.538] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.538] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.538] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.538] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.538] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.538] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.538] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.538] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.538] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.538] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.538] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.538] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.539] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.539] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.539] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.539] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.539] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.539] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.539] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.539] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.539] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.539] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.539] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.539] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b0f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.540] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.540] CryptEncrypt (in: hKey=0xa7cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x9bb0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x9bb8) returned 1 [0083.540] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.540] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.540] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.540] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.540] CharLowerBuffW (in: lpsz="byte[39864]", cchLength=0xb | out: lpsz="byte[39864]") returned 0xb [0083.540] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.542] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.542] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.542] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.542] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.542] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.542] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.542] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b128, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.543] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.543] CryptEncrypt (in: hKey=0xa7cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cd4b08*, pdwDataLen=0x8bef60*=0x9bb0, dwBufLen=0x9bb8 | out: pbData=0x2cd4b08*, pdwDataLen=0x8bef60*=0x9bb8) returned 1 [0083.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.545] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.545] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.545] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.545] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.545] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.545] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.545] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.545] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.545] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.545] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.545] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.545] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.545] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.545] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.545] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.545] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.545] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.545] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.545] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.545] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.546] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.550] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.550] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.551] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.551] WriteFile (in: hFile=0x240, lpBuffer=0x2cb77e0*, nNumberOfBytesToWrite=0x9bb8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb77e0*, lpNumberOfBytesWritten=0x8bf5e4*=0x9bb8, lpOverlapped=0x0) returned 1 [0083.553] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.553] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.553] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0083.553] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.553] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0083.553] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.553] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.553] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.553] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.553] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.553] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.553] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.553] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac60, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0083.554] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0083.554] CryptDestroyKey (hKey=0xa7cd28) returned 1 [0083.554] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.554] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.554] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.554] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.554] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.554] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.554] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.554] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.554] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.554] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.554] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.554] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.554] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.591] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.591] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.591] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.591] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.592] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.592] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.592] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.592] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.592] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.592] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.592] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.592] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.592] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.592] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.592] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.592] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.592] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.592] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.592] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.592] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.592] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.592] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.593] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.593] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.593] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.593] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.593] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.593] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.593] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.593] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.593] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.593] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.593] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.593] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0083.594] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0083.594] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0083.594] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.594] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.596] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.596] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.596] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.596] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.596] FreeLibrary (hLibModule=0x76a10000) returned 1 [0083.596] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.596] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.597] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.597] CloseHandle (hObject=0x24c) returned 1 [0083.598] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.598] CloseHandle (hObject=0x240) returned 1 [0083.601] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.602] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.602] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.602] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.602] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/LRfe.m4a", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LRfe.m4a", lpFilePart=0x8bedf4*="LRfe.m4a") returned 0x2e [0083.602] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LRfe.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lrfe.m4a")) returned 0x20 [0083.602] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LRfe.m4a", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cee8 [0083.603] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LRfe.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lrfe.m4a")) returned 1 [0083.648] FindNextFileW (in: hFindFile=0xa7cee8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0083.648] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0083.648] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.648] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.648] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.648] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/LRfe.m4a", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LRfe.m4a", lpFilePart=0x8bf650*="LRfe.m4a") returned 0x2e [0083.648] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LRfe.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lrfe.m4a")) returned 0xffffffff [0083.648] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.648] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.648] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LvpXw5odR.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vpXw5odR.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pXw5odR.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xw5odR.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w5odR.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5odR.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="odR.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dR.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R.mkv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.649] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LvpXw5odR.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vpXw5odR.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pXw5odR.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xw5odR.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w5odR.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5odR.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="odR.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dR.mkv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.649] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.649] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0083.649] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.649] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.649] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.649] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.650] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.650] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0083.650] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.650] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.650] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.650] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.650] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.650] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/LvpXw5odR.mkv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d068 [0083.650] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0083.650] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.650] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.650] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.651] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.651] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.651] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.651] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.651] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.651] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.651] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.651] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.651] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.651] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.651] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0083.651] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.651] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.651] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0083.651] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.651] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0083.651] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.652] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.652] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.652] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.652] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.652] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.652] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0083.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0083.652] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.652] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.652] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.652] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.652] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.652] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.652] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0083.652] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0083.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0083.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab98, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0083.653] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0083.653] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0083.653] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.653] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.653] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0083.653] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.654] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0083.654] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.654] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.654] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.654] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.654] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.654] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.654] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.654] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.654] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.654] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.654] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.654] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.654] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.654] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.654] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.654] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.654] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0083.654] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.654] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0083.655] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.655] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.655] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.655] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.655] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.655] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.655] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.655] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.655] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.655] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.655] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.655] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.655] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.655] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.743] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.743] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.743] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.743] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.743] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.743] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.743] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.743] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.743] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.743] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.743] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.743] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.743] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.743] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.743] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.743] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.743] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.744] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.744] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.744] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.744] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.744] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.744] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.744] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.744] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af30, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0083.744] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0083.744] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0083.744] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.745] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.745] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.745] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ce0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.745] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0083.745] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983af0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.745] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.745] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.745] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.745] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.745] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.745] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.745] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0083.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8af90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0083.746] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0083.746] CryptHashData (hHash=0xa7ce28, pbData=0x3983ce0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0083.746] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.746] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.746] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.746] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.746] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.746] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.746] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.746] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.746] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.746] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.746] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.746] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.746] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.746] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b338, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0083.747] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0083.747] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7ce28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cc28) returned 1 [0083.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.747] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.747] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.747] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.747] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.747] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.747] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0083.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7abb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0083.748] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0083.748] CryptDestroyHash (hHash=0xa7ce28) returned 1 [0083.748] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.748] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.748] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.748] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.748] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.749] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/LvpXw5odR.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lvpxw5odr.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0083.749] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.749] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0083.749] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.749] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.749] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.749] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0083.749] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.LvpXw5odR.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.lvpxw5odr.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0083.750] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.750] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.750] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.750] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.754] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0083.754] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0083.756] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x2f6c, lpOverlapped=0x0) returned 1 [0083.756] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0083.761] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.762] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.762] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.762] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0083.763] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.763] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0083.764] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.764] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.764] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.764] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.764] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.764] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.764] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.764] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.764] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.764] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.764] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.764] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.764] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.764] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.764] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.764] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.764] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.764] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.764] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.764] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.765] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.765] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.765] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.765] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.765] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.765] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.765] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.765] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.765] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.765] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.765] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.765] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.765] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.765] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.765] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.769] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.769] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.770] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x12f6c, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x12f70) returned 1 [0083.770] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.770] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.770] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.770] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.770] CharLowerBuffW (in: lpsz="byte[77680]", cchLength=0xb | out: lpsz="byte[77680]") returned 0xb [0083.772] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.774] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.774] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.774] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.774] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.774] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.775] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.776] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b1a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.776] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.776] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3996fc8*, pdwDataLen=0x8bef60*=0x12f6c, dwBufLen=0x12f70 | out: pbData=0x3996fc8*, pdwDataLen=0x8bef60*=0x12f70) returned 1 [0083.779] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.779] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.779] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.779] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.801] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.801] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.801] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.801] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.801] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.801] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.801] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.801] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.801] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.801] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.801] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.802] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.802] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.802] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.802] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.802] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.802] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.802] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.802] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.802] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.802] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.802] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.802] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.807] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.807] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.807] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.808] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb77e0*, nNumberOfBytesToWrite=0x12f70, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb77e0*, lpNumberOfBytesWritten=0x8bf5e4*=0x12f70, lpOverlapped=0x0) returned 1 [0083.812] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.812] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.812] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0083.812] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.812] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0083.812] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.812] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.812] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.812] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.812] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.812] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.812] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.812] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8aca8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0083.813] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0083.813] CryptDestroyKey (hKey=0xa7cc28) returned 1 [0083.813] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.813] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.813] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.814] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.814] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.814] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.814] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.814] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.814] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.814] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.814] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.814] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.814] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.814] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.814] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.814] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.814] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.814] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.814] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.814] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.814] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.814] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.815] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.815] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.815] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.815] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.815] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.815] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.815] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.815] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.815] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.815] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.815] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.815] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.815] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.815] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.815] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.815] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.815] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.815] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.815] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.815] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.815] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.815] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.816] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.816] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.816] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.816] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.816] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.816] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.816] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.816] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.816] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0083.816] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0083.816] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0083.816] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.816] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.816] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.816] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.817] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.817] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.817] FreeLibrary (hLibModule=0x76a10000) returned 1 [0083.817] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.817] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.817] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.817] CloseHandle (hObject=0x240) returned 1 [0083.817] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.817] CloseHandle (hObject=0x24c) returned 1 [0083.821] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.823] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.823] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.823] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.823] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/LvpXw5odR.mkv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LvpXw5odR.mkv", lpFilePart=0x8bedf4*="LvpXw5odR.mkv") returned 0x33 [0083.823] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LvpXw5odR.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lvpxw5odr.mkv")) returned 0x20 [0083.823] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LvpXw5odR.mkv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0083.823] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LvpXw5odR.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lvpxw5odr.mkv")) returned 1 [0083.832] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0083.832] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0083.832] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.832] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.832] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.832] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/LvpXw5odR.mkv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LvpXw5odR.mkv", lpFilePart=0x8bf650*="LvpXw5odR.mkv") returned 0x33 [0083.833] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LvpXw5odR.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lvpxw5odr.mkv")) returned 0xffffffff [0083.833] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.833] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.833] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="miHZX-Mq6_uJj5Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHZX-Mq6_uJj5Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HZX-Mq6_uJj5Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZX-Mq6_uJj5Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-Mq6_uJj5Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Mq6_uJj5Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mq6_uJj5Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q6_uJj5Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6_uJj5Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_uJj5Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uJj5Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jj5Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j5Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jr.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.833] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="miHZX-Mq6_uJj5Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHZX-Mq6_uJj5Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HZX-Mq6_uJj5Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZX-Mq6_uJj5Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-Mq6_uJj5Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Mq6_uJj5Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mq6_uJj5Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.834] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q6_uJj5Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.834] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6_uJj5Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.834] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_uJj5Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.834] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uJj5Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.834] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jj5Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.834] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j5Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.834] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0083.834] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jr.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.834] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.834] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0083.834] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.834] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.834] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.834] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.834] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.834] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0083.834] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.834] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.834] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.834] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.834] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.834] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/miHZX-Mq6_uJj5Jr.bmp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7ce28 [0083.835] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0083.835] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.835] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.835] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.835] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.835] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.835] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.835] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.835] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.835] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.835] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.835] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.835] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.835] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.835] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0083.836] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.836] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.836] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0083.836] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.836] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0083.836] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.836] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.837] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.838] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.838] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.838] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.838] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0083.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0083.838] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.838] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.838] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.838] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.838] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.838] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.838] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a978, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0083.838] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0083.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0083.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a9b8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0083.839] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0083.839] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0083.839] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.839] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.839] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0083.839] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.839] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0083.839] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.840] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.840] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.840] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.840] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.840] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.840] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.840] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.840] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.840] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.840] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.840] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.840] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.840] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.840] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.840] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.840] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0083.840] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.840] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0083.840] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.840] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.841] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.841] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.841] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.841] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.841] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.841] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.841] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.841] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.841] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.841] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.841] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.841] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.841] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.841] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.841] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.841] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.841] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.841] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.841] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.841] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.841] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.841] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.842] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.842] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.842] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.842] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.842] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.842] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.842] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.842] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.842] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.842] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.842] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.842] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.842] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.842] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.842] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0083.843] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0083.843] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0083.843] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.843] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.843] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.843] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983bc0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.843] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0083.843] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983bf0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.843] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.843] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.843] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.843] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.843] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.843] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.844] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0083.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8ad80, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0083.844] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0083.844] CryptHashData (hHash=0xa7cfa8, pbData=0x3983ca0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0083.844] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.844] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.845] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.845] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.845] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.845] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.845] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.845] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.845] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.845] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.845] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.845] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.845] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.845] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b578, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0083.845] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0083.846] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cfa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d168) returned 1 [0083.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.846] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.846] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.846] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.846] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.846] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.846] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0083.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7abb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0083.847] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0083.847] CryptDestroyHash (hHash=0xa7cfa8) returned 1 [0083.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.847] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.847] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.847] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.847] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.848] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/miHZX-Mq6_uJj5Jr.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mihzx-mq6_ujj5jr.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0083.848] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.848] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0083.848] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.848] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.848] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.848] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0083.849] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.miHZX-Mq6_uJj5Jr.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.mihzx-mq6_ujj5jr.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0083.849] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.849] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.849] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.849] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.852] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0083.852] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x7fdd, lpOverlapped=0x0) returned 1 [0083.854] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0083.857] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.857] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.857] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.857] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0083.857] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.858] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0083.858] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.858] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.858] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.859] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.859] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.859] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.859] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.859] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.859] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.859] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.859] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.860] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.860] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.860] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.860] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.860] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.860] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.860] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.860] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.860] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.860] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.861] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.861] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.861] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.861] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.861] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.861] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.861] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.861] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.861] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.861] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.861] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b0f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.862] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.862] CryptEncrypt (in: hKey=0xa7d168, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x7fdd, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x7fe0) returned 1 [0083.862] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.862] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.862] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.862] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.862] CharLowerBuffW (in: lpsz="byte[32736]", cchLength=0xb | out: lpsz="byte[32736]") returned 0xb [0083.862] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.863] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.863] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.863] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.863] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.863] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.863] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.863] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b1d0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.863] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.863] CryptEncrypt (in: hKey=0xa7d168, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ccf798*, pdwDataLen=0x8bef60*=0x7fdd, dwBufLen=0x7fe0 | out: pbData=0x2ccf798*, pdwDataLen=0x8bef60*=0x7fe0) returned 1 [0083.865] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.865] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.865] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.865] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.865] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.865] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.865] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.865] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.865] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.865] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.865] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.865] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.865] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.865] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.865] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.865] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.865] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.865] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.865] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.865] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.866] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.866] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.866] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.866] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.866] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.866] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.866] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.870] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.870] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.870] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.871] WriteFile (in: hFile=0x240, lpBuffer=0x2cbf7c8*, nNumberOfBytesToWrite=0x7fe0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cbf7c8*, lpNumberOfBytesWritten=0x8bf5e4*=0x7fe0, lpOverlapped=0x0) returned 1 [0083.872] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.872] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.872] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0083.872] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.872] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0083.872] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.872] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.872] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.872] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.872] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.873] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.873] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.873] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8aca8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0083.873] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0083.873] CryptDestroyKey (hKey=0xa7d168) returned 1 [0083.873] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.873] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.873] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.873] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.873] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.873] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.873] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.874] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.874] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.874] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.874] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.874] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.874] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.874] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.874] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.874] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.874] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.874] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.874] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.874] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.874] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.874] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.874] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.874] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.874] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.875] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.875] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.875] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.875] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.875] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.875] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.875] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.875] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.875] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.875] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.875] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.875] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.875] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.875] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.875] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.876] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.876] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.876] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.876] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.876] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.876] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.876] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.876] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.876] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.876] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.876] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.894] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.894] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0083.894] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0083.894] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0083.894] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.894] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.894] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.894] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.894] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.894] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.895] FreeLibrary (hLibModule=0x76a10000) returned 1 [0083.895] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.895] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.895] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.895] CloseHandle (hObject=0x24c) returned 1 [0083.897] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.897] CloseHandle (hObject=0x240) returned 1 [0083.900] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.900] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.900] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.900] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.901] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/miHZX-Mq6_uJj5Jr.bmp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\miHZX-Mq6_uJj5Jr.bmp", lpFilePart=0x8bedf4*="miHZX-Mq6_uJj5Jr.bmp") returned 0x3a [0083.901] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\miHZX-Mq6_uJj5Jr.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mihzx-mq6_ujj5jr.bmp")) returned 0x20 [0083.901] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\miHZX-Mq6_uJj5Jr.bmp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7ce28 [0083.901] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\miHZX-Mq6_uJj5Jr.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mihzx-mq6_ujj5jr.bmp")) returned 1 [0083.939] FindNextFileW (in: hFindFile=0xa7ce28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0083.939] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0083.940] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.940] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.940] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.940] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/miHZX-Mq6_uJj5Jr.bmp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\miHZX-Mq6_uJj5Jr.bmp", lpFilePart=0x8bf650*="miHZX-Mq6_uJj5Jr.bmp") returned 0x3a [0083.940] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\miHZX-Mq6_uJj5Jr.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mihzx-mq6_ujj5jr.bmp")) returned 0xffffffff [0083.940] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.940] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.940] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.940] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MLN9.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.940] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LN9.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.940] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N9.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0083.940] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0083.940] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.940] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MLN9.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.940] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LN9.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.940] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N9.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0083.940] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0083.940] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0083.941] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.941] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.941] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0083.941] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0083.941] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.941] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0083.941] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.941] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.941] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.941] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.941] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.941] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/MLN9.csv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d068 [0083.941] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0083.941] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.941] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.941] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.942] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.942] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.942] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.942] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.942] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.942] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.942] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.942] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.942] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.942] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.942] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0083.942] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.942] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.942] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0083.942] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.942] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0083.942] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.942] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.942] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.942] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.943] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.943] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.943] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0083.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0083.943] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.943] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.943] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.943] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.943] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.943] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0083.943] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0083.943] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0083.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0083.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7acf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0083.943] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0083.944] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0083.944] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.944] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.944] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0083.944] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.944] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0083.944] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.944] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.944] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.944] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.944] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.944] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.944] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.945] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.945] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.945] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.945] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.945] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.945] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.945] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.945] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.945] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.945] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0083.945] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.945] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0083.945] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.945] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.945] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.945] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.945] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.945] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.945] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.945] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.945] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.945] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.945] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.946] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.946] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.946] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.946] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.946] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.946] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.946] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.946] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.946] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.946] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.946] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.946] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.946] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.946] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.946] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.946] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.946] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.946] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.946] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.946] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.946] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.946] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.947] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.947] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.947] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.947] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.947] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.947] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8aeb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0083.947] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0083.947] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0083.947] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.947] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.947] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.947] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ce0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.948] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0083.948] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0083.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b80, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0083.948] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.948] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.948] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.948] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.948] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.948] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.961] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0083.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8ad50, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0083.961] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0083.961] CryptHashData (hHash=0xa7ce28, pbData=0x3983af0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0083.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.961] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.961] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.961] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.961] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.961] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.962] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.962] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.962] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.962] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.962] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.962] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0083.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b338, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0083.962] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0083.962] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7ce28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d0a8) returned 1 [0083.962] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.962] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.962] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.962] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.962] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.962] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.962] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.962] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.962] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.963] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.963] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0083.963] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0083.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7abb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0083.963] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0083.963] CryptDestroyHash (hHash=0xa7ce28) returned 1 [0083.963] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.963] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.963] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.963] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.963] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.963] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/MLN9.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mln9.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0083.963] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.964] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0083.964] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.964] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.964] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.964] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0083.964] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.MLN9.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.mln9.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0083.964] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.964] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.964] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.964] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.967] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0083.967] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x1f1f, lpOverlapped=0x0) returned 1 [0083.968] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0083.971] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.971] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.971] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.971] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0083.971] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.971] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0083.971] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.971] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.971] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.971] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.971] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.971] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.972] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.972] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0083.972] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.972] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0083.972] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.972] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.972] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.972] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.972] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.972] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.972] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.972] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.972] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.972] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0083.972] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.972] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0083.972] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.972] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.972] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.972] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.972] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.973] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.973] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.973] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.973] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.973] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.973] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.973] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.973] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.973] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b050, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.973] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.973] CryptEncrypt (in: hKey=0xa7d0a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x1f1f, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x1f20) returned 1 [0083.973] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.973] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.973] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.973] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.974] CharLowerBuffW (in: lpsz="byte[7968]", cchLength=0xa | out: lpsz="byte[7968]") returned 0xa [0083.974] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.974] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.974] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.974] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.974] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.974] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.974] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0083.974] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0083.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b200, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0083.974] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0083.974] CryptEncrypt (in: hKey=0xa7d0a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cbd558*, pdwDataLen=0x8bef60*=0x1f1f, dwBufLen=0x1f20 | out: pbData=0x2cbd558*, pdwDataLen=0x8bef60*=0x1f20) returned 1 [0083.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.975] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.975] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.975] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.975] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.975] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.975] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.975] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.975] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.975] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.975] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.975] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.976] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0083.976] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.976] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.976] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.976] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.976] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.976] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0083.976] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.976] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0083.976] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0083.976] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.976] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.976] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.976] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb9708*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb9708*, lpNumberOfBytesWritten=0x8bf5e4*=0x1f20, lpOverlapped=0x0) returned 1 [0083.977] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.977] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.978] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0083.978] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.978] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0083.978] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.978] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.978] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.978] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.993] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.993] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.993] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0083.993] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0083.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8abd0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0083.994] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0083.994] CryptDestroyKey (hKey=0xa7d0a8) returned 1 [0083.994] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.994] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.994] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.994] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.994] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.994] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.994] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.994] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.994] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.994] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.994] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.994] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.994] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0083.994] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.994] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.994] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.994] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.995] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.995] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0083.995] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.995] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0083.995] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.995] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0083.995] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.995] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0083.995] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.995] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0083.995] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.995] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.995] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0083.995] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.995] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0083.995] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.995] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.995] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0083.995] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.995] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0083.995] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.995] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0083.995] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.996] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0083.996] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.996] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.996] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.996] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.996] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.996] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.996] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0083.996] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.996] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0083.996] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.996] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.996] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0083.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0083.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0083.996] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0083.996] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0083.996] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.997] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0083.997] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.997] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0083.997] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.997] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0083.997] FreeLibrary (hLibModule=0x76a10000) returned 1 [0083.997] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.997] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0083.997] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.997] CloseHandle (hObject=0x240) returned 1 [0083.998] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0083.998] CloseHandle (hObject=0x24c) returned 1 [0083.999] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.000] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.000] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.000] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.000] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/MLN9.csv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MLN9.csv", lpFilePart=0x8bedf4*="MLN9.csv") returned 0x2e [0084.000] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MLN9.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mln9.csv")) returned 0x20 [0084.001] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MLN9.csv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0084.001] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MLN9.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mln9.csv")) returned 1 [0084.004] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0084.004] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0084.004] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.004] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.004] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.004] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/MLN9.csv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MLN9.csv", lpFilePart=0x8bf650*="MLN9.csv") returned 0x2e [0084.005] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MLN9.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mln9.csv")) returned 0xffffffff [0084.005] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.005] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.005] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="my4LIyozfPFM.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y4LIyozfPFM.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4LIyozfPFM.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LIyozfPFM.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IyozfPFM.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yozfPFM.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ozfPFM.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zfPFM.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fPFM.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PFM.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FM.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.005] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="my4LIyozfPFM.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y4LIyozfPFM.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4LIyozfPFM.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LIyozfPFM.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IyozfPFM.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yozfPFM.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ozfPFM.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zfPFM.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fPFM.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PFM.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FM.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.006] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.006] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0084.006] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.006] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.006] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.006] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.006] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.006] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0084.006] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.006] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.006] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.006] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.006] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.006] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/my4LIyozfPFM.mp4", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cc28 [0084.007] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0084.007] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.007] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.007] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.007] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.007] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.007] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.007] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.007] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.007] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.007] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.007] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.007] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.007] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.007] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0084.008] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.008] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.008] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0084.008] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.008] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0084.008] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.008] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.008] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.008] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.008] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.008] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.008] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0084.008] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0084.008] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.008] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.008] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.009] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.009] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.009] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.009] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0084.009] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0084.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0084.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7acb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0084.009] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0084.009] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0084.010] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.010] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.010] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0084.010] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.010] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0084.010] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.010] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.010] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.010] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.010] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.010] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.010] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.010] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.010] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.010] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.010] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.010] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.010] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.011] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.011] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.011] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.011] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0084.011] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.015] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0084.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.015] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.015] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.015] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.015] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.015] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.015] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.015] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.015] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.015] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.015] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.015] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.015] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.015] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.016] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.016] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.016] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.018] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.018] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.018] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.018] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.018] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.018] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.018] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.018] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.019] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad80, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0084.019] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0084.019] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0084.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c50, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.019] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0084.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b30, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.020] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.020] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.020] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8ad50, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0084.020] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0084.020] CryptHashData (hHash=0xa7cfa8, pbData=0x3983b20, dwDataLen=0x3, dwFlags=0x1) returned 1 [0084.020] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.020] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.020] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.020] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.020] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.021] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.021] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.021] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.021] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.021] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.021] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0084.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0084.021] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0084.021] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cfa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cda8) returned 1 [0084.021] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.021] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.021] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.021] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.021] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.021] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.021] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.022] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.022] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.022] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.022] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.022] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0084.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0084.022] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0084.022] CryptDestroyHash (hHash=0xa7cfa8) returned 1 [0084.022] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.022] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.022] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.022] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.022] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.022] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/my4LIyozfPFM.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\my4liyozfpfm.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0084.023] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.023] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0084.023] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.023] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.023] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.023] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0084.023] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.my4LIyozfPFM.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.my4liyozfpfm.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0084.024] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.024] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.024] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.024] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.026] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0084.026] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x724a, lpOverlapped=0x0) returned 1 [0084.027] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0084.029] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.029] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.029] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.029] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0084.030] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.030] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0084.030] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.030] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.030] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.030] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.030] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.030] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.030] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.030] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.030] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.030] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.030] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.030] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.030] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.030] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.031] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.031] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.031] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.031] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.031] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.031] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.031] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.031] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.031] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.031] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.031] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.031] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.031] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.031] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.031] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.031] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.031] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.031] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.031] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.032] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.033] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.034] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b0e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.034] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.034] CryptEncrypt (in: hKey=0xa7cda8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x724a, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x7250) returned 1 [0084.034] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.034] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.036] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.036] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.036] CharLowerBuffW (in: lpsz="byte[29264]", cchLength=0xb | out: lpsz="byte[29264]") returned 0xb [0084.036] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.037] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.037] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.037] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.037] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.037] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.037] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.037] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b260, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.037] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.037] CryptEncrypt (in: hKey=0xa7cda8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cccee8*, pdwDataLen=0x8bef60*=0x724a, dwBufLen=0x7250 | out: pbData=0x2cccee8*, pdwDataLen=0x8bef60*=0x7250) returned 1 [0084.038] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.038] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.038] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.038] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.038] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.038] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.039] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.039] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.039] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.039] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.039] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.039] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.039] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.039] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.039] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.039] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.039] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.039] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.039] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.039] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.039] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.039] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.039] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.039] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.039] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.039] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.039] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.044] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.044] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.044] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.045] WriteFile (in: hFile=0x240, lpBuffer=0x2cbea38*, nNumberOfBytesToWrite=0x7250, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cbea38*, lpNumberOfBytesWritten=0x8bf5e4*=0x7250, lpOverlapped=0x0) returned 1 [0084.046] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.046] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.046] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0084.046] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.046] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0084.046] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.046] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.047] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.047] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.047] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.047] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.047] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.047] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac30, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0084.047] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0084.048] CryptDestroyKey (hKey=0xa7cda8) returned 1 [0084.048] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.048] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.048] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.048] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.048] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.048] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.048] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.048] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.048] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.048] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.048] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.048] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.048] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.048] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.048] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.048] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.048] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.048] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.048] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.049] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.049] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.049] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.049] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.049] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.049] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.049] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.049] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.049] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.049] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.049] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.049] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.049] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.049] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.049] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.049] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.049] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.049] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.049] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.049] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.049] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.049] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.050] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.050] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.050] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.050] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.050] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.050] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.050] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.050] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.050] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.050] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.050] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.050] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0084.050] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0084.050] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0084.050] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.050] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.050] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.051] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.051] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.051] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.051] FreeLibrary (hLibModule=0x76a10000) returned 1 [0084.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.051] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.051] CloseHandle (hObject=0x24c) returned 1 [0084.053] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.053] CloseHandle (hObject=0x240) returned 1 [0084.054] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.055] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.055] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.055] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.055] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/my4LIyozfPFM.mp4", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\my4LIyozfPFM.mp4", lpFilePart=0x8bedf4*="my4LIyozfPFM.mp4") returned 0x36 [0084.055] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\my4LIyozfPFM.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\my4liyozfpfm.mp4")) returned 0x20 [0084.056] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\my4LIyozfPFM.mp4", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cc28 [0084.056] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\my4LIyozfPFM.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\my4liyozfpfm.mp4")) returned 1 [0084.059] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0084.059] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0084.059] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.059] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.059] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.059] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/my4LIyozfPFM.mp4", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\my4LIyozfPFM.mp4", lpFilePart=0x8bf650*="my4LIyozfPFM.mp4") returned 0x36 [0084.059] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\my4LIyozfPFM.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\my4liyozfpfm.mp4")) returned 0xffffffff [0084.060] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.060] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.060] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PiMy.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iMy.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="My.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.060] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PiMy.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iMy.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="My.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.060] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.060] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0084.060] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.060] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.060] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.060] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.060] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.060] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0084.060] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.060] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.060] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.060] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.060] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.061] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/PiMy.wav", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cee8 [0084.061] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0084.061] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.061] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.061] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.061] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.062] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.062] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.062] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.062] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.062] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.062] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.062] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.062] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.062] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.062] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0084.062] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.062] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.062] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0084.062] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.062] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0084.062] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.062] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.062] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.063] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.063] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.063] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.063] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0084.063] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0084.063] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.063] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.063] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.063] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.063] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.063] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.063] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0084.064] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0084.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0084.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7abb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0084.064] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0084.064] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0084.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.065] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.065] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0084.065] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.065] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0084.065] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.065] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.065] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.065] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.065] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.065] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.065] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.065] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.065] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.065] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.065] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.065] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.065] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.065] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.065] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.065] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.066] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0084.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.066] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0084.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.066] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.066] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.066] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.066] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.066] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.066] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.066] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.066] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.066] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.066] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.066] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.067] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.067] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.067] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.067] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.067] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.067] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.067] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.067] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.067] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.067] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.067] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.067] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.067] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.067] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.067] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.067] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.067] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.067] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.067] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.067] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad80, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0084.068] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0084.068] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0084.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.068] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0084.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ba0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.069] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.069] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.069] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.069] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.069] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.069] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8af90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0084.069] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0084.069] CryptHashData (hHash=0xa7d0e8, pbData=0x3983b50, dwDataLen=0x3, dwFlags=0x1) returned 1 [0084.069] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.069] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.069] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.069] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.069] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.069] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.069] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.069] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.070] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.070] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.070] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.070] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.070] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.070] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0084.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b3f8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0084.070] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0084.070] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d0e8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7caa8) returned 1 [0084.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.070] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.070] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.070] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.071] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.071] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.071] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0084.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0084.071] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0084.071] CryptDestroyHash (hHash=0xa7d0e8) returned 1 [0084.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.071] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.071] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.071] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.071] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.071] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/PiMy.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\pimy.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0084.071] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.072] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0084.072] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.072] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.072] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.073] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0084.073] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.PiMy.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.pimy.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0084.073] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.073] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.073] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.073] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.076] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0084.076] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x72d, lpOverlapped=0x0) returned 1 [0084.076] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0084.078] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.079] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.079] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.079] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0084.079] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.079] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0084.079] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.080] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.080] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.080] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.080] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.080] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.080] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.080] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.080] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.080] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.080] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.080] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.080] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.080] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.080] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.080] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.080] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.081] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.081] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.081] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.081] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.081] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.081] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b068, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.081] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.082] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x72d, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x730) returned 1 [0084.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.082] CharLowerBuffW (in: lpsz="byte[1840]", cchLength=0xa | out: lpsz="byte[1840]") returned 0xa [0084.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.082] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.082] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.082] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.082] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.082] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.082] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b158, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.082] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.082] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cb8650*, pdwDataLen=0x8bef60*=0x72d, dwBufLen=0x730 | out: pbData=0x2cb8650*, pdwDataLen=0x8bef60*=0x730) returned 1 [0084.083] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.083] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.083] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.083] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.083] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.083] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.083] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.083] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.083] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.083] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.083] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.083] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.083] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.083] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.083] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.083] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.083] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.083] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.083] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.084] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.084] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.084] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.084] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.084] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.084] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.084] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.084] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.084] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb77e0*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb77e0*, lpNumberOfBytesWritten=0x8bf5e4*=0x730, lpOverlapped=0x0) returned 1 [0084.085] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.085] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.085] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0084.085] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.085] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0084.085] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.085] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.085] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.085] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.086] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.086] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.086] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.086] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8aca8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0084.086] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0084.086] CryptDestroyKey (hKey=0xa7caa8) returned 1 [0084.086] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.086] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.086] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.086] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.086] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.086] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.086] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.087] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.087] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.087] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.087] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.087] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.087] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.087] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.087] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.087] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.087] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.087] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.087] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.087] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.087] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.087] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.087] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.087] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.087] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.087] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.087] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.087] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.088] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.088] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.088] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.088] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.088] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.088] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.090] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.090] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.090] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.090] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.090] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.090] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.090] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.090] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.090] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.090] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.090] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.090] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.090] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.090] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.091] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.091] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.091] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.091] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.091] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a998, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0084.091] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0084.091] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0084.091] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.091] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.091] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.091] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.091] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.091] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.091] FreeLibrary (hLibModule=0x76a10000) returned 1 [0084.091] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.092] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.092] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.092] CloseHandle (hObject=0x240) returned 1 [0084.092] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.092] CloseHandle (hObject=0x24c) returned 1 [0084.096] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.096] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.096] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.096] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.096] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/PiMy.wav", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PiMy.wav", lpFilePart=0x8bedf4*="PiMy.wav") returned 0x2e [0084.096] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PiMy.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\pimy.wav")) returned 0x20 [0084.096] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PiMy.wav", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cee8 [0084.097] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PiMy.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\pimy.wav")) returned 1 [0084.100] FindNextFileW (in: hFindFile=0xa7cee8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0084.100] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0084.100] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.100] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.100] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.100] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/PiMy.wav", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PiMy.wav", lpFilePart=0x8bf650*="PiMy.wav") returned 0x2e [0084.100] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PiMy.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\pimy.wav")) returned 0xffffffff [0084.101] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.101] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.101] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Qro3U.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ro3U.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o3U.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3U.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.101] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Qro3U.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ro3U.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o3U.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3U.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.101] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.101] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0084.101] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.101] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.101] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.101] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.101] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.101] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0084.101] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.101] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.102] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.102] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.102] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.102] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Qro3U.bmp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d128 [0084.102] FindClose (in: hFindFile=0xa7d128 | out: hFindFile=0xa7d128) returned 1 [0084.102] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.102] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.102] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.102] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.102] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.102] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.102] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.102] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.102] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.102] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.103] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.103] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.103] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.103] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0084.103] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.103] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.103] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0084.103] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.103] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0084.103] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.103] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.103] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.103] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.103] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.103] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.103] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0084.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0084.103] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.103] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.104] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.104] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.104] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.104] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.104] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7abb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0084.104] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0084.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0084.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa98, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0084.104] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0084.104] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0084.105] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.105] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.105] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0084.105] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.105] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0084.105] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.105] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.105] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.105] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.105] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.105] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.105] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.105] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.105] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.105] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.106] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.106] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.106] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.106] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.106] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.106] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.106] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0084.106] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.106] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0084.106] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.106] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.106] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.106] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.106] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.106] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.106] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.106] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.106] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.106] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.106] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.106] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.107] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.107] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.107] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.107] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.107] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.107] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.107] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.107] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.107] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.107] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.107] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.107] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.107] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.107] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.107] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.107] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.107] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.107] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.107] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.107] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.107] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.107] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.107] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.120] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.120] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.120] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.120] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8aed0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0084.120] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0084.120] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0084.121] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.121] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.121] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.121] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c20, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.121] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0084.121] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.121] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.121] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.121] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.121] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.121] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.121] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.121] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8ad80, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0084.122] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0084.122] CryptHashData (hHash=0xa7d0a8, pbData=0x3983b00, dwDataLen=0x3, dwFlags=0x1) returned 1 [0084.122] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.122] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.122] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.122] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.122] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.122] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.122] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.122] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.122] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.122] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.122] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.122] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.122] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.122] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0084.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b350, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0084.123] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0084.123] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d0a8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cca8) returned 1 [0084.123] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.123] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.123] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.123] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.123] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.123] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.123] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.123] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.123] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.123] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.123] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.123] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0084.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aa38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0084.124] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0084.124] CryptDestroyHash (hHash=0xa7d0a8) returned 1 [0084.124] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.124] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.124] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.124] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.124] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.125] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Qro3U.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\qro3u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0084.125] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.125] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0084.125] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.125] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.125] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.125] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0084.128] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.Qro3U.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.qro3u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0084.132] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.132] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.132] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.132] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.134] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0084.134] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0xbdc3, lpOverlapped=0x0) returned 1 [0084.136] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0084.139] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.139] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.139] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.139] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0084.139] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.140] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0084.140] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.140] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.140] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.140] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.140] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.140] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.140] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.140] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.140] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.140] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.140] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.140] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.140] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.140] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.140] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.140] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.140] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.140] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.140] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.141] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.141] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.141] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.141] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.141] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.141] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.141] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.141] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.141] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.141] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.141] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.141] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.141] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.142] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.142] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.142] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.142] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b1d0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.142] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.142] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xbdc3, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xbdc8) returned 1 [0084.142] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.142] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.143] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.143] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.143] CharLowerBuffW (in: lpsz="byte[48584]", cchLength=0xb | out: lpsz="byte[48584]") returned 0xb [0084.143] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.144] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.144] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.144] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.144] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.144] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.145] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.145] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b128, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.145] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.145] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cdb150*, pdwDataLen=0x8bef60*=0xbdc3, dwBufLen=0xbdc8 | out: pbData=0x2cdb150*, pdwDataLen=0x8bef60*=0xbdc8) returned 1 [0084.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.147] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.147] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.147] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.147] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.147] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.147] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.147] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.147] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.147] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.147] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.148] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.148] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.148] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.148] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.148] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.148] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.148] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.148] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.148] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.166] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.166] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.169] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.169] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.169] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.170] WriteFile (in: hFile=0x240, lpBuffer=0x2cb77e0*, nNumberOfBytesToWrite=0xbdc8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb77e0*, lpNumberOfBytesWritten=0x8bf5e4*=0xbdc8, lpOverlapped=0x0) returned 1 [0084.171] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.171] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.171] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0084.171] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.172] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0084.172] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.172] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.172] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.172] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.172] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.172] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.172] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.172] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac48, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0084.172] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0084.173] CryptDestroyKey (hKey=0xa7cca8) returned 1 [0084.173] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.173] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.173] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.173] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.173] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.173] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.173] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.173] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.173] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.173] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.173] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.173] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.173] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.173] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.173] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.173] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.173] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.174] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.174] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.174] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.174] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.174] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.174] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.174] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.174] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.174] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.174] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.174] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.174] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.174] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.174] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.174] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.174] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.174] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.174] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.174] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.174] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.174] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.174] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.175] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.175] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.175] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.175] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.175] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.175] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.175] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.175] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.175] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.175] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.175] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.175] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.175] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.175] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0084.176] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0084.176] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0084.176] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.176] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.176] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.176] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.176] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.176] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.176] FreeLibrary (hLibModule=0x76a10000) returned 1 [0084.176] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.176] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.176] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.176] CloseHandle (hObject=0x24c) returned 1 [0084.178] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.178] CloseHandle (hObject=0x240) returned 1 [0084.184] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.185] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.185] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.185] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.185] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Qro3U.bmp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Qro3U.bmp", lpFilePart=0x8bedf4*="Qro3U.bmp") returned 0x2f [0084.185] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Qro3U.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\qro3u.bmp")) returned 0x20 [0084.186] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Qro3U.bmp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7ce28 [0084.186] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Qro3U.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\qro3u.bmp")) returned 1 [0084.193] FindNextFileW (in: hFindFile=0xa7ce28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0084.193] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0084.193] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.193] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.193] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.193] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Qro3U.bmp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Qro3U.bmp", lpFilePart=0x8bf650*="Qro3U.bmp") returned 0x2f [0084.194] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Qro3U.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\qro3u.bmp")) returned 0xffffffff [0084.194] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.194] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.194] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R0bpFAwwI.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0bpFAwwI.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bpFAwwI.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pFAwwI.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FAwwI.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AwwI.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wwI.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wI.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I.xls", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.194] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R0bpFAwwI.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0bpFAwwI.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bpFAwwI.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pFAwwI.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FAwwI.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AwwI.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wwI.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wI.xls", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.195] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.195] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0084.195] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.195] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.195] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.195] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.195] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.195] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0084.195] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.195] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.195] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.195] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.195] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.195] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/R0bpFAwwI.xls", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7caa8 [0084.196] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0084.196] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.196] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.196] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.196] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.196] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.196] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.196] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.196] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.196] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.196] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.196] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.196] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.196] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.197] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0084.197] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.197] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.197] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0084.197] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.197] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0084.197] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.197] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.197] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.197] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.197] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.197] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.197] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0084.198] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0084.198] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.198] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.198] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.198] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.198] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.198] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.198] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0084.198] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0084.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0084.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0084.199] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0084.199] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0084.199] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.199] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.199] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0084.200] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.200] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0084.200] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.200] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.200] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.200] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.218] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 1 [0084.218] TranslateMessage (lpMsg=0x8bf4a8) returned 0 [0084.218] DispatchMessageW (lpMsg=0x8bf4a8) returned 0x0 [0084.218] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0084.218] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0084.218] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.218] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.218] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.218] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.218] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.218] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.218] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.218] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.219] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.219] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0084.219] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.219] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0084.219] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.219] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.219] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.219] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.220] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.220] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.220] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.220] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.220] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.220] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.220] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.220] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.220] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.220] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.220] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.220] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.220] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.220] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.220] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.220] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.220] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.221] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.221] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.221] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.221] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.221] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.221] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.221] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.221] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.221] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.221] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.221] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.221] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.221] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.221] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.221] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.222] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0084.222] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0084.222] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0084.222] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.222] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.222] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.222] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b50, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.222] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0084.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c20, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.223] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.223] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.223] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.223] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.223] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.223] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8aee8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0084.223] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0084.224] CryptHashData (hHash=0xa7d0a8, pbData=0x3983be0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0084.224] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.224] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.224] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.224] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.224] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.224] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.224] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.224] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.224] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.224] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.224] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.224] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.224] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.224] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0084.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b3f8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0084.225] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0084.225] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d0a8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cd28) returned 1 [0084.225] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.225] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.225] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.225] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.225] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.225] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.225] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.226] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.226] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.226] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.226] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.226] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0084.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a998, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0084.226] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0084.226] CryptDestroyHash (hHash=0xa7d0a8) returned 1 [0084.226] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.226] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.226] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.227] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.227] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.228] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/R0bpFAwwI.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\r0bpfawwi.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0084.228] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.228] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0084.228] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.228] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.228] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.228] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0084.228] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.R0bpFAwwI.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.r0bpfawwi.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0084.229] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.229] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.229] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.229] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.232] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0084.232] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0xa31b, lpOverlapped=0x0) returned 1 [0084.233] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0084.238] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.238] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.238] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.238] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0084.238] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.238] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0084.239] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.239] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.239] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.239] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.239] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.239] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.239] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.239] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.239] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.239] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.239] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.239] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.239] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.239] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.239] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.239] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.239] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.240] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.240] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.240] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.240] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.240] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.240] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.240] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.240] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.240] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.240] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.240] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.240] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.240] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.240] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.240] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.240] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.241] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.241] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.241] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b050, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.241] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.242] CryptEncrypt (in: hKey=0xa7cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xa31b, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xa320) returned 1 [0084.242] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.242] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.242] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.242] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.242] CharLowerBuffW (in: lpsz="byte[41760]", cchLength=0xb | out: lpsz="byte[41760]") returned 0xb [0084.242] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.242] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.242] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.242] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.243] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.243] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.243] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.243] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b0e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.243] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.243] CryptEncrypt (in: hKey=0xa7cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cd6158*, pdwDataLen=0x8bef60*=0xa31b, dwBufLen=0xa320 | out: pbData=0x2cd6158*, pdwDataLen=0x8bef60*=0xa320) returned 1 [0084.245] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.245] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.245] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.245] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.245] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.245] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.245] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.245] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.245] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.245] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.245] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.246] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.246] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.246] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.246] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.246] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.246] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.246] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.246] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.246] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.246] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.246] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.246] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.246] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.246] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.246] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.246] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.257] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.258] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.258] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.259] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb77e0*, nNumberOfBytesToWrite=0xa320, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb77e0*, lpNumberOfBytesWritten=0x8bf5e4*=0xa320, lpOverlapped=0x0) returned 1 [0084.260] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.261] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.261] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0084.261] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.261] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0084.261] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.261] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.261] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.261] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.261] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.261] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.261] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.261] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8abd0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0084.262] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0084.262] CryptDestroyKey (hKey=0xa7cd28) returned 1 [0084.262] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.262] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.262] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.262] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.262] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.262] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.262] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.262] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.262] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.262] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.263] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.263] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.263] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.263] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.263] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.263] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.263] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.263] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.263] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.263] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.263] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.263] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.263] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.263] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.263] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.263] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.263] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.264] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.264] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.264] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.264] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.264] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.264] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.264] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.264] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.264] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.264] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.264] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.264] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.264] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.264] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.264] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.264] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.264] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.265] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.265] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.265] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.265] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.265] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.265] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.265] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.265] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.265] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0084.265] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0084.265] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0084.266] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.266] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.266] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.266] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.266] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.266] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.266] FreeLibrary (hLibModule=0x76a10000) returned 1 [0084.268] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.268] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.268] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.268] CloseHandle (hObject=0x240) returned 1 [0084.271] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.271] CloseHandle (hObject=0x24c) returned 1 [0084.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.276] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.276] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.276] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.276] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/R0bpFAwwI.xls", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\R0bpFAwwI.xls", lpFilePart=0x8bedf4*="R0bpFAwwI.xls") returned 0x33 [0084.276] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\R0bpFAwwI.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\r0bpfawwi.xls")) returned 0x20 [0084.276] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\R0bpFAwwI.xls", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0084.277] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\R0bpFAwwI.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\r0bpfawwi.xls")) returned 1 [0084.284] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0084.284] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0084.285] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.285] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.285] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.285] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/R0bpFAwwI.xls", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\R0bpFAwwI.xls", lpFilePart=0x8bf650*="R0bpFAwwI.xls") returned 0x33 [0084.285] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\R0bpFAwwI.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\r0bpfawwi.xls")) returned 0xffffffff [0084.285] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.285] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.285] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rzTdzniVDq.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zTdzniVDq.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TdzniVDq.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dzniVDq.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zniVDq.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="niVDq.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iVDq.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VDq.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dq.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.305] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rzTdzniVDq.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zTdzniVDq.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TdzniVDq.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dzniVDq.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zniVDq.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="niVDq.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iVDq.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VDq.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dq.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.305] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.305] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0084.305] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.305] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.305] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.305] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.305] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.305] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0084.305] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.306] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.306] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.306] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.306] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.306] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/rzTdzniVDq.csv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7c9e8 [0084.306] FindClose (in: hFindFile=0xa7c9e8 | out: hFindFile=0xa7c9e8) returned 1 [0084.306] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.306] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.306] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.306] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.306] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.306] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.307] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.307] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.307] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.307] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.307] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.307] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.307] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.307] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0084.307] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.307] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.307] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0084.307] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.307] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0084.308] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.308] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.308] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.308] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.308] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.308] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.308] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0084.308] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0084.308] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.308] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.308] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.308] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.308] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.308] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.308] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0084.309] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0084.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0084.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0084.309] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0084.309] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0084.310] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.310] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.310] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0084.310] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.310] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0084.310] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.310] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.310] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.310] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.310] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.310] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.311] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.311] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.311] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.311] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.311] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.311] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.311] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.311] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.311] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.311] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.311] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0084.311] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.311] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0084.311] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.311] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.311] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.311] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.312] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.312] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.312] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.312] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.312] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.312] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.312] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.312] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.312] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.312] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.312] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.312] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.312] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.312] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.312] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.312] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.313] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.313] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.313] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.313] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.313] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.313] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.313] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.313] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.313] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.313] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.314] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.314] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.314] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.314] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.314] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.314] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.314] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.314] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.314] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad68, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0084.314] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0084.315] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0084.315] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.315] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.315] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.315] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.315] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0084.315] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c30, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.315] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.315] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.315] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.315] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.316] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.316] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.316] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8ad38, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0084.316] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0084.316] CryptHashData (hHash=0xa7cce8, pbData=0x3983c00, dwDataLen=0x3, dwFlags=0x1) returned 1 [0084.316] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.316] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.316] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.316] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.316] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.316] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.317] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.317] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.317] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.317] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.317] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.317] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.317] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.317] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0084.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b350, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0084.317] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0084.317] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cce8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cf28) returned 1 [0084.317] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.318] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.318] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.318] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.318] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.318] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.323] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.323] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.323] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.324] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.324] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.324] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0084.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7abb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0084.324] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0084.324] CryptDestroyHash (hHash=0xa7cce8) returned 1 [0084.324] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.324] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.324] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.324] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.324] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.325] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/rzTdzniVDq.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\rztdznivdq.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0084.326] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.326] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0084.326] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.326] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.326] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.326] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0084.326] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.rzTdzniVDq.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.rztdznivdq.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0084.327] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.327] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.327] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.327] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.331] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0084.331] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0xe2cd, lpOverlapped=0x0) returned 1 [0084.333] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0084.337] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.337] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.337] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.337] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0084.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.338] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0084.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.339] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.339] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.339] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.339] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.339] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.339] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.339] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.339] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.339] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.339] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.339] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.339] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.339] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.339] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.339] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.339] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.339] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.340] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.340] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.340] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.340] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.340] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.340] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.340] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.340] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.340] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.340] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.340] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.340] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.341] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.341] CryptEncrypt (in: hKey=0xa7cf28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xe2cd, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xe2d0) returned 1 [0084.341] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.341] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.341] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.341] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.341] CharLowerBuffW (in: lpsz="byte[58064]", cchLength=0xb | out: lpsz="byte[58064]") returned 0xb [0084.341] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.343] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.343] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.343] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.343] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.343] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.343] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.343] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b080, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.344] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.344] CryptEncrypt (in: hKey=0xa7cf28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3984050*, pdwDataLen=0x8bef60*=0xe2cd, dwBufLen=0xe2d0 | out: pbData=0x3984050*, pdwDataLen=0x8bef60*=0xe2d0) returned 1 [0084.346] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.346] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.346] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.347] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.347] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.347] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.347] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.347] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.347] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.347] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.347] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.347] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.347] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.347] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.347] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.347] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.347] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.347] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.348] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.348] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.348] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.348] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.348] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.348] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.348] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.348] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.348] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.354] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.354] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.354] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.355] WriteFile (in: hFile=0x240, lpBuffer=0x2cb77e0*, nNumberOfBytesToWrite=0xe2d0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb77e0*, lpNumberOfBytesWritten=0x8bf5e4*=0xe2d0, lpOverlapped=0x0) returned 1 [0084.357] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.357] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.357] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0084.357] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.357] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0084.357] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.357] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.357] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.357] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.357] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.357] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.357] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.358] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8aca8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0084.358] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0084.358] CryptDestroyKey (hKey=0xa7cf28) returned 1 [0084.358] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.358] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.358] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.358] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.358] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.358] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.358] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.358] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.359] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.359] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.359] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.359] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.359] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.359] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.359] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.359] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.359] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.359] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.359] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.363] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.363] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.363] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.363] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.363] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.363] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.363] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.363] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.363] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.364] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.364] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.364] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.364] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.364] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.364] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.364] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.364] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.364] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.364] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.364] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.364] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.364] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.364] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.364] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.364] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.364] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.364] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.364] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.364] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.364] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.364] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.365] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.365] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.365] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7acb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0084.365] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0084.365] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0084.365] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.365] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.365] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.365] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.365] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.365] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.365] FreeLibrary (hLibModule=0x76a10000) returned 1 [0084.365] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.365] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.366] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.366] CloseHandle (hObject=0x24c) returned 1 [0084.368] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.368] CloseHandle (hObject=0x240) returned 1 [0084.372] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.374] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.374] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.374] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.375] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/rzTdzniVDq.csv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rzTdzniVDq.csv", lpFilePart=0x8bedf4*="rzTdzniVDq.csv") returned 0x34 [0084.375] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rzTdzniVDq.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\rztdznivdq.csv")) returned 0x20 [0084.375] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rzTdzniVDq.csv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cee8 [0084.375] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rzTdzniVDq.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\rztdznivdq.csv")) returned 1 [0084.381] FindNextFileW (in: hFindFile=0xa7cee8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0084.381] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0084.382] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.382] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.382] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.382] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/rzTdzniVDq.csv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rzTdzniVDq.csv", lpFilePart=0x8bf650*="rzTdzniVDq.csv") returned 0x34 [0084.382] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rzTdzniVDq.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\rztdznivdq.csv")) returned 0xffffffff [0084.382] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.382] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.382] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SBImy.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BImy.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Imy.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="my.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.382] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SBImy.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BImy.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Imy.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="my.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.383] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.383] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0084.383] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.383] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.383] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.383] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.383] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0084.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.383] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/SBImy.wav", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cca8 [0084.383] FindClose (in: hFindFile=0xa7cca8 | out: hFindFile=0xa7cca8) returned 1 [0084.384] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.384] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.384] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.384] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.384] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.384] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.384] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.384] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.384] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.384] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0084.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.385] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.385] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0084.385] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.385] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0084.385] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.385] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.385] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.385] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.385] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.385] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.385] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0084.385] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0084.385] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.385] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.385] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.385] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.385] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.385] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.385] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0084.386] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0084.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0084.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a9b8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0084.386] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0084.386] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0084.387] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.387] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.387] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0084.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.387] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0084.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.387] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.387] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.387] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.387] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.387] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.387] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.387] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.388] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0084.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.388] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0084.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.388] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.388] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.388] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.388] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.388] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.388] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.388] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.388] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.388] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.388] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.389] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.389] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.396] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.396] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.396] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.396] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.396] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.396] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.397] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.397] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.397] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.397] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.397] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.397] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.397] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.397] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.397] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.397] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.397] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.397] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.397] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.397] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8aeb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0084.398] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0084.398] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0084.398] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.398] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.398] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.398] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.398] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0084.398] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.398] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.398] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.398] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.398] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.398] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.398] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.398] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8ad80, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0084.399] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0084.399] CryptHashData (hHash=0xa7d168, pbData=0x3983c60, dwDataLen=0x3, dwFlags=0x1) returned 1 [0084.399] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.399] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.399] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.399] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.399] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.399] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.399] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.399] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.399] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.399] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.399] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.399] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.400] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.400] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0084.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b500, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0084.400] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0084.400] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d168, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cd28) returned 1 [0084.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.400] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.400] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.400] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.400] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.400] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.400] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.400] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0084.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a998, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0084.401] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0084.401] CryptDestroyHash (hHash=0xa7d168) returned 1 [0084.401] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.401] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.401] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.401] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.401] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.402] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/SBImy.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\sbimy.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0084.402] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.402] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0084.402] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.402] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.402] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.402] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0084.403] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.SBImy.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.sbimy.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0084.403] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.403] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.403] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.403] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.405] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0084.405] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0084.408] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x85c3, lpOverlapped=0x0) returned 1 [0084.408] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0084.413] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.414] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.414] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.414] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0084.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.416] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0084.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.416] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.416] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.416] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.416] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.416] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.416] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.416] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.416] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.416] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.416] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.417] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.417] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.417] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.417] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.417] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.417] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.417] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.417] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.417] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.417] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.417] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.417] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.417] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.417] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.417] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.417] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.417] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.417] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.418] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b200, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.419] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.419] CryptEncrypt (in: hKey=0xa7cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x185c3, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x185c8) returned 1 [0084.419] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.419] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.419] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.419] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.419] CharLowerBuffW (in: lpsz="byte[99784]", cchLength=0xb | out: lpsz="byte[99784]") returned 0xb [0084.419] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.421] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.421] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.421] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.421] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.421] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.421] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.421] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b0e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.421] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.422] CryptEncrypt (in: hKey=0xa7cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x399c620*, pdwDataLen=0x8bef60*=0x185c3, dwBufLen=0x185c8 | out: pbData=0x399c620*, pdwDataLen=0x8bef60*=0x185c8) returned 1 [0084.425] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.426] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.426] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.426] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.426] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.426] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.426] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.426] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.426] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.457] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.457] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.457] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.457] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.457] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.457] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.457] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.457] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.458] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.458] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.458] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.458] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.458] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.458] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.458] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.458] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.458] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.458] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.466] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.466] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.466] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.467] WriteFile (in: hFile=0x24c, lpBuffer=0x2ccfdb0*, nNumberOfBytesToWrite=0x185c8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2ccfdb0*, lpNumberOfBytesWritten=0x8bf5e4*=0x185c8, lpOverlapped=0x0) returned 1 [0084.478] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.478] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.478] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0084.478] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.478] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0084.478] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.478] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.478] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.478] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.478] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.478] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.478] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.478] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac30, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0084.479] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0084.479] CryptDestroyKey (hKey=0xa7cd28) returned 1 [0084.479] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.479] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.479] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.479] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.479] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.479] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.479] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.479] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.479] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.479] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.479] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.480] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.480] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.480] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.480] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.480] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.480] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.480] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.480] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.480] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.480] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.480] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.480] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.480] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.480] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.480] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.480] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.480] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.480] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.480] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.480] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.480] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.480] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.480] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.481] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.481] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.481] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.481] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.481] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.481] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.481] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.481] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.481] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.481] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.481] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.481] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.481] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.481] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.481] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.481] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.481] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.481] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.481] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0084.482] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0084.482] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0084.482] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.482] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.482] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.482] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.482] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.482] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.482] FreeLibrary (hLibModule=0x76a10000) returned 1 [0084.482] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.482] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.482] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.482] CloseHandle (hObject=0x240) returned 1 [0084.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.483] CloseHandle (hObject=0x24c) returned 1 [0084.489] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.490] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.490] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.490] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.490] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/SBImy.wav", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SBImy.wav", lpFilePart=0x8bedf4*="SBImy.wav") returned 0x2f [0084.490] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SBImy.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\sbimy.wav")) returned 0x20 [0084.491] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SBImy.wav", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cee8 [0084.491] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SBImy.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\sbimy.wav")) returned 1 [0084.499] FindNextFileW (in: hFindFile=0xa7cee8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0084.499] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0084.500] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.500] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.500] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.500] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/SBImy.wav", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SBImy.wav", lpFilePart=0x8bf650*="SBImy.wav") returned 0x2f [0084.500] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SBImy.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\sbimy.wav")) returned 0xffffffff [0084.500] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.500] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.500] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SeOV2qpgcHWHh_nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eOV2qpgcHWHh_nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OV2qpgcHWHh_nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V2qpgcHWHh_nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2qpgcHWHh_nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qpgcHWHh_nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pgcHWHh_nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gcHWHh_nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cHWHh_nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HWHh_nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WHh_nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Hh_nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h_nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nbqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bqI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qI.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I.mp3", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.501] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SeOV2qpgcHWHh_nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eOV2qpgcHWHh_nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OV2qpgcHWHh_nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V2qpgcHWHh_nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2qpgcHWHh_nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qpgcHWHh_nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pgcHWHh_nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gcHWHh_nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cHWHh_nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HWHh_nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WHh_nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Hh_nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h_nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nbqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bqI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qI.mp3", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.502] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.502] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0084.502] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.502] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.502] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.502] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.502] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.502] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0084.502] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.502] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.502] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.502] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.502] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.502] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/SeOV2qpgcHWHh_nbqI.mp3", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cee8 [0084.503] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0084.503] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.503] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.503] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.503] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.503] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.503] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.503] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.503] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.503] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.503] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.503] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.503] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.503] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.503] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0084.504] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.504] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.504] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0084.504] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.504] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0084.504] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.504] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.504] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.504] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.504] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.504] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.506] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0084.507] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0084.507] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.507] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.507] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.507] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.507] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.507] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.507] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7abb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0084.507] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0084.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0084.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0084.507] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0084.507] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0084.508] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.508] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.508] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0084.508] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.508] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0084.508] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.508] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.508] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.508] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.508] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.508] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.508] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.508] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.509] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.509] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.509] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.509] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.509] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.509] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.509] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.509] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.509] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0084.509] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.509] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0084.509] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.509] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.509] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.509] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.509] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.509] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.509] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.509] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.510] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.510] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.510] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.510] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.510] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.510] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.510] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.510] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.510] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.510] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.510] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.510] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.510] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.510] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.510] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.510] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.510] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.510] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.511] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.511] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.511] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.511] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.511] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.511] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.511] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.511] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.511] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.511] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.511] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.511] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.511] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0084.512] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0084.512] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0084.512] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.512] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.512] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.512] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.512] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0084.512] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983bf0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.512] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.513] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.513] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.513] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.513] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.513] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.513] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8af48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0084.513] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0084.513] CryptHashData (hHash=0xa7cc28, pbData=0x3983ba0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0084.513] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.513] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.513] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.513] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.513] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.514] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.514] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.514] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.514] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.514] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.514] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.514] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.514] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.514] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0084.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b338, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0084.514] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0084.514] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cc28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cb68) returned 1 [0084.514] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.515] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.515] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.515] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.515] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.515] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.515] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.515] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.515] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.515] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.515] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.515] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0084.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aa38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0084.515] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0084.515] CryptDestroyHash (hHash=0xa7cc28) returned 1 [0084.516] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.516] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.516] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.516] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.516] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.517] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/SeOV2qpgcHWHh_nbqI.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\seov2qpgchwhh_nbqi.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0084.517] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.517] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0084.518] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.518] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.518] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.518] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0084.518] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.SeOV2qpgcHWHh_nbqI.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.seov2qpgchwhh_nbqi.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0084.519] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.519] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.519] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.519] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.521] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0084.521] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0xa22c, lpOverlapped=0x0) returned 1 [0084.523] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0084.527] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.527] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.527] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.527] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0084.527] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.527] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0084.527] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.527] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.543] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.543] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.543] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.543] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.543] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.543] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.543] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.543] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.543] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.543] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.543] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.543] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.543] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.543] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.544] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.544] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.544] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.544] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.544] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.544] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.544] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.544] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.544] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.544] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.544] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.545] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b140, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.545] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.545] CryptEncrypt (in: hKey=0xa7cb68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xa22c, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xa230) returned 1 [0084.545] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.545] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.545] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.546] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.546] CharLowerBuffW (in: lpsz="byte[41520]", cchLength=0xb | out: lpsz="byte[41520]") returned 0xb [0084.546] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.550] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.550] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.550] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.550] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.550] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.550] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.551] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b2d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.552] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.552] CryptEncrypt (in: hKey=0xa7cb68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cd5e88*, pdwDataLen=0x8bef60*=0xa22c, dwBufLen=0xa230 | out: pbData=0x2cd5e88*, pdwDataLen=0x8bef60*=0xa230) returned 1 [0084.553] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.553] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.554] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.554] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.554] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.554] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.554] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.555] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.555] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.555] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.555] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.555] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.555] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.555] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.555] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.555] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.555] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.555] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.555] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.555] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.555] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.555] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.555] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.560] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.560] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.561] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.561] WriteFile (in: hFile=0x240, lpBuffer=0x2cb77e0*, nNumberOfBytesToWrite=0xa230, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb77e0*, lpNumberOfBytesWritten=0x8bf5e4*=0xa230, lpOverlapped=0x0) returned 1 [0084.564] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.564] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.564] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0084.564] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.564] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0084.564] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.564] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.564] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.564] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.564] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.564] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.564] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.564] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac30, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0084.565] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0084.565] CryptDestroyKey (hKey=0xa7cb68) returned 1 [0084.565] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.565] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.565] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.565] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.565] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.565] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.565] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.565] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.565] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.565] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.565] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.566] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.566] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.566] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.566] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.566] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.566] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.566] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.566] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.566] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.566] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.566] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.566] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.566] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.566] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.566] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.566] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.566] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.567] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.567] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.567] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.567] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.567] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.567] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.567] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.567] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.567] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.567] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.567] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.567] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.567] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.567] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.567] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.567] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.567] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.567] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.567] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.568] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.568] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.568] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.568] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.568] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.568] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7abf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0084.568] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0084.568] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0084.568] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.568] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.568] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.569] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.569] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.570] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.570] FreeLibrary (hLibModule=0x76a10000) returned 1 [0084.570] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.570] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.570] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.570] CloseHandle (hObject=0x24c) returned 1 [0084.573] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.573] CloseHandle (hObject=0x240) returned 1 [0084.582] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.583] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.583] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.583] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.583] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/SeOV2qpgcHWHh_nbqI.mp3", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SeOV2qpgcHWHh_nbqI.mp3", lpFilePart=0x8bedf4*="SeOV2qpgcHWHh_nbqI.mp3") returned 0x3c [0084.583] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SeOV2qpgcHWHh_nbqI.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\seov2qpgchwhh_nbqi.mp3")) returned 0x20 [0084.583] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SeOV2qpgcHWHh_nbqI.mp3", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cee8 [0084.583] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SeOV2qpgcHWHh_nbqI.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\seov2qpgchwhh_nbqi.mp3")) returned 1 [0084.593] FindNextFileW (in: hFindFile=0xa7cee8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0084.594] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0084.594] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.594] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.594] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.594] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/SeOV2qpgcHWHh_nbqI.mp3", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SeOV2qpgcHWHh_nbqI.mp3", lpFilePart=0x8bf650*="SeOV2qpgcHWHh_nbqI.mp3") returned 0x3c [0084.594] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\SeOV2qpgcHWHh_nbqI.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\seov2qpgchwhh_nbqi.mp3")) returned 0xffffffff [0084.594] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.594] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.595] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sgCJT.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gCJT.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CJT.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JT.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.595] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sgCJT.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gCJT.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CJT.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JT.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.595] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.595] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0084.595] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.595] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.595] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.595] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.595] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.595] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0084.595] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.595] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.595] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.595] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.596] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.596] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/sgCJT.jpg", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cc28 [0084.596] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0084.596] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.596] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.596] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.596] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.596] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.596] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.596] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.596] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.596] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.596] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.596] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.596] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.597] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.597] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0084.597] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.597] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.597] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0084.597] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.597] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0084.597] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.597] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.597] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.597] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.597] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.597] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.597] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0084.597] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0084.597] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.597] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.597] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.598] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.598] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.598] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.598] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0084.598] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0084.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0084.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab98, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0084.598] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0084.598] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0084.599] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.599] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.599] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0084.599] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.599] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0084.599] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.599] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.599] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.599] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.599] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.599] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.599] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.599] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.599] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.599] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.600] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.600] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.600] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.600] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0084.600] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.600] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0084.600] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.600] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.600] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.600] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.600] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.600] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.600] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.600] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.600] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.600] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.600] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.600] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.600] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.601] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.601] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.601] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.601] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.601] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.601] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.601] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.601] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.601] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.601] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.601] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.601] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.601] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.601] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.601] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.601] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.601] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.601] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.601] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.601] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.601] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.601] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.602] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.602] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.602] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.602] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad68, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0084.602] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0084.602] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0084.602] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.602] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.602] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.602] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c80, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.602] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0084.602] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.603] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.603] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.603] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.603] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.603] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.603] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.603] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8af30, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0084.603] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0084.603] CryptHashData (hHash=0xa7caa8, pbData=0x3983ba0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0084.603] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.603] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.603] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.603] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.603] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.605] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.605] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.606] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.606] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.606] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.606] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.606] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.606] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.606] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0084.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b4b8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0084.606] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0084.606] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7caa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cb28) returned 1 [0084.606] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.606] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.606] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.607] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.607] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.607] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.607] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.607] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.607] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.607] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.607] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.607] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0084.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7acd8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0084.607] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0084.607] CryptDestroyHash (hHash=0xa7caa8) returned 1 [0084.607] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.607] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.607] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.607] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.608] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.608] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/sgCJT.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\sgcjt.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0084.609] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.609] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0084.609] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.609] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.609] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.609] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0084.609] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.sgCJT.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.sgcjt.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0084.609] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.610] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.610] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.610] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.613] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0084.613] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0084.615] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x11, lpOverlapped=0x0) returned 1 [0084.615] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0084.618] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.619] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.619] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.619] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0084.619] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.619] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0084.619] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.619] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.619] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.620] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.620] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.620] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.620] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.620] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.620] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.620] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.620] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.620] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.620] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.620] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.620] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.620] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.620] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.620] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.620] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.620] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.620] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.620] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.620] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.620] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.621] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.621] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.621] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.621] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.621] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.621] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.621] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.621] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.621] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.621] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.621] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.621] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b2c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.622] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.622] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x10011, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x10018) returned 1 [0084.622] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.622] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.622] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.622] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.622] CharLowerBuffW (in: lpsz="byte[65560]", cchLength=0xb | out: lpsz="byte[65560]") returned 0xb [0084.622] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.623] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.623] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.623] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.623] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.623] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.623] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.623] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b0e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.624] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.624] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3984050*, pdwDataLen=0x8bef60*=0x10011, dwBufLen=0x10018 | out: pbData=0x3984050*, pdwDataLen=0x8bef60*=0x10018) returned 1 [0084.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.627] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.627] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.627] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.627] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.627] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.628] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.628] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.628] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.628] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.628] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.628] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.628] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.628] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.628] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.628] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.628] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.628] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.628] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.628] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.628] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.634] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.634] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.634] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.635] WriteFile (in: hFile=0x24c, lpBuffer=0x2cc7800*, nNumberOfBytesToWrite=0x10018, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cc7800*, lpNumberOfBytesWritten=0x8bf5e4*=0x10018, lpOverlapped=0x0) returned 1 [0084.636] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.637] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.637] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0084.637] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.637] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0084.637] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.637] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.637] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.637] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.637] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.637] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.637] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.637] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac18, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0084.637] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0084.637] CryptDestroyKey (hKey=0xa7cb28) returned 1 [0084.638] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.638] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.647] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.647] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.648] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.648] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.648] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.648] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.648] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.648] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.648] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.648] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.648] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.648] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.648] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.648] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.648] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.648] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.648] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.648] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.648] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.648] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.648] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.648] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.648] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.649] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.649] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.649] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.649] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.649] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.649] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.649] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.649] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.649] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.649] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.649] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.649] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.649] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.649] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.649] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.649] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.649] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.649] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.649] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.649] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.649] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.649] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.649] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.650] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.650] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.650] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.650] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.650] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7abf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0084.650] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0084.650] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0084.650] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.650] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.650] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.650] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.650] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.650] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.650] FreeLibrary (hLibModule=0x76a10000) returned 1 [0084.650] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.650] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.650] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.651] CloseHandle (hObject=0x240) returned 1 [0084.653] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.653] CloseHandle (hObject=0x24c) returned 1 [0084.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.656] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.657] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.657] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.657] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/sgCJT.jpg", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sgCJT.jpg", lpFilePart=0x8bedf4*="sgCJT.jpg") returned 0x2f [0084.658] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sgCJT.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\sgcjt.jpg")) returned 0x20 [0084.658] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sgCJT.jpg", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cf28 [0084.658] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sgCJT.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\sgcjt.jpg")) returned 1 [0084.684] FindNextFileW (in: hFindFile=0xa7cf28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0084.685] FindClose (in: hFindFile=0xa7cf28 | out: hFindFile=0xa7cf28) returned 1 [0084.685] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.685] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.685] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.685] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/sgCJT.jpg", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sgCJT.jpg", lpFilePart=0x8bf650*="sgCJT.jpg") returned 0x2f [0084.685] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sgCJT.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\sgcjt.jpg")) returned 0xffffffff [0084.685] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.685] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.685] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T2Cxs_YQD7nPt.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2Cxs_YQD7nPt.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cxs_YQD7nPt.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xs_YQD7nPt.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s_YQD7nPt.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_YQD7nPt.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YQD7nPt.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QD7nPt.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D7nPt.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7nPt.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nPt.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pt.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.686] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T2Cxs_YQD7nPt.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2Cxs_YQD7nPt.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cxs_YQD7nPt.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xs_YQD7nPt.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s_YQD7nPt.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_YQD7nPt.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YQD7nPt.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QD7nPt.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D7nPt.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7nPt.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nPt.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pt.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.686] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.686] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0084.686] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.686] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.686] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.686] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.686] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.686] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0084.686] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.687] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.687] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.687] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.687] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.687] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/T2Cxs_YQD7nPt.bmp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7caa8 [0084.687] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0084.687] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.687] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.687] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.687] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.687] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.687] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.687] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.687] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.688] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.688] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.688] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.688] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.688] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.688] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0084.688] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.688] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.688] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0084.688] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.688] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0084.688] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.688] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.688] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.688] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.688] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.689] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.689] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0084.689] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0084.689] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.689] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.689] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.689] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.689] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.689] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.689] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0084.689] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0084.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0084.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a9b8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0084.690] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0084.690] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0084.691] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.691] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.691] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0084.691] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.691] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0084.691] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.691] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.691] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.691] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.691] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.691] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.691] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.691] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.691] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.692] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.692] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.692] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.692] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.692] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.692] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.692] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.692] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0084.692] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.692] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0084.692] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.692] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.692] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.692] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.703] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.703] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.703] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.703] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.703] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.703] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.703] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.703] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.703] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.703] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.703] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.703] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.703] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.704] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.704] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.704] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.704] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.704] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.704] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.704] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.704] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.704] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.704] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.704] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.704] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.704] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.705] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.705] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.705] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.705] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.705] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.705] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.705] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.705] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.705] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8aee8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0084.705] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0084.705] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0084.706] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.706] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.706] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.706] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.706] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0084.706] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.706] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.706] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.706] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.706] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.706] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.706] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.707] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8aeb8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0084.707] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0084.707] CryptHashData (hHash=0xa7cb28, pbData=0x3983b00, dwDataLen=0x3, dwFlags=0x1) returned 1 [0084.707] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.707] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.707] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.707] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.707] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.707] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.708] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.708] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.708] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.708] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.708] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.708] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.708] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.708] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0084.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b428, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0084.708] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0084.708] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cb28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cc28) returned 1 [0084.709] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.709] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.709] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.709] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.709] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.709] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.709] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.709] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.709] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.709] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.709] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.709] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0084.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7abf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0084.710] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0084.710] CryptDestroyHash (hHash=0xa7cb28) returned 1 [0084.710] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.710] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.710] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.710] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.710] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.711] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/T2Cxs_YQD7nPt.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\t2cxs_yqd7npt.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0084.712] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.712] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0084.712] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.712] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.712] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.712] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0084.712] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.T2Cxs_YQD7nPt.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.t2cxs_yqd7npt.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0084.713] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.713] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.713] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.713] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.716] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0084.717] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x999b, lpOverlapped=0x0) returned 1 [0084.718] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0084.723] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.723] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.723] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.723] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0084.724] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.724] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0084.724] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.724] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.724] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.724] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.724] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.724] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.724] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.724] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.724] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.725] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.725] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.725] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.725] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.725] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.725] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.725] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.725] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.725] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.725] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.725] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.725] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.725] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.725] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.725] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.726] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.726] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.726] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.726] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.726] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.726] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.726] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.726] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.726] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.726] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.726] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.727] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b080, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.727] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.727] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x999b, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x99a0) returned 1 [0084.727] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.727] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.728] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.728] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.728] CharLowerBuffW (in: lpsz="byte[39328]", cchLength=0xb | out: lpsz="byte[39328]") returned 0xb [0084.728] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.730] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.743] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.743] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.743] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.743] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.743] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.743] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b0f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.743] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.743] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cd44d8*, pdwDataLen=0x8bef60*=0x999b, dwBufLen=0x99a0 | out: pbData=0x2cd44d8*, pdwDataLen=0x8bef60*=0x99a0) returned 1 [0084.745] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.745] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.746] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.746] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.746] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.746] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.746] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.746] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.746] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.746] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.746] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.746] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.746] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.746] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.746] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.746] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.746] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.747] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.747] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.747] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.747] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.747] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.747] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.747] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.747] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.747] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.755] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.755] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.756] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.756] WriteFile (in: hFile=0x240, lpBuffer=0x2cb77e0*, nNumberOfBytesToWrite=0x99a0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb77e0*, lpNumberOfBytesWritten=0x8bf5e4*=0x99a0, lpOverlapped=0x0) returned 1 [0084.758] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.758] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.758] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0084.758] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.758] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0084.758] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.758] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.758] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.758] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.758] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.758] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.758] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.758] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac48, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0084.759] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0084.759] CryptDestroyKey (hKey=0xa7cc28) returned 1 [0084.759] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.759] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.759] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.759] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.759] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.759] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.759] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.759] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.759] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.759] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.759] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.759] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.760] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.760] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.760] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.760] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.760] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.760] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.760] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.760] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.760] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.760] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.760] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.760] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.760] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.760] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.760] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.760] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.760] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.760] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.761] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.761] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.761] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.761] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.761] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.761] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.761] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.761] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.761] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.761] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.761] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.761] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.761] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.761] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.761] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.761] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.761] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.762] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.762] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.762] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.762] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.762] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.762] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a958, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0084.762] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0084.762] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0084.762] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.763] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.763] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.763] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.763] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.763] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.763] FreeLibrary (hLibModule=0x76a10000) returned 1 [0084.763] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.763] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.763] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.763] CloseHandle (hObject=0x24c) returned 1 [0084.766] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.766] CloseHandle (hObject=0x240) returned 1 [0084.769] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.770] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.770] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.771] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.771] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/T2Cxs_YQD7nPt.bmp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\T2Cxs_YQD7nPt.bmp", lpFilePart=0x8bedf4*="T2Cxs_YQD7nPt.bmp") returned 0x37 [0084.771] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\T2Cxs_YQD7nPt.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\t2cxs_yqd7npt.bmp")) returned 0x20 [0084.771] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\T2Cxs_YQD7nPt.bmp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cce8 [0084.771] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\T2Cxs_YQD7nPt.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\t2cxs_yqd7npt.bmp")) returned 1 [0084.780] FindNextFileW (in: hFindFile=0xa7cce8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0084.780] FindClose (in: hFindFile=0xa7cce8 | out: hFindFile=0xa7cce8) returned 1 [0084.780] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.781] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.781] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.781] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/T2Cxs_YQD7nPt.bmp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\T2Cxs_YQD7nPt.bmp", lpFilePart=0x8bf650*="T2Cxs_YQD7nPt.bmp") returned 0x37 [0084.781] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\T2Cxs_YQD7nPt.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\t2cxs_yqd7npt.bmp")) returned 0xffffffff [0084.781] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.781] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.781] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TzQzGhO-DVwBiUIbj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zQzGhO-DVwBiUIbj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QzGhO-DVwBiUIbj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zGhO-DVwBiUIbj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GhO-DVwBiUIbj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hO-DVwBiUIbj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O-DVwBiUIbj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-DVwBiUIbj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DVwBiUIbj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VwBiUIbj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wBiUIbj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BiUIbj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iUIbj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UIbj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ibj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bj v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.782] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TzQzGhO-DVwBiUIbj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zQzGhO-DVwBiUIbj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QzGhO-DVwBiUIbj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zGhO-DVwBiUIbj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GhO-DVwBiUIbj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hO-DVwBiUIbj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O-DVwBiUIbj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-DVwBiUIbj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DVwBiUIbj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VwBiUIbj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wBiUIbj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BiUIbj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iUIbj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UIbj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ibj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bj v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" v.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.783] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.783] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0084.783] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.783] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.783] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.783] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.783] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.783] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0084.784] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.784] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.784] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.784] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.784] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.784] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/TzQzGhO-DVwBiUIbj v.odp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cc28 [0084.784] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0084.784] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.784] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.784] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.784] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.784] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.784] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.784] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.784] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.785] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.785] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.785] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.790] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.790] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.790] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0084.790] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.790] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.791] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0084.791] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.791] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0084.791] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.791] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.791] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.791] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.791] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.791] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.791] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0084.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0084.791] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.791] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.791] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.791] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.792] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.792] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.792] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0084.792] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0084.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0084.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7acf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0084.792] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0084.792] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0084.793] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.793] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.793] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0084.793] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.793] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0084.794] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.794] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.794] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.794] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.794] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.794] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.794] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.794] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.794] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.794] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.794] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.794] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.794] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.794] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.794] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.794] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.795] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0084.795] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.795] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0084.795] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.795] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.795] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.795] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.795] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.795] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.795] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.795] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.795] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.795] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.795] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.795] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.795] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.796] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.796] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.796] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.796] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.796] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.796] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.796] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.796] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.796] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.796] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.796] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.796] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.796] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.796] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.796] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.796] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.796] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.797] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.797] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.797] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.797] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.797] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.797] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.797] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.797] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.797] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ae40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0084.798] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0084.798] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0084.798] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.798] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.798] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.798] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.799] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0084.799] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c80, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.799] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.799] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.799] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.799] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.799] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.799] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.799] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8ad38, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0084.800] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0084.800] CryptHashData (hHash=0xa7cc28, pbData=0x3983c20, dwDataLen=0x3, dwFlags=0x1) returned 1 [0084.800] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.800] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.800] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.800] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.800] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.800] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.800] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.800] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.801] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.801] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.801] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.801] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.801] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.801] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0084.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b500, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0084.801] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0084.801] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cc28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cca8) returned 1 [0084.801] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.802] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.802] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.802] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.802] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.802] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.802] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.802] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.802] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.802] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.802] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.802] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0084.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aab8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0084.803] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0084.803] CryptDestroyHash (hHash=0xa7cc28) returned 1 [0084.803] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.803] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.803] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.803] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.803] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.804] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/TzQzGhO-DVwBiUIbj v.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\tzqzgho-dvwbiuibj v.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0084.804] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.804] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0084.805] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.805] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.805] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.805] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0084.805] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.TzQzGhO-DVwBiUIbj v.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.tzqzgho-dvwbiuibj v.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0084.806] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.806] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.806] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.806] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.892] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0084.892] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0084.893] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x76d9, lpOverlapped=0x0) returned 1 [0084.894] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0084.900] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.901] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.901] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.901] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0084.903] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.903] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0084.903] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.903] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.904] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.904] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.904] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.904] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.904] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.904] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.904] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.904] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.904] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.904] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.904] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.904] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.904] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.904] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.904] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.904] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.904] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.904] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.905] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.905] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.905] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.905] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.905] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.905] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.905] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.905] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.905] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.905] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.905] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.905] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.905] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.905] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.905] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.906] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b050, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.907] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.907] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x176d9, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x176e0) returned 1 [0084.907] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.908] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.908] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.908] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.908] CharLowerBuffW (in: lpsz="byte[95968]", cchLength=0xb | out: lpsz="byte[95968]") returned 0xb [0084.908] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.909] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.909] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.909] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.909] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.910] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.910] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.910] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0084.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b128, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0084.910] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0084.910] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x399b738*, pdwDataLen=0x8bef60*=0x176d9, dwBufLen=0x176e0 | out: pbData=0x399b738*, pdwDataLen=0x8bef60*=0x176e0) returned 1 [0084.914] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.914] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.914] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.914] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.914] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.914] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.914] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.914] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.914] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.914] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.914] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.914] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.915] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.915] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.915] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.915] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.915] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.915] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.915] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.915] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.915] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.915] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.915] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.915] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.915] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.915] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.915] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.925] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.925] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.925] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.925] WriteFile (in: hFile=0x24c, lpBuffer=0x2cceec8*, nNumberOfBytesToWrite=0x176e0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cceec8*, lpNumberOfBytesWritten=0x8bf5e4*=0x176e0, lpOverlapped=0x0) returned 1 [0084.930] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.930] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.930] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0084.930] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.930] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0084.930] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.930] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.930] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.930] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.930] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.931] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.931] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0084.931] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0084.931] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0084.931] CryptDestroyKey (hKey=0xa7cca8) returned 1 [0084.931] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.931] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.931] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.931] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.931] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.931] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.932] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.932] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.932] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.932] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.932] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.932] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.932] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0084.932] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.932] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.932] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.932] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.932] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.932] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0084.932] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.932] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0084.932] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.932] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0084.932] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.933] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0084.933] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.933] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0084.933] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.933] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.933] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0084.933] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.933] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0084.933] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.933] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.933] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.933] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.933] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.933] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.933] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.933] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.935] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.935] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.935] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.935] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.935] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.935] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.935] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.935] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.935] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.935] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.935] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.935] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.935] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aab8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0084.936] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0084.936] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0084.936] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.936] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.936] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.936] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.936] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.936] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0084.936] FreeLibrary (hLibModule=0x76a10000) returned 1 [0084.936] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.936] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.936] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.936] CloseHandle (hObject=0x240) returned 1 [0084.937] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.937] CloseHandle (hObject=0x24c) returned 1 [0084.942] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.943] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.943] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.943] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.943] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/TzQzGhO-DVwBiUIbj v.odp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\TzQzGhO-DVwBiUIbj v.odp", lpFilePart=0x8bedf4*="TzQzGhO-DVwBiUIbj v.odp") returned 0x3d [0084.943] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\TzQzGhO-DVwBiUIbj v.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\tzqzgho-dvwbiuibj v.odp")) returned 0x20 [0084.944] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\TzQzGhO-DVwBiUIbj v.odp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cce8 [0084.944] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\TzQzGhO-DVwBiUIbj v.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\tzqzgho-dvwbiuibj v.odp")) returned 1 [0084.972] FindNextFileW (in: hFindFile=0xa7cce8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0084.972] FindClose (in: hFindFile=0xa7cce8 | out: hFindFile=0xa7cce8) returned 1 [0084.973] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 1 [0084.973] TranslateMessage (lpMsg=0x8bf968) returned 0 [0084.973] DispatchMessageW (lpMsg=0x8bf968) returned 0x0 [0084.973] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0084.973] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0084.973] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.973] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.973] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.973] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/TzQzGhO-DVwBiUIbj v.odp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\TzQzGhO-DVwBiUIbj v.odp", lpFilePart=0x8bf650*="TzQzGhO-DVwBiUIbj v.odp") returned 0x3d [0084.973] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\TzQzGhO-DVwBiUIbj v.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\tzqzgho-dvwbiuibj v.odp")) returned 0xffffffff [0084.973] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.974] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.974] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UiCbiMIX.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iCbiMIX.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CbiMIX.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="biMIX.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iMIX.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MIX.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IX.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X.ods", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0084.974] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UiCbiMIX.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iCbiMIX.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CbiMIX.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="biMIX.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iMIX.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MIX.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IX.ods", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0084.974] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0084.974] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0084.974] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.974] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.974] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0084.974] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0084.975] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.975] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0084.975] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.975] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.975] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.975] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.975] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.975] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/UiCbiMIX.ods", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7caa8 [0084.975] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0084.975] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.975] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.975] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.975] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.975] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.976] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.976] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.976] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.976] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.976] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.976] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.976] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0084.976] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.976] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0084.976] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.976] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.976] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0084.976] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.976] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0084.976] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.977] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.977] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.977] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.977] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.977] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.977] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0084.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0084.977] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.977] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.977] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.977] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.977] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.977] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0084.977] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0084.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0084.978] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0084.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0084.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0084.978] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0084.978] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0084.979] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.979] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.979] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0084.979] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.979] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0084.979] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.979] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.979] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.979] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.979] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.979] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.979] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.979] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.979] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.979] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.979] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.979] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0084.979] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0084.979] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.979] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.979] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.979] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0084.980] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.980] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0084.980] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.980] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.980] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.980] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.980] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.980] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.980] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.980] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.980] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.980] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.980] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.980] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.980] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.980] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.980] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.980] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.980] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.980] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.980] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.980] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.980] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.981] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.981] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.981] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.981] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.981] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.981] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.981] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.981] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.981] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.981] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.981] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.981] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.981] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.981] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.981] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.981] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0084.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad68, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0084.982] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0084.982] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0084.982] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.982] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.982] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.982] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c20, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.982] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0084.982] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0084.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0084.982] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.982] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.982] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.982] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.983] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.983] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.983] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0084.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8af90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0084.983] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0084.983] CryptHashData (hHash=0xa7cb28, pbData=0x3983c10, dwDataLen=0x3, dwFlags=0x1) returned 1 [0084.983] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.983] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.983] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.983] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.983] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.983] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.983] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.983] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.983] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0084.984] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.984] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0084.984] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.984] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.984] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0084.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b4b8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0084.984] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0084.984] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cb28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cca8) returned 1 [0084.984] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.984] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.984] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.984] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.984] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.984] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.985] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.985] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.985] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0084.985] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.985] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0084.985] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0084.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0084.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0084.986] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0084.986] CryptDestroyHash (hHash=0xa7cb28) returned 1 [0084.986] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.986] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.986] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.986] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.986] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.987] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/UiCbiMIX.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\uicbimix.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0084.987] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.987] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0084.987] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.987] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.987] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.987] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0084.988] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.UiCbiMIX.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.uicbimix.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0084.988] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.988] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.988] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.988] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.990] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0084.990] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0084.992] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x5c51, lpOverlapped=0x0) returned 1 [0084.992] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0084.996] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.996] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.996] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0084.996] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0084.998] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.998] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0084.998] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.998] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.998] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.998] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.998] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.998] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.998] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.998] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0084.998] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.998] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0084.998] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.999] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.999] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0084.999] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.999] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0084.999] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.999] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0084.999] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.999] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.999] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0084.999] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.999] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0084.999] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.999] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.999] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0084.999] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0084.999] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.999] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.999] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.999] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0084.999] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0084.999] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0084.999] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.000] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.000] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.000] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b0f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0085.005] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0085.006] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x15c51, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x15c58) returned 1 [0085.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.006] CharLowerBuffW (in: lpsz="byte[89176]", cchLength=0xb | out: lpsz="byte[89176]") returned 0xb [0085.006] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.007] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.007] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.008] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.008] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.008] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.008] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.009] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b260, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0085.009] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0085.009] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3999cb0*, pdwDataLen=0x8bef60*=0x15c51, dwBufLen=0x15c58 | out: pbData=0x3999cb0*, pdwDataLen=0x8bef60*=0x15c58) returned 1 [0085.012] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.013] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.013] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.013] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.015] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.015] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.015] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.015] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.015] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.015] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.015] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.016] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.016] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.016] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.016] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.016] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.017] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.017] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.017] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.017] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.017] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.024] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.025] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.025] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.026] WriteFile (in: hFile=0x240, lpBuffer=0x2ccd440*, nNumberOfBytesToWrite=0x15c58, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2ccd440*, lpNumberOfBytesWritten=0x8bf5e4*=0x15c58, lpOverlapped=0x0) returned 1 [0085.028] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.028] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.028] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0085.028] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.028] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0085.028] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.028] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.028] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.029] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.029] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.029] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.029] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.029] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0085.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8abe8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0085.029] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0085.029] CryptDestroyKey (hKey=0xa7cca8) returned 1 [0085.029] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.029] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.029] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.029] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.029] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.030] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.030] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.030] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.030] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.030] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.030] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.030] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.030] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.050] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.050] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.050] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.050] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.050] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.050] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.050] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.050] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.050] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.050] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.051] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.051] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.051] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.051] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.051] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.051] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.051] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.051] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.051] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.051] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.051] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.051] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.051] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.051] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.051] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.051] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.052] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.052] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.052] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.052] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.052] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.052] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.052] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.052] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.052] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.052] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0085.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a978, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0085.052] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0085.052] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0085.052] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.052] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.052] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.053] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.053] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.053] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.053] FreeLibrary (hLibModule=0x76a10000) returned 1 [0085.053] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.053] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.053] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.053] CloseHandle (hObject=0x24c) returned 1 [0085.055] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.055] CloseHandle (hObject=0x240) returned 1 [0085.057] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.059] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.059] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.059] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.059] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/UiCbiMIX.ods", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UiCbiMIX.ods", lpFilePart=0x8bedf4*="UiCbiMIX.ods") returned 0x32 [0085.059] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UiCbiMIX.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\uicbimix.ods")) returned 0x20 [0085.059] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UiCbiMIX.ods", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cda8 [0085.059] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UiCbiMIX.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\uicbimix.ods")) returned 1 [0085.114] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0085.114] FindClose (in: hFindFile=0xa7cda8 | out: hFindFile=0xa7cda8) returned 1 [0085.114] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.114] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.114] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.114] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/UiCbiMIX.ods", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UiCbiMIX.ods", lpFilePart=0x8bf650*="UiCbiMIX.ods") returned 0x32 [0085.114] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UiCbiMIX.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\uicbimix.ods")) returned 0xffffffff [0085.114] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.114] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.114] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XyTO98.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yTO98.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TO98.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O98.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="98.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.115] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XyTO98.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yTO98.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TO98.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O98.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="98.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.115] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.115] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0085.115] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.115] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.115] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.115] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.115] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.115] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0085.115] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.115] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.115] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.115] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.115] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.115] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/XyTO98.bmp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cee8 [0085.116] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0085.116] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.116] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.116] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.116] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.116] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.116] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.116] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.116] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.116] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.116] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.116] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.116] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.116] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.116] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0085.116] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.116] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.117] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0085.117] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.117] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0085.117] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.117] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.117] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.117] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.117] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.117] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.117] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0085.117] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0085.117] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.117] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.117] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.117] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.117] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.117] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.117] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0085.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a9f8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0085.118] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0085.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0085.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a9d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0085.118] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0085.118] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0085.118] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.118] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.118] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0085.118] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.119] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0085.119] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.119] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.119] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.119] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.119] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.119] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.119] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.119] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.119] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.119] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.119] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.119] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.119] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.119] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0085.119] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.119] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0085.119] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.119] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.120] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.120] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.120] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.120] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.120] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.120] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.120] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.120] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.120] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.120] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.120] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.120] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.134] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.134] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.134] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.134] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.135] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.135] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.135] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.135] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.135] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.135] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.135] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.135] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.135] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.135] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.135] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.135] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.135] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.135] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.135] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.135] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.135] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.135] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.135] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.135] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.136] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0085.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8aea0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0085.136] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0085.136] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0085.136] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.136] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.136] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.136] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0085.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0085.136] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0085.136] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0085.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0085.136] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.136] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.136] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.137] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.137] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.137] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.137] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0085.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8af48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0085.137] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0085.137] CryptHashData (hHash=0xa7d128, pbData=0x3983be0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0085.137] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.137] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.137] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.137] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.137] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.137] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.137] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.137] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.137] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.137] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.137] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.138] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.138] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.138] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0085.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b3e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0085.138] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0085.138] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d128, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d168) returned 1 [0085.138] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.138] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.138] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.138] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.138] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.138] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.138] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.138] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.138] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.138] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.138] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.138] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0085.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0085.139] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0085.139] CryptDestroyHash (hHash=0xa7d128) returned 1 [0085.139] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.139] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.139] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.139] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.139] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.140] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/XyTO98.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xyto98.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0085.140] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.140] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0085.140] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.140] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.140] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.140] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0085.140] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.XyTO98.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.xyto98.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0085.141] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.141] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.141] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.144] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0085.144] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x55d2, lpOverlapped=0x0) returned 1 [0085.145] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0085.148] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.148] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.148] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.148] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0085.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.148] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0085.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.148] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.149] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.149] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.149] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.149] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.149] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.149] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.149] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.149] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.149] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.149] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.150] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.150] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.150] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.150] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.150] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.150] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.150] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.150] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.150] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.150] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.150] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b068, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0085.151] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0085.151] CryptEncrypt (in: hKey=0xa7d168, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x55d2, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x55d8) returned 1 [0085.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.151] CharLowerBuffW (in: lpsz="byte[21976]", cchLength=0xb | out: lpsz="byte[21976]") returned 0xb [0085.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.152] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.152] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.152] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.152] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.152] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.152] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b260, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0085.152] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0085.152] CryptEncrypt (in: hKey=0xa7d168, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cc7980*, pdwDataLen=0x8bef60*=0x55d2, dwBufLen=0x55d8 | out: pbData=0x2cc7980*, pdwDataLen=0x8bef60*=0x55d8) returned 1 [0085.153] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.153] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.153] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.153] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.168] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.168] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.168] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.168] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.168] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.168] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.168] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.168] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.168] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.168] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.168] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.168] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.168] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.168] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.168] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.168] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.169] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.169] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.169] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.169] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.169] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.169] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.169] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.171] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.171] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.171] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.171] WriteFile (in: hFile=0x24c, lpBuffer=0x2ce26e0*, nNumberOfBytesToWrite=0x55d8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2ce26e0*, lpNumberOfBytesWritten=0x8bf5e4*=0x55d8, lpOverlapped=0x0) returned 1 [0085.173] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.173] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.173] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0085.173] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.173] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0085.173] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.173] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.173] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.173] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.173] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.173] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.173] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.174] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0085.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac18, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0085.174] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0085.174] CryptDestroyKey (hKey=0xa7d168) returned 1 [0085.174] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.174] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.174] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.174] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.174] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.174] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.174] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.174] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.174] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.175] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.175] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.175] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.175] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.175] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.175] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.175] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.175] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.175] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.175] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.175] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.175] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.176] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.176] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.176] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.176] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.176] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.176] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.176] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.176] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.176] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.176] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.176] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.176] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.176] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.176] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.176] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.176] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.176] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.176] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.176] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.176] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.176] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.176] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0085.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0085.177] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0085.177] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0085.177] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.177] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.177] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.177] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.177] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.177] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.177] FreeLibrary (hLibModule=0x76a10000) returned 1 [0085.177] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.177] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.177] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.177] CloseHandle (hObject=0x240) returned 1 [0085.178] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.178] CloseHandle (hObject=0x24c) returned 1 [0085.180] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.181] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.181] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.181] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.181] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/XyTO98.bmp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XyTO98.bmp", lpFilePart=0x8bedf4*="XyTO98.bmp") returned 0x30 [0085.181] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XyTO98.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xyto98.bmp")) returned 0x20 [0085.181] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XyTO98.bmp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7c9a8 [0085.182] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XyTO98.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xyto98.bmp")) returned 1 [0085.184] FindNextFileW (in: hFindFile=0xa7c9a8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0085.184] FindClose (in: hFindFile=0xa7c9a8 | out: hFindFile=0xa7c9a8) returned 1 [0085.184] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.184] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.184] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.184] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/XyTO98.bmp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XyTO98.bmp", lpFilePart=0x8bf650*="XyTO98.bmp") returned 0x30 [0085.184] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XyTO98.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xyto98.bmp")) returned 0xffffffff [0085.184] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.184] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.184] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YbpOFECxSdU1o.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bpOFECxSdU1o.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pOFECxSdU1o.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OFECxSdU1o.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FECxSdU1o.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ECxSdU1o.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CxSdU1o.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xSdU1o.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SdU1o.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dU1o.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1o.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1o.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o.odp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.185] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YbpOFECxSdU1o.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bpOFECxSdU1o.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pOFECxSdU1o.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OFECxSdU1o.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FECxSdU1o.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ECxSdU1o.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CxSdU1o.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xSdU1o.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SdU1o.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dU1o.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1o.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1o.odp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.185] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.185] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0085.185] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.185] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.185] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.185] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.186] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0085.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.186] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/YbpOFECxSdU1o.odp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7c9a8 [0085.186] FindClose (in: hFindFile=0xa7c9a8 | out: hFindFile=0xa7c9a8) returned 1 [0085.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.186] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.186] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.186] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.186] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.187] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.187] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.187] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.187] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.187] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.187] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.187] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.187] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0085.187] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.187] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.187] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0085.187] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.187] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0085.187] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.187] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.188] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.188] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.188] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.188] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.188] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0085.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0085.188] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.189] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.189] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.189] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.189] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.189] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.189] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0085.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0085.189] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0085.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0085.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a978, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0085.189] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0085.189] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0085.190] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.190] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.190] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0085.190] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.190] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0085.190] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.190] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.190] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.190] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.190] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.190] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.190] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.190] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.190] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.190] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.191] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.191] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.191] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.191] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.191] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.191] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.191] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0085.191] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.191] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0085.191] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.191] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.191] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.191] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.191] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.191] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.191] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.191] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.191] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.191] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.191] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.191] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.191] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.191] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.191] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.192] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.192] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.192] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.192] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.192] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.192] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.192] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.192] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.192] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.192] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.192] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.192] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.192] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.192] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.192] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.192] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.192] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.192] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.192] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.192] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.192] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.192] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.192] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.193] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0085.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8aed0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0085.193] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0085.193] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0085.193] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.193] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.193] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.193] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0085.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0085.193] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0085.193] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0085.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983bf0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0085.193] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.193] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.193] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.193] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.194] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.194] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.194] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0085.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8aee8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0085.194] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0085.194] CryptHashData (hHash=0xa7caa8, pbData=0x3983cb0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0085.194] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.194] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.194] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.194] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.194] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.194] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.194] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.194] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.194] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.194] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.194] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.194] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.195] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.195] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0085.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b338, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0085.195] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0085.195] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7caa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cca8) returned 1 [0085.195] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.195] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.195] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.195] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.195] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.195] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.195] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.195] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.195] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.195] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.195] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.195] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0085.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a978, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0085.196] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0085.196] CryptDestroyHash (hHash=0xa7caa8) returned 1 [0085.196] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.196] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.196] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.196] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.196] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.196] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/YbpOFECxSdU1o.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ybpofecxsdu1o.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0085.196] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.196] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0085.196] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.196] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.196] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.196] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0085.197] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.YbpOFECxSdU1o.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.ybpofecxsdu1o.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0085.197] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.197] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.197] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.197] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.200] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0085.200] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0085.201] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x3dbc, lpOverlapped=0x0) returned 1 [0085.201] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0085.248] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.248] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.248] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.249] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0085.250] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.250] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0085.250] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.250] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.250] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.267] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.267] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.267] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.267] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.267] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.267] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.267] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.267] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.267] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.267] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.267] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.267] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.267] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.267] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.267] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.267] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.267] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.268] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.268] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.268] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.268] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.268] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.268] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.268] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.268] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.268] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.268] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.268] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.268] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.268] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.268] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.268] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.269] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b068, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0085.269] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0085.269] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x13dbc, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x13dc0) returned 1 [0085.269] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.269] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.269] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.269] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.269] CharLowerBuffW (in: lpsz="byte[81344]", cchLength=0xb | out: lpsz="byte[81344]") returned 0xb [0085.269] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.272] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.272] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.272] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.272] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.272] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.272] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.274] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b2c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0085.274] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0085.274] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3997e18*, pdwDataLen=0x8bef60*=0x13dbc, dwBufLen=0x13dc0 | out: pbData=0x3997e18*, pdwDataLen=0x8bef60*=0x13dc0) returned 1 [0085.277] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.277] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.277] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.277] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.278] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.278] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.278] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.278] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.278] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.278] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.278] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.278] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.278] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.278] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.278] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.278] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.278] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.279] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.279] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.279] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.279] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.279] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.279] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.279] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.279] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.279] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.279] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.286] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.287] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.287] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.288] WriteFile (in: hFile=0x240, lpBuffer=0x2cb77e0*, nNumberOfBytesToWrite=0x13dc0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb77e0*, lpNumberOfBytesWritten=0x8bf5e4*=0x13dc0, lpOverlapped=0x0) returned 1 [0085.290] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.290] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.290] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0085.290] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.290] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0085.290] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.290] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.290] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.290] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.290] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.290] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.290] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.290] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0085.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8abe8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0085.291] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0085.291] CryptDestroyKey (hKey=0xa7cca8) returned 1 [0085.291] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.291] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.291] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.291] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.291] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.291] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.291] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.291] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.291] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.291] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.291] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.291] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.291] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.291] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.291] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.291] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.291] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.291] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.291] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.291] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.291] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.292] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.292] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.292] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.292] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.292] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.292] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.292] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.292] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.292] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.292] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.292] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.292] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.292] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.292] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.292] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.292] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.292] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.292] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.292] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.292] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.292] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.292] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.293] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.293] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.293] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.293] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.293] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.293] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.293] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.293] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.295] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.295] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0085.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0085.295] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0085.296] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0085.296] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.296] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.296] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.296] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.296] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.296] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.296] FreeLibrary (hLibModule=0x76a10000) returned 1 [0085.296] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.296] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.296] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.296] CloseHandle (hObject=0x24c) returned 1 [0085.299] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.299] CloseHandle (hObject=0x240) returned 1 [0085.303] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.306] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.306] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.306] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.306] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/YbpOFECxSdU1o.odp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YbpOFECxSdU1o.odp", lpFilePart=0x8bedf4*="YbpOFECxSdU1o.odp") returned 0x37 [0085.306] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YbpOFECxSdU1o.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ybpofecxsdu1o.odp")) returned 0x20 [0085.306] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YbpOFECxSdU1o.odp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cf28 [0085.306] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YbpOFECxSdU1o.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ybpofecxsdu1o.odp")) returned 1 [0085.309] FindNextFileW (in: hFindFile=0xa7cf28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0085.309] FindClose (in: hFindFile=0xa7cf28 | out: hFindFile=0xa7cf28) returned 1 [0085.309] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.309] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.310] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.310] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/YbpOFECxSdU1o.odp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YbpOFECxSdU1o.odp", lpFilePart=0x8bf650*="YbpOFECxSdU1o.odp") returned 0x37 [0085.310] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YbpOFECxSdU1o.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ybpofecxsdu1o.odp")) returned 0xffffffff [0085.310] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.310] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.310] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YeqB3B7c2.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eqB3B7c2.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qB3B7c2.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B3B7c2.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3B7c2.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B7c2.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7c2.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c2.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2.odt", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.310] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YeqB3B7c2.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eqB3B7c2.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qB3B7c2.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B3B7c2.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3B7c2.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B7c2.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7c2.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c2.odt", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.311] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.311] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0085.311] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.311] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.311] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.311] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.311] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.311] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0085.311] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.311] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.311] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.311] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.311] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.311] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/YeqB3B7c2.odt", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7caa8 [0085.312] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0085.312] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.312] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.312] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.312] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.312] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.312] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.312] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.312] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.312] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.312] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.312] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.312] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.312] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.313] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0085.315] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.315] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.315] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0085.315] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.315] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0085.315] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.315] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.315] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.315] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.316] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.316] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.316] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0085.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0085.316] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.316] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.316] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.316] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.316] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.316] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.316] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0085.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0085.317] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0085.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0085.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aab8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0085.317] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0085.317] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0085.318] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.318] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.318] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0085.318] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.318] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0085.318] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.318] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.318] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.318] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.318] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.318] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.318] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.318] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.318] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.318] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.318] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.318] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.319] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.319] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.319] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.319] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.319] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0085.319] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.319] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0085.319] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.319] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.319] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.319] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.319] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.319] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.319] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.319] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.319] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.319] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.319] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.319] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.320] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.320] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.320] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.320] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.320] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.320] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.320] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.320] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.320] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.320] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.320] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.320] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.320] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.320] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.320] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.320] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.320] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.320] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.321] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.321] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.321] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.321] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.321] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.321] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.321] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.321] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.321] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0085.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad50, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0085.321] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0085.321] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0085.322] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.322] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.322] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.322] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0085.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983be0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0085.322] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0085.322] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0085.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0085.322] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.322] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.322] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.322] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.322] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.322] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.325] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0085.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8af48, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0085.325] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0085.325] CryptHashData (hHash=0xa7cfa8, pbData=0x3983cd0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0085.326] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.326] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.326] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.326] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.326] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.326] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.326] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.326] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.326] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.326] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.326] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.326] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.326] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.326] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0085.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b338, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0085.327] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0085.327] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cfa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cca8) returned 1 [0085.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.327] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.327] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.327] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.327] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.327] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.327] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.327] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0085.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7acb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0085.328] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0085.328] CryptDestroyHash (hHash=0xa7cfa8) returned 1 [0085.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.328] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.328] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.328] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.328] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.329] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/YeqB3B7c2.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\yeqb3b7c2.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0085.330] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.330] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0085.330] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.330] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.330] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.330] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming")) returned 0x10 [0085.330] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/Lock.YeqB3B7c2.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lock.yeqb3b7c2.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0085.331] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.331] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.331] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.331] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.333] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0085.333] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x4e84, lpOverlapped=0x0) returned 1 [0085.335] ReadFile (in: hFile=0x240, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0085.338] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.338] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.338] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.338] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0085.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.338] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0085.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.338] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.339] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.339] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.339] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.339] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.339] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.339] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.339] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.339] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.339] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.339] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.339] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.339] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.339] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.339] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.339] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.339] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.339] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.339] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.340] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.340] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.340] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.340] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.340] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.340] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.340] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.340] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.340] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.340] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.340] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.340] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b1a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0085.341] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0085.341] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x4e84, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x4e88) returned 1 [0085.341] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.341] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.341] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.341] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.341] CharLowerBuffW (in: lpsz="byte[20104]", cchLength=0xb | out: lpsz="byte[20104]") returned 0xb [0085.341] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.342] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.342] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.342] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.342] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.342] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.342] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.342] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b158, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0085.342] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0085.342] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cc6390*, pdwDataLen=0x8bef60*=0x4e84, dwBufLen=0x4e88 | out: pbData=0x2cc6390*, pdwDataLen=0x8bef60*=0x4e88) returned 1 [0085.343] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.343] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.343] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.343] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.343] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.344] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.344] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.344] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.344] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.344] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.344] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.344] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.344] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.344] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.344] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.344] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.344] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.344] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.344] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.345] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.345] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.345] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.345] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.345] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.345] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.345] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.345] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.347] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.347] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.347] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.347] WriteFile (in: hFile=0x24c, lpBuffer=0x2cdec60*, nNumberOfBytesToWrite=0x4e88, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cdec60*, lpNumberOfBytesWritten=0x8bf5e4*=0x4e88, lpOverlapped=0x0) returned 1 [0085.348] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.348] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.348] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0085.349] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.349] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0085.349] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.349] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.349] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.349] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.350] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.350] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.350] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.350] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0085.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ac30, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0085.350] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0085.350] CryptDestroyKey (hKey=0xa7cca8) returned 1 [0085.350] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.350] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.350] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.350] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.351] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.351] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.351] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.351] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.351] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.351] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.351] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.351] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.351] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.351] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.351] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.351] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.351] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.351] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.351] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.351] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.351] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.351] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.352] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.352] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.352] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.352] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.352] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.352] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.352] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.352] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.352] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.352] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.352] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.352] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.352] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.352] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.352] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.352] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.352] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.352] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.352] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.353] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.353] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.353] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.353] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.353] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.353] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.353] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.353] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.353] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.353] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.353] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.353] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0085.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a9d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0085.354] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0085.354] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0085.354] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.354] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.354] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.354] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.354] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.354] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.354] FreeLibrary (hLibModule=0x76a10000) returned 1 [0085.354] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.354] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.354] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.354] CloseHandle (hObject=0x240) returned 1 [0085.355] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.355] CloseHandle (hObject=0x24c) returned 1 [0085.360] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.361] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.361] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.361] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/YeqB3B7c2.odt", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YeqB3B7c2.odt", lpFilePart=0x8bedf4*="YeqB3B7c2.odt") returned 0x33 [0085.361] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YeqB3B7c2.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\yeqb3b7c2.odt")) returned 0x20 [0085.361] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YeqB3B7c2.odt", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7c9a8 [0085.362] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YeqB3B7c2.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\yeqb3b7c2.odt")) returned 1 [0085.364] FindNextFileW (in: hFindFile=0xa7c9a8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0085.365] FindClose (in: hFindFile=0xa7c9a8 | out: hFindFile=0xa7c9a8) returned 1 [0085.365] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.365] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.365] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.365] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Roaming/YeqB3B7c2.odt", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YeqB3B7c2.odt", lpFilePart=0x8bf650*="YeqB3B7c2.odt") returned 0x33 [0085.365] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YeqB3B7c2.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\yeqb3b7c2.odt")) returned 0xffffffff [0085.365] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.365] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.365] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.365] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.365] CharUpperBuffW (in: lpsz="A1600E02A1D", cchLength=0xb | out: lpsz="A1600E02A1D") returned 0xb [0085.366] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.366] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf2b8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.366] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.366] CharUpperBuffW (in: lpsz="SSA1600E02A1D", cchLength=0xd | out: lpsz="SSA1600E02A1D") returned 0xd [0085.366] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.366] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.366] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0085.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x2c8a6d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/]+\\z", lpUsedDefaultChar=0x0) returned 9 [0085.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps/AppData/Local", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0085.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps/AppData/Local", cchWideChar=36, lpMultiByteStr=0x2c07148, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\CIiHmnxMn6Ps/AppData/Local", lpUsedDefaultChar=0x0) returned 36 [0085.366] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.366] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Local\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local")) returned 0x10 [0085.366] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0085.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x2c7a978, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", lpUsedDefaultChar=0x0) returned 23 [0085.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0085.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x3983bd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.*", lpUsedDefaultChar=0x0) returned 4 [0085.367] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.367] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.367] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Local\\*.*", lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0xa7cf68 [0085.367] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.367] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.367] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.367] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.367] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.367] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.367] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.368] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.368] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.368] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.368] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.368] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.368] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.368] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.368] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.368] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.368] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.368] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.368] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.368] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.368] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.368] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.368] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.369] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.369] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.369] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.369] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.370] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.370] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.370] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.370] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.370] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.370] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.370] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.370] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.371] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.371] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.371] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.371] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.371] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.372] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.372] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.372] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.372] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.372] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.372] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.372] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.372] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.372] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.372] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.372] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.372] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.372] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.372] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.372] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.372] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.372] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.372] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.373] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.373] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.373] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.373] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.373] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.373] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.373] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.373] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.373] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.373] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.373] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.373] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.373] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.373] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.373] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.373] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.373] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.374] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.374] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.374] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0085.374] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.374] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.374] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.374] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.374] FindNextFileW (in: hFindFile=0xa7cf68, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0 [0085.374] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.374] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.374] FindClose (in: hFindFile=0xa7cf68 | out: hFindFile=0xa7cf68) returned 1 [0085.374] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.374] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0085.375] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.375] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.375] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IconCache.db", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="conCache.db", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="onCache.db", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nCache.db", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache.db", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ache.db", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="che.db", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="he.db", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.375] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IconCache.db", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="conCache.db", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="onCache.db", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nCache.db", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache.db", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ache.db", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="che.db", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.376] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.376] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0085.376] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.376] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.376] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.376] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.377] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.377] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0085.377] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.377] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.377] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.377] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.377] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.377] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Local/IconCache.db", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cc28 [0085.377] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0085.377] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.377] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.377] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.378] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.378] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.378] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.378] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.378] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.378] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.378] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.378] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.378] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.378] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.378] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0085.378] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.378] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.379] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0085.379] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.379] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0085.379] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.379] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.379] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.379] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.379] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.379] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.379] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0085.379] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0085.379] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.379] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.379] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.379] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.379] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.379] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.380] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0085.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0085.380] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0085.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0085.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a9d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0085.380] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0085.380] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0085.381] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.381] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.381] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0085.381] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.381] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0085.381] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.381] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.381] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.382] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.382] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.382] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.382] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.382] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.382] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.382] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.382] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.382] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.382] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.382] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.382] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.382] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.382] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0085.382] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.382] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0085.382] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.382] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.383] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.383] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.383] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.383] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.383] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.388] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.388] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.388] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.388] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.388] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.388] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.388] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.388] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.388] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.388] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.388] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.388] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.388] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.388] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.388] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.389] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.389] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.389] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.389] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.389] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.389] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.389] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.389] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.389] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.389] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.389] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.389] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.389] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.389] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.389] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.389] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.389] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0085.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8b338, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0085.390] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0085.390] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0085.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0085.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b20, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0085.390] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0085.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0085.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b20, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0085.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.390] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.390] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.390] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.391] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.391] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.391] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0085.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b1e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0085.391] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0085.391] CryptHashData (hHash=0xa7cb28, pbData=0x3983b00, dwDataLen=0x3, dwFlags=0x1) returned 1 [0085.391] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.391] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.391] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.391] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.392] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.392] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.392] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.392] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.392] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.392] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.392] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.392] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.392] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.392] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0085.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b8c0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0085.392] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0085.392] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cb28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d068) returned 1 [0085.392] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.392] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.392] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.392] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.393] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.393] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.393] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.393] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.393] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.393] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0085.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7abf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0085.393] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0085.393] CryptDestroyHash (hHash=0xa7cb28) returned 1 [0085.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.393] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.393] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.393] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.393] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.393] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Local/IconCache.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\iconcache.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0085.394] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.394] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0085.394] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.394] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.394] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.394] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Local/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local")) returned 0x10 [0085.394] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Local/Lock.IconCache.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\lock.iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0085.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.397] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0085.397] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0085.400] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0xda38, lpOverlapped=0x0) returned 1 [0085.401] ReadFile (in: hFile=0x24c, lpBuffer=0x2c977d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c977d0*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0085.408] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.410] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.410] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.410] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0085.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.412] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0085.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.413] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.413] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.413] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.413] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.413] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.413] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.413] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.413] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.413] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.413] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.413] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.413] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.413] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.413] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.413] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.413] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.413] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.413] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.414] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.414] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.414] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.414] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.414] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.414] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.414] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.414] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.414] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.414] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.414] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.415] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b3f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0085.416] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0085.416] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x1da38, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x1da40) returned 1 [0085.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.416] CharLowerBuffW (in: lpsz="byte[121408]", cchLength=0xc | out: lpsz="byte[121408]") returned 0xc [0085.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.419] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.419] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.419] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.422] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b338, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0085.422] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0085.422] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x39bf4d0*, pdwDataLen=0x8bef60*=0x1da38, dwBufLen=0x1da40 | out: pbData=0x39bf4d0*, pdwDataLen=0x8bef60*=0x1da40) returned 1 [0085.427] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.427] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.427] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.427] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.427] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.427] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.439] WriteFile (in: hFile=0x240, lpBuffer=0x3a18008*, nNumberOfBytesToWrite=0x1da40, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesWritten=0x8bf5e4*=0x1da40, lpOverlapped=0x0) returned 1 [0085.443] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.443] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.443] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0085.443] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.443] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0085.443] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.443] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.443] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.444] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.444] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.444] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.444] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0085.444] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0085.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8b260, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0085.444] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0085.444] CryptDestroyKey (hKey=0xa7d068) returned 1 [0085.444] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.444] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.444] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.444] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.444] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.445] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.445] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.445] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.445] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.445] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.445] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.445] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.445] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0085.445] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.445] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.445] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.445] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.445] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.445] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0085.445] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.445] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0085.445] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.445] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0085.446] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.446] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.446] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.446] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.446] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.446] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.446] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.446] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.446] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.446] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.446] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.446] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.446] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.446] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.446] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.446] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.447] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.447] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.447] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.447] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.447] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.447] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.447] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.447] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.447] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.447] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.447] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.447] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.447] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.447] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0085.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ab98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0085.448] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0085.448] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0085.448] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.448] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.448] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.448] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.448] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.448] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0085.448] FreeLibrary (hLibModule=0x76a10000) returned 1 [0085.448] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.448] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.448] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.448] CloseHandle (hObject=0x24c) returned 1 [0085.449] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.449] CloseHandle (hObject=0x240) returned 1 [0085.452] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.462] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.462] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.462] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.462] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Local/IconCache.db", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db", lpFilePart=0x8bedf4*="IconCache.db") returned 0x30 [0085.462] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\iconcache.db")) returned 0x22 [0085.462] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d0a8 [0085.462] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\iconcache.db")) returned 1 [0085.464] FindNextFileW (in: hFindFile=0xa7d0a8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0085.464] FindClose (in: hFindFile=0xa7d0a8 | out: hFindFile=0xa7d0a8) returned 1 [0085.465] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.465] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.465] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.465] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Local/IconCache.db", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db", lpFilePart=0x8bf650*="IconCache.db") returned 0x30 [0085.465] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\iconcache.db")) returned 0xffffffff [0085.465] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.465] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.465] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TempCHHKSM.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="empCHHKSM.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mpCHHKSM.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pCHHKSM.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CHHKSM.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HHKSM.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HKSM.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KSM.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0085.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SM.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M.exe", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0085.466] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TempCHHKSM.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="empCHHKSM.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mpCHHKSM.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pCHHKSM.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CHHKSM.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0085.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HHKSM.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HKSM.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KSM.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SM.exe", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0085.466] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0085.466] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0085.466] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.466] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.466] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0085.466] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0085.466] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.466] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0085.466] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.467] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.467] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.467] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.467] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.467] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Local/TempCHHKSM.exe", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7ce28 [0085.467] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0085.467] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.467] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.467] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.467] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.467] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.467] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.467] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.467] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.467] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.467] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.468] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.468] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0085.468] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.468] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0085.468] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.477] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.477] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0085.477] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.477] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0085.478] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.478] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.478] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.478] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.478] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.478] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.478] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0085.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0085.478] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.478] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.478] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.478] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.478] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.478] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0085.478] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0085.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0085.479] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0085.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0085.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0085.479] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0085.479] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0085.480] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.480] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.480] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0085.480] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.480] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0085.480] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.480] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.480] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.480] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.480] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.480] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.480] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.480] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.481] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.481] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.481] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.481] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0085.481] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0085.481] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.481] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.481] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.481] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0085.481] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.481] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0085.481] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.481] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.481] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.481] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.481] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.481] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.481] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.481] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.482] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.482] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.482] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.482] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.482] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.482] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.482] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.482] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.482] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.482] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.482] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.482] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.482] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.482] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.482] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.482] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.482] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.483] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.483] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.483] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.483] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.483] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.483] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.483] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.483] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.483] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.483] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.483] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.483] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.483] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.483] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0085.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8b320, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0085.484] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0085.484] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0085.484] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.484] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.484] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.484] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0085.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0085.484] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0085.484] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0085.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0085.484] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.485] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.485] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.485] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.485] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.485] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.485] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0085.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b1e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0085.485] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0085.486] CryptHashData (hHash=0xa7cca8, pbData=0x3983b20, dwDataLen=0x3, dwFlags=0x1) returned 1 [0085.486] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.486] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.486] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.486] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.486] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.486] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.486] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.486] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.486] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0085.486] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.486] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0085.486] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.486] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.486] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0085.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b860, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0085.487] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0085.487] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cca8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d0a8) returned 1 [0085.487] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.487] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.487] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.487] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.487] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.487] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.487] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.487] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.487] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.487] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.487] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0085.488] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0085.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7abd8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0085.488] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0085.488] CryptDestroyHash (hHash=0xa7cca8) returned 1 [0085.488] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.488] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.488] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.488] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.488] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.489] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Local/TempCHHKSM.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tempchhksm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0085.489] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.489] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0085.489] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.489] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.489] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Local/" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local")) returned 0x10 [0085.489] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Local/Lock.TempCHHKSM.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\lock.tempchhksm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0085.491] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.491] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.491] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.491] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.494] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0085.494] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0085.496] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0085.497] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0085.498] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0085.499] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0085.501] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0085.502] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0085.504] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0085.505] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0085.506] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0085.507] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0085.508] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0085.510] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0xe867, lpOverlapped=0x0) returned 1 [0085.511] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0085.560] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.571] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.571] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0085.585] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0085.665] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.666] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0085.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.666] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0085.666] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.666] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0085.666] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.666] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.666] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.666] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.666] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.666] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.667] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.667] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.667] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.667] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0085.667] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.667] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0085.667] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.667] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.667] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.667] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.667] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.667] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.667] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.668] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.668] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.681] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b380, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0085.682] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0085.682] CryptEncrypt (in: hKey=0xa7d0a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xce867, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xce868) returned 1 [0085.682] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.682] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.682] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.682] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.683] CharLowerBuffW (in: lpsz="byte[845928]", cchLength=0xc | out: lpsz="byte[845928]") returned 0xc [0085.695] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.722] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 1 [0085.723] TranslateMessage (lpMsg=0x8bf3b8) returned 0 [0085.723] DispatchMessageW (lpMsg=0x8bf3b8) returned 0x0 [0085.723] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0085.723] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0085.723] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.723] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0085.723] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.723] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0085.723] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.723] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0085.751] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0085.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b4b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0085.752] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0085.752] CryptEncrypt (in: hKey=0xa7d0a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e28020*, pdwDataLen=0x8bef60*=0xce867, dwBufLen=0xce868 | out: pbData=0x3e28020*, pdwDataLen=0x8bef60*=0xce868) returned 1 [0085.781] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.781] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.781] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.781] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.849] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.849] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.849] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0085.849] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0085.849] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.849] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0085.850] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.850] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.850] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0085.850] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.850] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0085.850] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.850] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.850] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0085.850] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.850] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0085.850] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.850] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0085.850] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.850] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0085.850] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.850] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0085.850] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.049] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.050] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.050] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.059] WriteFile (in: hFile=0x24c, lpBuffer=0x3c66020*, nNumberOfBytesToWrite=0xce868, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3c66020*, lpNumberOfBytesWritten=0x8bf5e4*=0xce868, lpOverlapped=0x0) returned 1 [0086.089] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.089] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.089] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0086.089] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.089] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0086.089] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.089] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.089] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.090] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.090] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.090] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.090] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.090] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8b050, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0086.090] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0086.090] CryptDestroyKey (hKey=0xa7d0a8) returned 1 [0086.090] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.090] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.090] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.090] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.090] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.090] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.090] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.090] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.091] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.091] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.091] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.091] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.091] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.091] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.091] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.091] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.091] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.091] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.091] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.091] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.091] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.091] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.091] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.091] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.091] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.091] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.091] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.091] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.091] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.091] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.091] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.092] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.092] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.092] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.092] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.092] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.092] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.092] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.092] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.092] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.092] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.092] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.092] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.092] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.092] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.092] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.092] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.092] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.092] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.092] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.092] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.092] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.092] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0086.093] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0086.093] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0086.093] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.093] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.093] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.093] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.093] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.093] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.093] FreeLibrary (hLibModule=0x76a10000) returned 1 [0086.093] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.093] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.093] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.093] CloseHandle (hObject=0x240) returned 1 [0086.094] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.094] CloseHandle (hObject=0x24c) returned 1 [0086.108] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.128] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.128] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.128] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.128] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Local/TempCHHKSM.exe", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", lpFilePart=0x8bedf4*="TempCHHKSM.exe") returned 0x32 [0086.128] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tempchhksm.exe")) returned 0x20 [0086.128] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7caa8 [0086.128] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tempchhksm.exe")) returned 0 [0086.128] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0086.129] GetLastError () returned 0x5 [0086.129] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.129] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.129] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.129] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps/AppData/Local/TempCHHKSM.exe", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe", lpFilePart=0x8bf650*="TempCHHKSM.exe") returned 0x32 [0086.129] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tempchhksm.exe")) returned 0x20 [0086.129] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.129] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.129] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.129] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.129] CharLowerBuffW (in: lpsz="FIXED", cchLength=0x5 | out: lpsz="fixed") returned 0x5 [0086.129] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0086.129] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0086.130] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0086.130] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0086.130] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0086.130] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0086.130] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0086.130] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0086.130] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0086.130] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0086.130] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0086.130] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0086.130] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0086.131] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0086.131] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0086.131] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0086.131] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0086.131] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0086.131] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0086.131] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0086.131] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0086.131] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0086.131] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0086.132] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0086.132] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0086.132] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0086.132] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.132] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.132] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c:", cchCount1=2, lpString2="c:", cchCount2=2) returned 2 [0086.132] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.132] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.132] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.132] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.132] CharUpperBuffW (in: lpsz="A1600E02A1D", cchLength=0xb | out: lpsz="A1600E02A1D") returned 0xb [0086.132] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.132] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf2b8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.133] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.133] CharUpperBuffW (in: lpsz="SSA1600E02A1D", cchLength=0xd | out: lpsz="SSA1600E02A1D") returned 0xd [0086.133] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.133] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.133] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0086.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x2c926b8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/]+\\z", lpUsedDefaultChar=0x0) returned 9 [0086.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\Music", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0086.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\Music", cchWideChar=28, lpMultiByteStr=0x2c875c0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\CIiHmnxMn6Ps\\Music", lpUsedDefaultChar=0x0) returned 28 [0086.133] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.133] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0086.133] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0086.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x2c7aab8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", lpUsedDefaultChar=0x0) returned 23 [0086.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x3983bf0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.*", lpUsedDefaultChar=0x0) returned 4 [0086.134] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.134] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.134] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0xa7d168 [0086.134] FindNextFileW (in: hFindFile=0xa7d168, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.134] FindNextFileW (in: hFindFile=0xa7d168, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.134] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.134] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.134] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.134] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.134] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.134] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.134] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.134] FindNextFileW (in: hFindFile=0xa7d168, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.134] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.134] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.134] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] FindNextFileW (in: hFindFile=0xa7d168, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] FindNextFileW (in: hFindFile=0xa7d168, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] FindNextFileW (in: hFindFile=0xa7d168, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] FindNextFileW (in: hFindFile=0xa7d168, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.135] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.136] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.136] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.136] FindNextFileW (in: hFindFile=0xa7d168, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.136] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.136] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.136] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.136] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.136] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.136] FindNextFileW (in: hFindFile=0xa7d168, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.136] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.136] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.136] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.136] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.136] FindNextFileW (in: hFindFile=0xa7d168, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0 [0086.136] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.136] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.136] FindClose (in: hFindFile=0xa7d168 | out: hFindFile=0xa7d168) returned 1 [0086.137] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.137] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.137] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.137] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.137] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.137] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.137] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.137] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0086.137] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.137] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.138] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.138] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.138] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0086.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.138] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cb68 [0086.138] FindClose (in: hFindFile=0xa7cb68 | out: hFindFile=0xa7cb68) returned 1 [0086.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.138] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.138] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.138] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.138] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.139] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.139] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.139] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.139] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.139] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.139] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0086.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.139] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0086.139] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.139] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0086.139] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.139] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.139] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.139] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.140] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0086.140] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0086.140] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.140] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.140] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.140] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.140] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.140] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.140] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7acb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0086.140] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0086.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0086.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7acf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0086.140] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0086.141] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0086.141] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.141] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.141] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0086.141] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.141] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0086.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.142] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.142] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.142] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.142] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.142] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.142] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.142] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.142] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.142] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0086.142] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.142] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0086.142] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.142] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.143] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.143] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.143] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.143] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.149] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.149] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.149] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.149] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.149] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.149] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.149] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.149] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.149] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.149] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.149] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.149] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.150] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.150] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.150] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.150] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.150] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.150] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.150] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.150] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.150] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.150] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.150] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.150] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.150] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.150] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.150] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.150] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.150] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8b200, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0086.151] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0086.151] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0086.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.151] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0086.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c50, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.151] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.151] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.151] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.151] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.151] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.151] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.151] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b158, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0086.152] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0086.152] CryptHashData (hHash=0xa7cda8, pbData=0x3983b00, dwDataLen=0x3, dwFlags=0x1) returned 1 [0086.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.152] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.152] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.152] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.152] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.152] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.152] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.152] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.152] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.152] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.152] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.152] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.153] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0086.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b8a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0086.153] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0086.153] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cda8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cc28) returned 1 [0086.153] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.153] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.153] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.153] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.153] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.153] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.153] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.153] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.153] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.153] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.153] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.154] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0086.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a9d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0086.154] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0086.154] CryptDestroyHash (hHash=0xa7cda8) returned 1 [0086.154] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.154] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.154] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.154] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.154] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.155] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0086.155] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.155] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0086.155] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.155] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.155] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.155] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music/" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0086.155] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music/Lock.desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\lock.desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0086.156] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.156] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.156] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.156] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.158] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0086.158] ReadFile (in: hFile=0x24c, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x1f8, lpOverlapped=0x0) returned 1 [0086.159] ReadFile (in: hFile=0x24c, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0086.161] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.161] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.161] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.162] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0086.162] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.162] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0086.162] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.162] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.162] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.162] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.162] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.162] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.162] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.162] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.162] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.162] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.162] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.162] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.162] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.162] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.162] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.162] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.162] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.163] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.163] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.163] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.163] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.163] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.163] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.163] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.163] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.163] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.163] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.163] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.163] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.163] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.163] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.163] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.163] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.163] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.163] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.163] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b4e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.164] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.164] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x1f8, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x200) returned 1 [0086.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.164] CharLowerBuffW (in: lpsz="byte[512]", cchLength=0x9 | out: lpsz="byte[512]") returned 0x9 [0086.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.164] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.164] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.164] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.164] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.164] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.182] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.182] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b350, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.182] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.182] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c85448*, pdwDataLen=0x8bef60*=0x1f8, dwBufLen=0x200 | out: pbData=0x2c85448*, pdwDataLen=0x8bef60*=0x200) returned 1 [0086.182] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.182] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.182] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.182] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.182] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.182] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.183] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.183] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.183] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.183] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.183] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.183] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.183] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.183] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.183] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.183] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.183] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.183] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.183] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.183] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.183] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.183] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.183] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.183] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.183] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.183] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.183] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.184] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.184] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.184] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.184] WriteFile (in: hFile=0x240, lpBuffer=0x2c045c0*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2c045c0*, lpNumberOfBytesWritten=0x8bf5e4*=0x200, lpOverlapped=0x0) returned 1 [0086.185] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.185] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.185] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0086.185] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.185] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0086.185] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.185] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.185] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.185] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.185] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.185] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8aeb8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0086.185] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0086.185] CryptDestroyKey (hKey=0xa7cc28) returned 1 [0086.186] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.186] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.186] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.186] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.186] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.186] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.186] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.186] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.186] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.186] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.186] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.186] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.186] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.186] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.186] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.186] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.186] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0086.187] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0086.187] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0086.187] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.187] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.187] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.187] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.187] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.187] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.187] FreeLibrary (hLibModule=0x76a10000) returned 1 [0086.187] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.187] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.187] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.187] CloseHandle (hObject=0x24c) returned 1 [0086.189] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.189] CloseHandle (hObject=0x240) returned 1 [0086.190] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.190] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.190] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.191] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.191] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", lpFilePart=0x8bedf4*="desktop.ini") returned 0x27 [0086.191] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\desktop.ini")) returned 0x26 [0086.191] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0086.191] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\desktop.ini")) returned 1 [0086.192] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0086.192] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0086.192] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.192] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.192] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.192] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", lpFilePart=0x8bf650*="desktop.ini") returned 0x27 [0086.192] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\desktop.ini")) returned 0xffffffff [0086.193] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.193] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.193] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZPcES1.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PcES1.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cES1.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ES1.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S1.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.wav", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.193] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZPcES1.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PcES1.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cES1.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ES1.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S1.wav", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.193] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.193] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0086.193] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.193] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.193] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.193] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.193] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.193] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0086.194] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.194] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.194] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.194] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.194] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.194] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZPcES1.wav", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cf28 [0086.194] FindClose (in: hFindFile=0xa7cf28 | out: hFindFile=0xa7cf28) returned 1 [0086.194] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.194] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.194] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.194] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.194] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.194] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.194] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.194] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.194] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.195] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.195] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.195] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.195] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.197] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0086.197] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.197] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.197] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0086.197] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.197] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0086.197] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.197] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.197] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.197] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.197] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.197] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.198] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0086.198] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0086.198] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.198] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.198] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.198] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.198] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.198] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.198] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0086.198] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0086.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0086.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a9d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0086.199] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0086.199] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0086.199] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.199] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.199] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0086.199] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.199] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0086.199] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.200] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.200] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.200] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.200] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.200] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.200] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.200] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.200] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.200] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.200] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.200] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.200] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.200] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.200] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.200] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.200] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0086.200] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.200] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0086.200] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.200] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.201] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.201] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.201] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.201] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.201] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.201] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.201] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.201] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.201] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.201] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.201] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.201] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.201] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.201] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.201] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.201] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.201] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.201] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.201] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.201] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.201] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.202] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.202] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.202] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.202] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.202] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.202] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.202] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.202] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.202] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.202] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.202] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.202] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.202] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.202] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.202] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.202] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8b200, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0086.203] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0086.203] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0086.203] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.203] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.203] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.203] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b70, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.203] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0086.203] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.203] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.203] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.203] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.203] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.203] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.203] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.205] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b140, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0086.206] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0086.206] CryptHashData (hHash=0xa7cd28, pbData=0x3983c10, dwDataLen=0x3, dwFlags=0x1) returned 1 [0086.206] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.206] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.206] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.206] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.206] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.206] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.206] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.206] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.206] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.206] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.206] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.206] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.206] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.206] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0086.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b620, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0086.207] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0086.207] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cd28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7caa8) returned 1 [0086.207] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.207] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.207] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.207] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.207] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.207] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.207] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.207] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.207] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.207] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.207] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.207] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0086.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aa58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0086.208] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0086.208] CryptDestroyHash (hHash=0xa7cd28) returned 1 [0086.208] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.208] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.208] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.208] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.208] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.208] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZPcES1.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zpces1.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0086.209] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.209] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0086.209] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.209] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.209] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.209] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music/" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0086.210] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music/Lock.ZPcES1.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\lock.zpces1.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0086.210] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.210] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.210] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.210] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.212] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0086.212] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0xad87, lpOverlapped=0x0) returned 1 [0086.214] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0086.217] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.217] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.219] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0086.220] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.220] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0086.220] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.220] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.220] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.220] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.220] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.220] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.220] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.220] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.220] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.220] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.220] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.220] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.220] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.220] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.220] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.220] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.221] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.221] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.221] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.221] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.221] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.221] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.221] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.221] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.221] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.221] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.221] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.221] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.221] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.221] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.221] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.222] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b3f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.222] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.222] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xad87, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xad88) returned 1 [0086.222] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.222] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.223] CharLowerBuffW (in: lpsz="byte[44424]", cchLength=0xb | out: lpsz="byte[44424]") returned 0xb [0086.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.224] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.224] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.224] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.224] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.224] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.224] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.224] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b3f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.224] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.224] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cb48c0*, pdwDataLen=0x8bef60*=0xad87, dwBufLen=0xad88 | out: pbData=0x2cb48c0*, pdwDataLen=0x8bef60*=0xad88) returned 1 [0086.226] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.226] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.226] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.226] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.226] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.226] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.226] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.226] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.226] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.226] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.226] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.226] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.226] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.226] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.226] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.227] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.227] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.227] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.227] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.227] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.227] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.227] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.227] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.227] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.227] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.227] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.227] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.230] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.231] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.231] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.231] WriteFile (in: hFile=0x24c, lpBuffer=0x2c9eda0*, nNumberOfBytesToWrite=0xad88, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2c9eda0*, lpNumberOfBytesWritten=0x8bf5e4*=0xad88, lpOverlapped=0x0) returned 1 [0086.232] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.232] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.232] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0086.232] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.232] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0086.233] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.233] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.233] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.233] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.233] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.233] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.233] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.233] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8aea0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0086.233] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0086.233] CryptDestroyKey (hKey=0xa7caa8) returned 1 [0086.233] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.233] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.234] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.234] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.234] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.234] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.234] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.234] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.234] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.234] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.234] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.234] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.234] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.234] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.234] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.234] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.234] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.234] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.234] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.234] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.234] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.234] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.235] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.235] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.235] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.235] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.237] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.237] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.237] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.237] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.237] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.237] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.237] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.237] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.237] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.237] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.238] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.238] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.238] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.238] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.238] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.238] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.242] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.242] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.242] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.242] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.242] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.242] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.242] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.242] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.242] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.242] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.242] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0086.243] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0086.243] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0086.243] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.243] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.243] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.243] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.243] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.243] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.243] FreeLibrary (hLibModule=0x76a10000) returned 1 [0086.243] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.243] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.243] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.243] CloseHandle (hObject=0x240) returned 1 [0086.245] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.245] CloseHandle (hObject=0x24c) returned 1 [0086.247] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.248] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.248] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.248] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.248] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZPcES1.wav", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZPcES1.wav", lpFilePart=0x8bedf4*="ZPcES1.wav") returned 0x26 [0086.248] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZPcES1.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zpces1.wav")) returned 0x20 [0086.248] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZPcES1.wav", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7c9e8 [0086.248] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZPcES1.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zpces1.wav")) returned 1 [0086.268] FindNextFileW (in: hFindFile=0xa7c9e8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0086.268] FindClose (in: hFindFile=0xa7c9e8 | out: hFindFile=0xa7c9e8) returned 1 [0086.268] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.268] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.268] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.268] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZPcES1.wav", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZPcES1.wav", lpFilePart=0x8bf650*="ZPcES1.wav") returned 0x26 [0086.269] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZPcES1.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zpces1.wav")) returned 0xffffffff [0086.269] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.269] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.269] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.269] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.269] CharUpperBuffW (in: lpsz="A1600E02A1D", cchLength=0xb | out: lpsz="A1600E02A1D") returned 0xb [0086.269] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.269] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf2b8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.269] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.269] CharUpperBuffW (in: lpsz="SSA1600E02A1D", cchLength=0xd | out: lpsz="SSA1600E02A1D") returned 0xd [0086.269] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.269] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.269] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0086.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x2c8ab70, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/]+\\z", lpUsedDefaultChar=0x0) returned 9 [0086.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\Pictures", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0086.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\Pictures", cchWideChar=31, lpMultiByteStr=0x2c87688, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpUsedDefaultChar=0x0) returned 31 [0086.269] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.269] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0086.270] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0086.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x2c7a9d8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", lpUsedDefaultChar=0x0) returned 23 [0086.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x39839c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.*", lpUsedDefaultChar=0x0) returned 4 [0086.270] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.270] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.270] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0xa7cda8 [0086.270] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.270] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.270] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.270] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.270] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.270] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.270] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.270] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.270] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.271] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.272] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.273] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.273] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.273] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.273] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.273] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.273] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.273] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0 [0086.273] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.273] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.273] FindClose (in: hFindFile=0xa7cda8 | out: hFindFile=0xa7cda8) returned 1 [0086.273] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.273] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.273] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.274] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.274] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.274] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.274] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.274] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0086.274] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.274] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.274] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.275] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.275] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0086.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.275] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/desktop.ini", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7caa8 [0086.275] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0086.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.275] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.275] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.275] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.275] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.276] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.276] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.276] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.276] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.276] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.277] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.277] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.277] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0086.277] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.277] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.277] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0086.277] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.278] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0086.278] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.278] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.278] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.278] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.278] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.278] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.278] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0086.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0086.278] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.278] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.278] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.278] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.278] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.278] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.278] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0086.279] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0086.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0086.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac78, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0086.279] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0086.279] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0086.279] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.280] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.280] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0086.280] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.280] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0086.280] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.280] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.280] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.280] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.280] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.280] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.280] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.280] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.280] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.280] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.280] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.280] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.280] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.280] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.280] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.280] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.280] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0086.281] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.281] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0086.281] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.281] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.281] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.281] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.281] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.281] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.281] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.281] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.281] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.281] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.281] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.281] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.281] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.281] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.281] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.281] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.281] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.281] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.281] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.281] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.281] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.282] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.282] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.282] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.282] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.282] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.282] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.282] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.282] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.282] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.282] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.282] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.282] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.283] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.283] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.283] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.283] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.283] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.283] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8a960, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0086.283] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0086.283] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0086.283] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.283] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.283] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.283] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.284] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0086.284] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.284] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.284] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.284] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.284] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.284] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.284] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.284] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a480, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0086.284] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0086.284] CryptHashData (hHash=0xa7d068, pbData=0x3983c80, dwDataLen=0x3, dwFlags=0x1) returned 1 [0086.284] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.284] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.285] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.285] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.285] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.285] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.285] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.285] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.285] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.285] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.285] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.285] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.285] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.285] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0086.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8ad38, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0086.285] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0086.285] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d068, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cb28) returned 1 [0086.285] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.285] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.286] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.286] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.286] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.286] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.286] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.286] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.286] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.286] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.286] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.286] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0086.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aaf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0086.286] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0086.286] CryptDestroyHash (hHash=0xa7d068) returned 1 [0086.286] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.286] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.286] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.287] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.287] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.287] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0086.287] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.287] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0086.287] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.287] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.287] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.287] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0086.288] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/Lock.desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\lock.desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0086.288] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.288] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.288] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.288] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.292] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0086.292] ReadFile (in: hFile=0x24c, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x1f8, lpOverlapped=0x0) returned 1 [0086.292] ReadFile (in: hFile=0x24c, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0086.295] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.295] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.295] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.295] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0086.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.295] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0086.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.295] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.295] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.295] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.295] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.295] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.296] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.296] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.296] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.296] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.296] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.296] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.296] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.296] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.296] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.296] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.296] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.296] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.296] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.296] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.296] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.297] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.297] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.297] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.297] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.297] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a858, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.297] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.297] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x1f8, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x200) returned 1 [0086.297] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.298] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.298] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.298] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.298] CharLowerBuffW (in: lpsz="byte[512]", cchLength=0x9 | out: lpsz="byte[512]") returned 0x9 [0086.298] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.298] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.298] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.298] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.298] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.298] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.298] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.298] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a720, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.299] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.299] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3984050*, pdwDataLen=0x8bef60*=0x1f8, dwBufLen=0x200 | out: pbData=0x3984050*, pdwDataLen=0x8bef60*=0x200) returned 1 [0086.299] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.299] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.299] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.299] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.299] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.299] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.299] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.299] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.299] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.299] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.299] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.299] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.299] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.299] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.300] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.300] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.300] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.300] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.300] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.300] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.300] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.300] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.300] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.300] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.300] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.300] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.300] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.300] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.300] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.300] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.300] WriteFile (in: hFile=0x240, lpBuffer=0x2c85248*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2c85248*, lpNumberOfBytesWritten=0x8bf5e4*=0x200, lpOverlapped=0x0) returned 1 [0086.302] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.302] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0086.302] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0086.302] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.302] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.302] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0086.302] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0086.302] CryptDestroyKey (hKey=0xa7cb28) returned 1 [0086.302] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.302] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.302] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.303] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.303] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.303] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.303] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.303] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.303] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.303] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.303] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.303] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.309] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.310] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.310] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.310] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.310] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0086.310] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0086.310] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0086.310] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.310] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.310] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.311] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.311] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.311] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.311] FreeLibrary (hLibModule=0x76a10000) returned 1 [0086.311] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.311] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.311] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.311] CloseHandle (hObject=0x24c) returned 1 [0086.312] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.312] CloseHandle (hObject=0x240) returned 1 [0086.314] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.314] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.314] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.314] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.314] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/desktop.ini", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", lpFilePart=0x8bedf4*="desktop.ini") returned 0x2a [0086.314] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\desktop.ini")) returned 0x26 [0086.314] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7c9e8 [0086.314] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\desktop.ini")) returned 1 [0086.315] FindNextFileW (in: hFindFile=0xa7c9e8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0086.315] FindClose (in: hFindFile=0xa7c9e8 | out: hFindFile=0xa7c9e8) returned 1 [0086.316] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.316] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.316] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.316] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/desktop.ini", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", lpFilePart=0x8bf650*="desktop.ini") returned 0x2a [0086.316] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\desktop.ini")) returned 0xffffffff [0086.316] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.316] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.316] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="di ot4o1qyFI.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i ot4o1qyFI.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" ot4o1qyFI.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ot4o1qyFI.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t4o1qyFI.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4o1qyFI.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o1qyFI.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1qyFI.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qyFI.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yFI.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FI.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I.jpg", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.316] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="di ot4o1qyFI.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i ot4o1qyFI.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" ot4o1qyFI.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ot4o1qyFI.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t4o1qyFI.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4o1qyFI.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o1qyFI.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1qyFI.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qyFI.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yFI.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FI.jpg", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.317] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.317] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0086.317] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.317] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.317] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.317] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.317] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.317] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0086.317] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.317] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.317] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.317] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.317] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.317] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/di ot4o1qyFI.jpg", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cee8 [0086.317] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0086.318] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.318] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.318] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.318] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.318] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.318] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.318] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.318] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.318] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.318] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.318] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.318] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.318] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.318] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0086.318] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.318] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.318] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0086.318] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.319] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0086.319] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.319] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.319] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.319] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.319] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.319] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.319] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0086.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0086.319] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.319] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.319] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.319] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.319] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.319] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.319] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aad8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0086.319] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0086.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0086.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac78, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0086.320] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0086.320] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0086.320] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.320] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.320] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0086.320] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.320] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0086.321] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.321] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.321] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.321] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.321] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.321] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.321] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.321] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.321] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.321] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.321] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.321] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.321] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.321] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.321] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.321] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.321] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0086.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.321] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0086.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.322] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.322] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.322] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.322] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.322] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.322] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.322] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.322] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.322] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.322] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.322] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.322] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.322] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.322] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.322] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.322] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.322] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.322] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.322] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.322] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.323] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.323] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.323] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.323] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.323] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.323] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.323] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.323] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.323] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.323] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.323] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.323] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.323] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.323] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.323] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8a768, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0086.324] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0086.324] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0086.324] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.324] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d20, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.328] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0086.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d50, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.328] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.328] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.328] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.329] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.329] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.329] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a480, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0086.329] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0086.329] CryptHashData (hHash=0xa7d0e8, pbData=0x3983d40, dwDataLen=0x3, dwFlags=0x1) returned 1 [0086.329] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.329] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.329] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.329] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.329] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.329] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.329] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.330] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.330] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.330] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.330] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.330] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.330] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.330] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0086.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8acf0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0086.330] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0086.330] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d0e8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cce8) returned 1 [0086.330] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.330] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.330] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.330] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.330] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.331] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.331] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.331] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.331] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.331] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.331] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.331] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0086.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7acb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0086.331] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0086.331] CryptDestroyHash (hHash=0xa7d0e8) returned 1 [0086.331] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.331] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.331] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.331] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.331] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.332] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/di ot4o1qyFI.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\di ot4o1qyfi.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0086.332] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.332] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0086.332] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.332] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.332] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.332] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0086.332] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/Lock.di ot4o1qyFI.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\lock.di ot4o1qyfi.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0086.333] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.333] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.333] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.333] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.335] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0086.335] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0086.337] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x13ab, lpOverlapped=0x0) returned 1 [0086.337] ReadFile (in: hFile=0x240, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0086.341] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.341] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.341] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.341] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0086.342] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.342] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0086.342] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.342] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.342] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.342] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.342] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.342] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.342] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.342] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.342] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.342] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.342] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.342] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.342] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.343] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.343] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.343] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.343] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.343] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.343] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.343] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.343] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.343] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.343] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.343] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.343] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.343] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.343] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.343] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.343] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.343] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.343] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.343] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.343] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.343] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.343] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.344] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a858, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.345] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.345] CryptEncrypt (in: hKey=0xa7cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x113ab, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x113b0) returned 1 [0086.345] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.345] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.345] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.345] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.345] CharLowerBuffW (in: lpsz="byte[70576]", cchLength=0xb | out: lpsz="byte[70576]") returned 0xb [0086.345] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.347] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.347] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.347] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.347] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.347] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.347] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.347] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a930, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.348] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.348] CryptEncrypt (in: hKey=0xa7cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cc7b38*, pdwDataLen=0x8bef60*=0x113ab, dwBufLen=0x113b0 | out: pbData=0x2cc7b38*, pdwDataLen=0x8bef60*=0x113b0) returned 1 [0086.350] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.350] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.350] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.350] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.350] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.350] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.350] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.350] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.351] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.351] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.351] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.351] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.351] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.351] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.351] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.351] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.351] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.351] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.351] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.351] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.351] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.351] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.351] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.351] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.351] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.351] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.351] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.356] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.357] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.365] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.366] WriteFile (in: hFile=0x24c, lpBuffer=0x3995408*, nNumberOfBytesToWrite=0x113b0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3995408*, lpNumberOfBytesWritten=0x8bf5e4*=0x113b0, lpOverlapped=0x0) returned 1 [0086.368] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.368] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.368] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0086.368] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.368] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0086.368] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.368] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.368] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.368] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.368] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.368] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.368] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.368] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a0f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0086.369] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0086.369] CryptDestroyKey (hKey=0xa7cce8) returned 1 [0086.369] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.369] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.369] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.369] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.369] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.369] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.369] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.369] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.369] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.369] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.369] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.369] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.369] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.369] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.369] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.370] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.370] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.370] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.370] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.370] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.370] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.370] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.370] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.370] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.370] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.370] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.370] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.370] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.370] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.370] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.370] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.370] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.370] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.370] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.370] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.370] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.370] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.370] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.371] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.371] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.371] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.371] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.371] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.371] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.371] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.371] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.371] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.371] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.371] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.371] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.371] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.371] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.371] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0086.372] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0086.372] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0086.372] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.372] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.372] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.372] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.372] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.372] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.372] FreeLibrary (hLibModule=0x76a10000) returned 1 [0086.372] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.372] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.372] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.372] CloseHandle (hObject=0x240) returned 1 [0086.373] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.373] CloseHandle (hObject=0x24c) returned 1 [0086.376] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.377] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.377] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.377] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.377] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/di ot4o1qyFI.jpg", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\di ot4o1qyFI.jpg", lpFilePart=0x8bedf4*="di ot4o1qyFI.jpg") returned 0x2f [0086.377] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\di ot4o1qyFI.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\di ot4o1qyfi.jpg")) returned 0x20 [0086.377] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\di ot4o1qyFI.jpg", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cce8 [0086.378] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\di ot4o1qyFI.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\di ot4o1qyfi.jpg")) returned 1 [0086.380] FindNextFileW (in: hFindFile=0xa7cce8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0086.380] FindClose (in: hFindFile=0xa7cce8 | out: hFindFile=0xa7cce8) returned 1 [0086.381] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.381] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.381] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.381] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/di ot4o1qyFI.jpg", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\di ot4o1qyFI.jpg", lpFilePart=0x8bf650*="di ot4o1qyFI.jpg") returned 0x2f [0086.381] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\di ot4o1qyFI.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\di ot4o1qyfi.jpg")) returned 0xffffffff [0086.381] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.381] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.381] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pCRiuz4PFsi5.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CRiuz4PFsi5.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Riuz4PFsi5.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iuz4PFsi5.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uz4PFsi5.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z4PFsi5.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4PFsi5.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PFsi5.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Fsi5.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="si5.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i5.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.381] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pCRiuz4PFsi5.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CRiuz4PFsi5.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Riuz4PFsi5.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iuz4PFsi5.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uz4PFsi5.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z4PFsi5.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4PFsi5.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PFsi5.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Fsi5.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="si5.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i5.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.382] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.382] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0086.382] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.382] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.382] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.382] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.382] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.382] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0086.382] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.382] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.382] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.382] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.382] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.382] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/pCRiuz4PFsi5.png", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cb28 [0086.382] FindClose (in: hFindFile=0xa7cb28 | out: hFindFile=0xa7cb28) returned 1 [0086.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.383] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.383] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.383] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.383] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.383] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.383] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.383] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.383] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.383] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.383] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.383] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.383] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0086.383] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.384] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0086.384] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.384] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0086.384] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.384] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.384] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.384] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0086.384] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0086.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.384] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.384] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.384] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.384] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.384] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.384] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0086.385] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0086.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0086.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab98, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0086.385] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0086.385] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0086.386] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.386] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.386] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0086.386] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.386] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0086.386] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.386] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.386] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.386] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.386] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.386] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.386] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.386] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.386] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.386] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.389] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.389] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.389] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.389] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.389] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.389] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.390] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0086.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.390] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0086.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.390] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.390] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.390] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.390] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.390] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.390] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.390] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.390] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.390] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.390] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.390] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.391] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.391] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.391] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.391] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.391] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.391] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.391] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.391] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.391] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.392] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.392] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.392] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.392] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.392] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.392] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.392] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.392] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.392] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.392] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.392] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.392] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8a930, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0086.393] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0086.393] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0086.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.393] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0086.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983be0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.393] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.393] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.393] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.393] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.393] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.393] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.394] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a480, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0086.394] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0086.394] CryptHashData (hHash=0xa7cb68, pbData=0x3983b30, dwDataLen=0x3, dwFlags=0x1) returned 1 [0086.394] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.394] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.394] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.394] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.394] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.394] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.394] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.394] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.394] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.394] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.394] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.394] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.395] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.395] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0086.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8af30, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0086.395] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0086.395] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cb68, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cca8) returned 1 [0086.395] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.395] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.395] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.395] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.395] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.395] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.395] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.395] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.395] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.396] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.396] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.396] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0086.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a9b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0086.396] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0086.396] CryptDestroyHash (hHash=0xa7cb68) returned 1 [0086.396] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.396] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.396] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.396] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.396] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.397] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/pCRiuz4PFsi5.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pcriuz4pfsi5.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0086.397] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.397] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0086.397] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.397] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.397] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.397] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0086.397] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/Lock.pCRiuz4PFsi5.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\lock.pcriuz4pfsi5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0086.398] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.398] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.398] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.398] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.400] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0086.400] ReadFile (in: hFile=0x24c, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0086.402] ReadFile (in: hFile=0x24c, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x4bc9, lpOverlapped=0x0) returned 1 [0086.402] ReadFile (in: hFile=0x24c, lpBuffer=0x3a18008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a18008*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0086.406] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.406] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.406] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.406] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0086.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.408] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0086.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.408] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.408] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.408] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.408] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.408] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.408] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.408] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.408] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.409] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.409] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.409] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.409] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.409] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.409] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.409] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.409] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.409] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.409] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.409] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.409] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.409] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.414] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.414] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.415] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.415] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.415] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.415] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.415] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.415] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a858, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.416] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.416] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x14bc9, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x14bd0) returned 1 [0086.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.416] CharLowerBuffW (in: lpsz="byte[84944]", cchLength=0xb | out: lpsz="byte[84944]") returned 0xb [0086.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.418] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.418] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.419] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.419] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.419] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.419] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.420] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a930, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.420] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.420] CryptEncrypt (in: hKey=0xa7cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ca8be8*, pdwDataLen=0x8bef60*=0x14bc9, dwBufLen=0x14bd0 | out: pbData=0x2ca8be8*, pdwDataLen=0x8bef60*=0x14bd0) returned 1 [0086.423] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.423] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.423] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.423] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.424] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.424] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.424] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.424] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.424] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.424] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.424] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.424] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.424] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.424] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.425] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.425] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.425] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.425] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.425] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.425] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.425] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.425] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.425] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.425] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.425] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.425] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.425] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.430] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.430] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.431] WriteFile (in: hFile=0x240, lpBuffer=0x3998c28*, nNumberOfBytesToWrite=0x14bd0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3998c28*, lpNumberOfBytesWritten=0x8bf5e4*=0x14bd0, lpOverlapped=0x0) returned 1 [0086.433] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.433] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.433] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0086.433] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.433] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0086.433] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.433] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.433] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.433] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.434] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.434] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.434] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.434] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a150, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0086.434] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0086.434] CryptDestroyKey (hKey=0xa7cca8) returned 1 [0086.434] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.434] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.434] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.434] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.435] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.435] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.435] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.435] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.435] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.435] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.435] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.435] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.435] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.435] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.435] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.435] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.435] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.435] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.435] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.435] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.435] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.435] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.436] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.436] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.436] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.436] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.436] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.436] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.436] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.436] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.436] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.436] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.436] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.436] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.436] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.436] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.436] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.436] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.436] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.436] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.437] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.437] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.437] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.437] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.437] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.437] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.437] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.437] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.437] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.437] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.437] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.437] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.437] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0086.438] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0086.438] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0086.438] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.438] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.438] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.438] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.438] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.438] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.438] FreeLibrary (hLibModule=0x76a10000) returned 1 [0086.439] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.439] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.439] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.439] CloseHandle (hObject=0x24c) returned 1 [0086.440] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.440] CloseHandle (hObject=0x240) returned 1 [0086.443] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.445] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.445] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.445] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/pCRiuz4PFsi5.png", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pCRiuz4PFsi5.png", lpFilePart=0x8bedf4*="pCRiuz4PFsi5.png") returned 0x2f [0086.445] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pCRiuz4PFsi5.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pcriuz4pfsi5.png")) returned 0x20 [0086.445] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pCRiuz4PFsi5.png", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cee8 [0086.446] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pCRiuz4PFsi5.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pcriuz4pfsi5.png")) returned 1 [0086.449] FindNextFileW (in: hFindFile=0xa7cee8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0086.449] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0086.449] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.449] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.449] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.450] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/pCRiuz4PFsi5.png", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pCRiuz4PFsi5.png", lpFilePart=0x8bf650*="pCRiuz4PFsi5.png") returned 0x2f [0086.450] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pCRiuz4PFsi5.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pcriuz4pfsi5.png")) returned 0xffffffff [0086.450] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.450] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.450] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SHgyDm0.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HgyDm0.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gyDm0.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yDm0.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dm0.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m0.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0.gif", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.450] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SHgyDm0.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HgyDm0.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gyDm0.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yDm0.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dm0.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m0.gif", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.451] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.451] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0086.451] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.451] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.451] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.451] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.451] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.451] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0086.451] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.491] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0086.492] TranslateMessage (lpMsg=0x8bf708) returned 0 [0086.492] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0086.492] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0086.492] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0086.492] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.492] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.492] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.492] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.492] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/SHgyDm0.gif", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d128 [0086.493] FindClose (in: hFindFile=0xa7d128 | out: hFindFile=0xa7d128) returned 1 [0086.493] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.493] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.493] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.493] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.493] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.493] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.493] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.493] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.493] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.493] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.493] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.493] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.494] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.494] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0086.494] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.494] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.494] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0086.494] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.494] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0086.494] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.494] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.494] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.494] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.494] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.494] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.494] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0086.495] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0086.495] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.495] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.495] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.495] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.495] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.495] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.495] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a9b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0086.495] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0086.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0086.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7abb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0086.496] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0086.496] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0086.496] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.496] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.496] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0086.497] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.497] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0086.497] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.497] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.497] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.497] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.497] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.497] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.497] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.497] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.497] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.497] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.497] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.497] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.497] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.497] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.497] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.497] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.498] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0086.498] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.498] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0086.498] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.498] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.498] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.498] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.498] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.498] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.498] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.498] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.498] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.498] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.498] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.498] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.498] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.498] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.499] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.499] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.499] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.499] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.499] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.499] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.499] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.499] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.499] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.499] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.499] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.499] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.499] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.499] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.499] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.499] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.499] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.499] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.500] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.500] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.500] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.500] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.500] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.500] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.500] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8a930, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0086.500] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0086.500] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0086.501] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.501] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.501] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.501] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.501] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0086.501] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ec0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.501] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.501] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.501] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.502] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.502] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.502] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.502] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a6d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0086.502] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0086.502] CryptHashData (hHash=0xa7cee8, pbData=0x3983ea0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0086.502] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.502] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.502] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.502] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.502] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.502] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.503] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.503] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.503] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.503] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.503] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.503] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.503] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.503] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0086.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8ae40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0086.503] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0086.503] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cee8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cc28) returned 1 [0086.503] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.503] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.504] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.504] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.504] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.504] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.504] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.504] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.504] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.504] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.504] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.504] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0086.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7acf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0086.504] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0086.504] CryptDestroyHash (hHash=0xa7cee8) returned 1 [0086.504] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.505] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.505] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.505] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.505] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.505] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/SHgyDm0.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\shgydm0.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0086.505] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.505] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0086.505] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.505] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.505] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.505] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0086.506] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/Lock.SHgyDm0.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\lock.shgydm0.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0086.506] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.506] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.506] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.506] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.509] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0086.509] ReadFile (in: hFile=0x240, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0086.511] ReadFile (in: hFile=0x240, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x2142, lpOverlapped=0x0) returned 1 [0086.511] ReadFile (in: hFile=0x240, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0086.517] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.518] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.518] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.518] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0086.519] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.519] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0086.519] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.519] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.519] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.519] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.519] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.519] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.519] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.520] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.520] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.520] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.520] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.520] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.520] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.520] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.520] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.520] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.520] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.520] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.520] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.520] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.520] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.520] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.520] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.520] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.520] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.521] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.521] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.521] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.521] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.521] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.521] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.521] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.521] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.521] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.521] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.522] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a7f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.522] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.522] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x12142, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x12148) returned 1 [0086.522] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.522] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.522] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.523] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.523] CharLowerBuffW (in: lpsz="byte[74056]", cchLength=0xb | out: lpsz="byte[74056]") returned 0xb [0086.523] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.525] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.525] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.525] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.525] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.525] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.525] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.525] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a798, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.525] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.526] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x39ba440*, pdwDataLen=0x8bef60*=0x12142, dwBufLen=0x12148 | out: pbData=0x39ba440*, pdwDataLen=0x8bef60*=0x12148) returned 1 [0086.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.529] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.529] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.529] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.529] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.529] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.529] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.529] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.529] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.529] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.529] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.529] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.529] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.529] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.529] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.529] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.529] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.529] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.529] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.530] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.530] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.530] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.530] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.530] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.530] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.569] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.569] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.569] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.570] WriteFile (in: hFile=0x24c, lpBuffer=0x2c94010*, nNumberOfBytesToWrite=0x12148, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesWritten=0x8bf5e4*=0x12148, lpOverlapped=0x0) returned 1 [0086.573] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.573] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.573] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0086.573] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.573] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0086.573] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.573] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.574] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.574] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.574] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.574] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.574] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.574] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a150, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0086.574] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0086.574] CryptDestroyKey (hKey=0xa7cc28) returned 1 [0086.574] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.574] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.574] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.575] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.575] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.575] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.575] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.575] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.575] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.575] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.575] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.575] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.575] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.575] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.575] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.575] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.575] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.575] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.575] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.575] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.575] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.575] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.576] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.596] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.596] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.596] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.596] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.596] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.596] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.596] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.596] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.597] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.597] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.597] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.597] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.597] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.597] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.597] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.597] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.597] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.597] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.597] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.597] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.597] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.597] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.597] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.597] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.597] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.597] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.597] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.598] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.598] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.598] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0086.598] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0086.598] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0086.598] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.598] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.598] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.598] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.598] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.598] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.599] FreeLibrary (hLibModule=0x76a10000) returned 1 [0086.599] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.599] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.599] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.599] CloseHandle (hObject=0x240) returned 1 [0086.599] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.599] CloseHandle (hObject=0x24c) returned 1 [0086.602] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.604] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.604] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.604] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.604] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/SHgyDm0.gif", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\SHgyDm0.gif", lpFilePart=0x8bedf4*="SHgyDm0.gif") returned 0x2a [0086.604] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\SHgyDm0.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\shgydm0.gif")) returned 0x20 [0086.605] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\SHgyDm0.gif", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0086.605] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\SHgyDm0.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\shgydm0.gif")) returned 1 [0086.623] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0086.623] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0086.623] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.623] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.623] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.623] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/SHgyDm0.gif", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\SHgyDm0.gif", lpFilePart=0x8bf650*="SHgyDm0.gif") returned 0x2a [0086.623] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\SHgyDm0.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\shgydm0.gif")) returned 0xffffffff [0086.623] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.624] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.624] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WNoBJk6u3i.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NoBJk6u3i.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oBJk6u3i.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BJk6u3i.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jk6u3i.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k6u3i.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6u3i.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u3i.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3i.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i.bmp", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.624] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WNoBJk6u3i.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NoBJk6u3i.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oBJk6u3i.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BJk6u3i.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jk6u3i.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k6u3i.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6u3i.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u3i.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3i.bmp", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.624] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.624] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0086.624] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.625] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.625] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.625] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.625] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.625] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0086.625] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.625] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.625] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.625] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.625] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.625] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/WNoBJk6u3i.bmp", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d068 [0086.626] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0086.626] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.626] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.626] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.626] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.626] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.626] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.626] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.626] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.626] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.626] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.626] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.626] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.626] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.627] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0086.627] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.627] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.627] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0086.627] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.627] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0086.627] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.627] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.627] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.627] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.627] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.627] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.627] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0086.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0086.627] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.628] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.628] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.628] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.628] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.628] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.628] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0086.628] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0086.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0086.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac78, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0086.629] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0086.629] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0086.629] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.629] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.629] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0086.629] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.630] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0086.630] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.630] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.630] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.630] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.630] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.630] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.630] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.630] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.630] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.630] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.630] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.630] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.630] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.630] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.630] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.630] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.630] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0086.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.631] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0086.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.631] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.631] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.631] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.631] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.631] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.631] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.631] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.631] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.631] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.631] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.631] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.632] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.632] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.632] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.632] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.632] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.632] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.632] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.632] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.636] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.636] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.636] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.636] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.636] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.636] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.636] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.636] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.636] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.636] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.636] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.636] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.636] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.636] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8a7f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0086.637] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0086.637] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0086.637] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.637] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.637] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.637] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.637] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0086.637] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.638] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.638] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.638] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.638] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.638] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.638] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.638] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a570, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0086.638] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0086.639] CryptHashData (hHash=0xa7c9e8, pbData=0x3983bd0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0086.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.639] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.639] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.639] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.639] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.639] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.639] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.639] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.639] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.639] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.639] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.639] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0086.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8aea0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0086.640] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0086.640] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7c9e8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cfa8) returned 1 [0086.640] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.640] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.640] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.640] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.640] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.640] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.640] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.640] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.640] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.640] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.640] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.640] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0086.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0086.641] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0086.641] CryptDestroyHash (hHash=0xa7c9e8) returned 1 [0086.641] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.642] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.642] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.642] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.642] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.642] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/WNoBJk6u3i.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\wnobjk6u3i.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0086.643] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.643] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0086.643] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.643] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.643] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.643] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0086.643] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/Lock.WNoBJk6u3i.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\lock.wnobjk6u3i.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0086.644] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.644] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.644] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.644] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.647] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0086.647] ReadFile (in: hFile=0x24c, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0086.649] ReadFile (in: hFile=0x24c, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x324d, lpOverlapped=0x0) returned 1 [0086.649] ReadFile (in: hFile=0x24c, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0086.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.655] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0086.655] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.655] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0086.655] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.656] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.656] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.656] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.656] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.656] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.656] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.656] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.656] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.656] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.656] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.656] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.656] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.656] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.656] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.656] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.656] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.656] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.656] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.657] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.657] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.657] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.657] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.657] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.657] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.657] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.657] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.657] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.657] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.657] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.657] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.657] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.658] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.658] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.658] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.659] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a900, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.659] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.659] CryptEncrypt (in: hKey=0xa7cfa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x1324d, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x13250) returned 1 [0086.660] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.660] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.660] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.660] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.660] CharLowerBuffW (in: lpsz="byte[78416]", cchLength=0xb | out: lpsz="byte[78416]") returned 0xb [0086.660] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.662] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.662] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.662] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.662] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.662] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.662] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.664] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a7c8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.664] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.664] CryptEncrypt (in: hKey=0xa7cfa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c94010*, pdwDataLen=0x8bef60*=0x1324d, dwBufLen=0x13250 | out: pbData=0x2c94010*, pdwDataLen=0x8bef60*=0x13250) returned 1 [0086.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.668] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.668] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.668] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.668] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.668] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.668] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.668] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.668] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.668] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.668] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.668] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.693] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.693] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.693] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.693] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.694] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.700] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.700] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.700] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.701] WriteFile (in: hFile=0x240, lpBuffer=0x2ca7268*, nNumberOfBytesToWrite=0x13250, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2ca7268*, lpNumberOfBytesWritten=0x8bf5e4*=0x13250, lpOverlapped=0x0) returned 1 [0086.703] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.703] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.703] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0086.703] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.703] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0086.703] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.703] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.703] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.703] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.703] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.703] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.705] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.705] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a2e8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0086.706] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0086.706] CryptDestroyKey (hKey=0xa7cfa8) returned 1 [0086.706] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.706] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.706] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.706] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.706] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.706] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.706] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.706] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.706] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.706] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.706] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.707] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.707] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.707] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.707] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.707] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.707] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.707] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.707] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.707] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.707] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.707] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.707] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.707] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.707] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.707] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.707] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.707] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.707] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.707] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.708] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.708] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.708] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.708] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.708] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.708] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.708] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.708] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.708] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.708] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.708] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.708] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.708] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.708] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.708] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.708] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.708] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.708] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.708] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.709] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.709] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.709] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.709] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a998, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0086.709] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0086.709] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0086.709] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.709] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.709] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.709] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.709] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.709] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.709] FreeLibrary (hLibModule=0x76a10000) returned 1 [0086.710] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.710] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.710] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.710] CloseHandle (hObject=0x24c) returned 1 [0086.711] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.711] CloseHandle (hObject=0x240) returned 1 [0086.714] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.715] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.715] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.715] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.715] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/WNoBJk6u3i.bmp", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\WNoBJk6u3i.bmp", lpFilePart=0x8bedf4*="WNoBJk6u3i.bmp") returned 0x2d [0086.715] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\WNoBJk6u3i.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\wnobjk6u3i.bmp")) returned 0x20 [0086.715] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\WNoBJk6u3i.bmp", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cfa8 [0086.716] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\WNoBJk6u3i.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\wnobjk6u3i.bmp")) returned 1 [0086.719] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0086.719] FindClose (in: hFindFile=0xa7cfa8 | out: hFindFile=0xa7cfa8) returned 1 [0086.719] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.719] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.720] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.720] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/WNoBJk6u3i.bmp", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\WNoBJk6u3i.bmp", lpFilePart=0x8bf650*="WNoBJk6u3i.bmp") returned 0x2d [0086.720] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\WNoBJk6u3i.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\wnobjk6u3i.bmp")) returned 0xffffffff [0086.720] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.720] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.720] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yrGrT5GM2kHnbKjZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rGrT5GM2kHnbKjZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GrT5GM2kHnbKjZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rT5GM2kHnbKjZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T5GM2kHnbKjZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5GM2kHnbKjZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GM2kHnbKjZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M2kHnbKjZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2kHnbKjZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kHnbKjZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HnbKjZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nbKjZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bKjZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KjZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jZs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zs.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s.png", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.721] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yrGrT5GM2kHnbKjZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rGrT5GM2kHnbKjZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GrT5GM2kHnbKjZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rT5GM2kHnbKjZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T5GM2kHnbKjZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5GM2kHnbKjZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GM2kHnbKjZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M2kHnbKjZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2kHnbKjZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kHnbKjZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HnbKjZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nbKjZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bKjZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KjZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jZs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zs.png", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.721] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.721] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0086.721] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.721] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.721] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.722] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.722] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.722] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0086.722] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.722] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.722] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.722] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.722] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.722] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/yrGrT5GM2kHnbKjZs.png", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7c9a8 [0086.722] FindClose (in: hFindFile=0xa7c9a8 | out: hFindFile=0xa7c9a8) returned 1 [0086.722] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.722] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.722] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.723] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.723] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.723] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.723] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.723] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.723] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.723] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.723] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.723] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.723] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.723] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0086.723] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.723] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.723] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0086.723] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.724] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0086.724] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.724] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.724] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.724] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.724] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.724] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.724] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0086.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0086.724] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.724] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.724] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.724] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.724] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.724] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.744] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0086.744] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0086.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0086.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a958, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0086.745] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0086.745] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0086.745] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.745] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.746] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0086.746] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.746] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0086.746] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.746] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.746] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.746] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.746] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.746] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.746] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.746] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.746] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.746] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.746] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.746] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.746] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.746] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.747] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.747] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.747] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0086.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.747] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0086.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.747] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.747] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.747] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.747] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.747] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.747] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.748] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.748] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.748] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.748] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.748] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.748] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.748] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.748] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.748] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.748] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.748] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.748] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.748] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.748] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.748] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.748] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.748] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.748] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.749] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.749] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.749] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.749] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.749] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.749] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.749] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.749] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.749] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8a7f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0086.749] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0086.750] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0086.750] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.750] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.750] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.750] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ee0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.750] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0086.750] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.750] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.750] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.751] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.751] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.751] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.751] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.751] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8a528, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0086.751] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0086.751] CryptHashData (hHash=0xa7cc28, pbData=0x3983e80, dwDataLen=0x3, dwFlags=0x1) returned 1 [0086.751] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.751] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.751] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.751] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.752] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.752] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.752] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.752] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.752] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.752] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.752] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.752] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.752] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.752] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0086.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8ad38, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0086.752] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0086.753] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cc28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d068) returned 1 [0086.753] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.753] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.753] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.753] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.753] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.753] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.753] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.754] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.754] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.754] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.754] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.754] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0086.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aab8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0086.754] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0086.754] CryptDestroyHash (hHash=0xa7cc28) returned 1 [0086.754] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.755] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.755] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.755] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.755] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.755] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/yrGrT5GM2kHnbKjZs.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\yrgrt5gm2khnbkjzs.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0086.756] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.756] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0086.756] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.756] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.756] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.756] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0086.756] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/Lock.yrGrT5GM2kHnbKjZs.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\lock.yrgrt5gm2khnbkjzs.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0086.757] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.757] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.757] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.757] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.759] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0086.760] ReadFile (in: hFile=0x240, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x2e9e, lpOverlapped=0x0) returned 1 [0086.761] ReadFile (in: hFile=0x240, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0086.764] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.764] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.764] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.764] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0086.764] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.765] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0086.765] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.765] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.765] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.765] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.765] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.765] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.765] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.765] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.765] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.765] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.765] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.765] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.765] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.765] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.771] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.771] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.771] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.771] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.771] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.771] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.771] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.771] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.771] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.771] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.771] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.771] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.771] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.771] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.771] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.772] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.772] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.772] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.772] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.772] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.772] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.772] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a900, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.772] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.773] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x2e9e, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x2ea0) returned 1 [0086.773] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.773] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.773] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.773] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.773] CharLowerBuffW (in: lpsz="byte[11936]", cchLength=0xb | out: lpsz="byte[11936]") returned 0xb [0086.773] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.773] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.773] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.773] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.773] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.773] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.773] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.773] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8a798, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.774] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.774] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3989da0*, pdwDataLen=0x8bef60*=0x2e9e, dwBufLen=0x2ea0 | out: pbData=0x3989da0*, pdwDataLen=0x8bef60*=0x2ea0) returned 1 [0086.774] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.774] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.774] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.774] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.775] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.775] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.775] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.775] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.775] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.775] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.775] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.775] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.775] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.775] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.775] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.775] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.775] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.775] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.775] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.775] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.775] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.775] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.775] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.775] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.776] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.776] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.776] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.777] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.777] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.777] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.777] WriteFile (in: hFile=0x24c, lpBuffer=0x3984050*, nNumberOfBytesToWrite=0x2ea0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesWritten=0x8bf5e4*=0x2ea0, lpOverlapped=0x0) returned 1 [0086.779] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.779] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.779] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0086.779] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.779] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0086.779] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.779] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.779] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.779] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.779] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.779] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.779] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.779] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a0f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0086.780] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0086.780] CryptDestroyKey (hKey=0xa7d068) returned 1 [0086.780] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.780] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.780] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.780] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.780] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.780] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.780] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.780] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.780] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.780] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.780] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.780] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.780] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.780] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.780] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.780] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.780] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.780] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.781] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.781] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.781] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.781] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.781] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.781] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.781] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.781] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.781] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.781] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.781] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.781] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.781] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.781] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.781] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.781] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.781] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.781] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.781] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.781] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.782] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.782] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.782] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.782] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.782] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.782] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.782] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.782] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.782] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.782] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.782] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.783] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.783] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.783] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.783] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0086.783] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0086.783] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0086.783] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.783] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.783] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.783] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.783] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.783] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.783] FreeLibrary (hLibModule=0x76a10000) returned 1 [0086.783] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.783] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.783] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.789] CloseHandle (hObject=0x240) returned 1 [0086.790] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.790] CloseHandle (hObject=0x24c) returned 1 [0086.791] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.791] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.792] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.792] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.792] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/yrGrT5GM2kHnbKjZs.png", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\yrGrT5GM2kHnbKjZs.png", lpFilePart=0x8bedf4*="yrGrT5GM2kHnbKjZs.png") returned 0x34 [0086.792] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\yrGrT5GM2kHnbKjZs.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\yrgrt5gm2khnbkjzs.png")) returned 0x20 [0086.792] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\yrGrT5GM2kHnbKjZs.png", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cd28 [0086.792] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\yrGrT5GM2kHnbKjZs.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\yrgrt5gm2khnbkjzs.png")) returned 1 [0086.800] FindNextFileW (in: hFindFile=0xa7cd28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0086.800] FindClose (in: hFindFile=0xa7cd28 | out: hFindFile=0xa7cd28) returned 1 [0086.800] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.801] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.801] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.801] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures/yrGrT5GM2kHnbKjZs.png", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\yrGrT5GM2kHnbKjZs.png", lpFilePart=0x8bf650*="yrGrT5GM2kHnbKjZs.png") returned 0x34 [0086.801] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\yrGrT5GM2kHnbKjZs.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\yrgrt5gm2khnbkjzs.png")) returned 0xffffffff [0086.801] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.801] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.801] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.801] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.801] CharUpperBuffW (in: lpsz="A1600E02A1D", cchLength=0xb | out: lpsz="A1600E02A1D") returned 0xb [0086.801] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.801] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf2b8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.801] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.801] CharUpperBuffW (in: lpsz="SSA1600E02A1D", cchLength=0xd | out: lpsz="SSA1600E02A1D") returned 0xd [0086.801] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.801] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.801] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0086.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x2c92ce8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/]+\\z", lpUsedDefaultChar=0x0) returned 9 [0086.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\Videos", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0086.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\Videos", cchWideChar=29, lpMultiByteStr=0x2c87728, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpUsedDefaultChar=0x0) returned 29 [0086.802] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.802] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0086.802] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0086.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x2c7acf8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", lpUsedDefaultChar=0x0) returned 23 [0086.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x3983bb0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.*", lpUsedDefaultChar=0x0) returned 4 [0086.802] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.802] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.802] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0xa7d0e8 [0086.802] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.803] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.803] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.804] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.805] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0 [0086.805] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.805] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.805] FindClose (in: hFindFile=0xa7d0e8 | out: hFindFile=0xa7d0e8) returned 1 [0086.805] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.805] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0086.805] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.805] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.805] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5VHrP.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VHrP.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HrP.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rP.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.805] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5VHrP.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VHrP.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HrP.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rP.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.805] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.806] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0086.806] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.806] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.806] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.806] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.806] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.806] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0086.806] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.806] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.806] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.806] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.806] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.806] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/5VHrP.avi", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cce8 [0086.806] FindClose (in: hFindFile=0xa7cce8 | out: hFindFile=0xa7cce8) returned 1 [0086.807] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.807] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.807] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.807] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.807] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.807] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.807] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.807] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.807] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.807] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.807] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.807] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.807] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.807] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0086.807] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.807] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.807] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0086.808] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.808] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0086.808] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.808] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.808] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.808] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.808] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.808] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.808] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0086.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0086.808] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.808] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.808] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.808] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.808] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.808] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.808] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0086.809] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0086.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0086.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a9d8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0086.809] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0086.809] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0086.810] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.810] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.810] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0086.810] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.810] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0086.810] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.810] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.810] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.810] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.810] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.810] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.810] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.810] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.810] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.810] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.810] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.816] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.816] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.816] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.816] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.816] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.816] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0086.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.816] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0086.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.817] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.817] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.817] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.817] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.817] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.817] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.817] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.817] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.817] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.817] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.817] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.817] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.817] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.817] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.817] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.817] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.817] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.817] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.817] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.817] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.817] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.818] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.818] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.818] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.818] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.818] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.818] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.818] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.818] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.818] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.818] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.818] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8b7d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0086.818] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0086.818] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0086.819] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.819] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.819] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.819] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.819] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0086.819] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ca0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.819] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.819] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.819] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.819] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.819] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.819] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.819] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b6f8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0086.820] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0086.820] CryptHashData (hHash=0xa7cee8, pbData=0x3983b60, dwDataLen=0x3, dwFlags=0x1) returned 1 [0086.820] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.820] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.820] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.820] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.820] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.820] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.820] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.820] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.820] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.820] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.820] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.820] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.820] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.820] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0086.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b818, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0086.821] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0086.821] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cee8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7caa8) returned 1 [0086.821] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.821] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.821] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.821] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.821] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.821] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.821] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.821] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.821] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.821] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.821] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.822] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0086.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aa98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0086.822] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0086.822] CryptDestroyHash (hHash=0xa7cee8) returned 1 [0086.822] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.822] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.822] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.822] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.822] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.822] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/5VHrP.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\5vhrp.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0086.823] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.823] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0086.823] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.823] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.823] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.823] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0086.823] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/Lock.5VHrP.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\lock.5vhrp.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0086.824] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.824] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.824] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.824] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.826] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0086.826] ReadFile (in: hFile=0x24c, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x910b, lpOverlapped=0x0) returned 1 [0086.827] ReadFile (in: hFile=0x24c, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0086.832] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.832] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.832] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.832] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0086.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.833] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0086.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.833] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.833] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.833] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.833] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.833] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.833] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.833] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.833] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.833] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.833] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.834] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.834] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.834] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.834] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.834] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.834] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.834] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.834] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.834] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.834] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.834] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.834] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.841] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.841] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.841] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.841] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.841] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.841] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.842] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b650, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.842] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.842] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x910b, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x9110) returned 1 [0086.842] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.842] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.842] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.842] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.842] CharLowerBuffW (in: lpsz="byte[37136]", cchLength=0xb | out: lpsz="byte[37136]") returned 0xb [0086.842] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.844] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.844] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.844] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.844] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.844] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.844] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.845] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b650, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.845] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.845] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x399f398*, pdwDataLen=0x8bef60*=0x910b, dwBufLen=0x9110 | out: pbData=0x399f398*, pdwDataLen=0x8bef60*=0x9110) returned 1 [0086.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.847] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.847] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.848] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.848] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.848] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.848] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.848] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.848] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.848] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.848] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.848] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.848] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.848] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.848] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.848] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.848] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.848] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.848] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.848] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.848] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.851] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.851] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.851] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.852] WriteFile (in: hFile=0x240, lpBuffer=0x3984050*, nNumberOfBytesToWrite=0x9110, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesWritten=0x8bf5e4*=0x9110, lpOverlapped=0x0) returned 1 [0086.853] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.853] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.854] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0086.854] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.854] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0086.854] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.854] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.854] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.854] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.854] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.854] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.854] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.854] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8b1d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0086.855] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0086.855] CryptDestroyKey (hKey=0xa7caa8) returned 1 [0086.855] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.855] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.855] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.855] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.855] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.855] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.855] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.855] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.855] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.855] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.855] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.855] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.856] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.856] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.856] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.856] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.856] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.856] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.856] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.856] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.856] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.856] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.856] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.856] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0086.857] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0086.857] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0086.857] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.857] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.857] FreeLibrary (hLibModule=0x76a10000) returned 1 [0086.857] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.857] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.857] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.857] CloseHandle (hObject=0x24c) returned 1 [0086.859] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.859] CloseHandle (hObject=0x240) returned 1 [0086.864] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.864] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.864] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.865] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.865] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/5VHrP.avi", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\5VHrP.avi", lpFilePart=0x8bedf4*="5VHrP.avi") returned 0x26 [0086.865] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\5VHrP.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\5vhrp.avi")) returned 0x20 [0086.865] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\5VHrP.avi", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d128 [0086.865] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\5VHrP.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\5vhrp.avi")) returned 1 [0086.879] FindNextFileW (in: hFindFile=0xa7d128, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0086.879] FindClose (in: hFindFile=0xa7d128 | out: hFindFile=0xa7d128) returned 1 [0086.879] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.879] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.879] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.879] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/5VHrP.avi", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\5VHrP.avi", lpFilePart=0x8bf650*="5VHrP.avi") returned 0x26 [0086.879] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\5VHrP.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\5vhrp.avi")) returned 0xffffffff [0086.879] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.880] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.880] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctEdCOQfNgS.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tEdCOQfNgS.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EdCOQfNgS.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dCOQfNgS.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="COQfNgS.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OQfNgS.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QfNgS.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fNgS.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NgS.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gS.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S.avi", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0086.880] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctEdCOQfNgS.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tEdCOQfNgS.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EdCOQfNgS.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dCOQfNgS.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="COQfNgS.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OQfNgS.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QfNgS.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fNgS.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NgS.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gS.avi", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0086.880] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.881] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0086.881] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.881] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.881] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.881] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.881] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.881] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0086.881] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.881] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.885] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.885] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.885] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.886] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/ctEdCOQfNgS.avi", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cce8 [0086.886] FindClose (in: hFindFile=0xa7cce8 | out: hFindFile=0xa7cce8) returned 1 [0086.886] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.886] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.886] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.886] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.886] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.886] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.886] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.886] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.886] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.887] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.887] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.887] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.887] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.887] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0086.887] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.887] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.887] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0086.887] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.887] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0086.887] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.887] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.888] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.888] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.888] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.888] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.888] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0086.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0086.888] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.888] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.888] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.888] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.888] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.888] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0086.888] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a978, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0086.889] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0086.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0086.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aab8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0086.889] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0086.889] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0086.890] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.890] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.890] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0086.890] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.890] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0086.890] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.890] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.890] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.890] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.890] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.890] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.890] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.891] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.891] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.891] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.891] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.891] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.891] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.891] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.891] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.891] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.891] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0086.892] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.892] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0086.892] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.892] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.892] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.892] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.892] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.892] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.892] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.892] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.892] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.892] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.892] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.892] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.892] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.892] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.892] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.893] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.893] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.893] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.893] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.893] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.893] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.893] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.893] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.893] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.893] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.893] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.893] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.893] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.893] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.893] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.893] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.893] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.894] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.894] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.894] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.894] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.894] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.894] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.894] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8b8d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0086.894] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0086.894] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0086.895] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.895] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.895] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.895] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cc0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.895] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0086.895] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0086.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0086.895] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.895] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.895] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.895] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.895] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.895] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.896] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b818, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0086.896] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0086.896] CryptHashData (hHash=0xa7d128, pbData=0x3983b20, dwDataLen=0x3, dwFlags=0x1) returned 1 [0086.896] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.896] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.896] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.896] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.896] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.896] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.896] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.897] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.897] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.897] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.897] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.897] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.897] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.897] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0086.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b758, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0086.897] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0086.897] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d128, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7caa8) returned 1 [0086.897] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.898] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.898] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.898] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.898] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.898] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.898] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.898] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.898] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.898] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.898] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0086.898] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0086.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aaf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0086.899] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0086.899] CryptDestroyHash (hHash=0xa7d128) returned 1 [0086.899] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.899] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.915] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.916] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.916] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.916] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/ctEdCOQfNgS.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\ctedcoqfngs.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0086.916] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.917] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0086.917] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.917] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.917] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.917] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0086.917] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/Lock.ctEdCOQfNgS.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\lock.ctedcoqfngs.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0086.918] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.918] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.918] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.918] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.971] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0086.971] ReadFile (in: hFile=0x240, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x3610, lpOverlapped=0x0) returned 1 [0086.972] ReadFile (in: hFile=0x240, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0086.975] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.975] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.975] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.975] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0086.976] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.976] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0086.976] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.976] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.976] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.976] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.976] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.976] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.976] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.976] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0086.976] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.976] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0086.976] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.976] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.977] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.977] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.977] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.977] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.977] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.977] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.977] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.977] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0086.977] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.977] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0086.977] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.977] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.977] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.977] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.977] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.977] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.978] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.978] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.978] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.978] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.978] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.978] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b6e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.979] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.979] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x3610, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x3618) returned 1 [0086.979] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.979] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.979] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.979] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.979] CharLowerBuffW (in: lpsz="byte[13848]", cchLength=0xb | out: lpsz="byte[13848]") returned 0xb [0086.979] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.979] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.979] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.980] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.980] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.980] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.980] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0086.980] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0086.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b740, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0086.980] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0086.980] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x398ac80*, pdwDataLen=0x8bef60*=0x3610, dwBufLen=0x3618 | out: pbData=0x398ac80*, pdwDataLen=0x8bef60*=0x3618) returned 1 [0086.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.981] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.981] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.982] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.982] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.982] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.982] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.982] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.982] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.982] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.982] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.982] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0086.982] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.982] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.982] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.982] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.982] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.982] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0086.982] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.983] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0086.983] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0086.985] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.985] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.985] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.986] WriteFile (in: hFile=0x24c, lpBuffer=0x3984050*, nNumberOfBytesToWrite=0x3618, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesWritten=0x8bf5e4*=0x3618, lpOverlapped=0x0) returned 1 [0086.987] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.987] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.987] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0086.987] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.987] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0086.987] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.987] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.987] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.988] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.988] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.988] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.988] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0086.988] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8b278, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0086.988] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0086.988] CryptDestroyKey (hKey=0xa7caa8) returned 1 [0086.988] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.988] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.989] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.989] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.989] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.989] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.989] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.989] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.989] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.989] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.989] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.989] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.989] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0086.989] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.989] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.989] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.989] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.989] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.990] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0086.990] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.990] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0086.990] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.990] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0086.990] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.992] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0086.992] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.992] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0086.992] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.992] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.992] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0086.992] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.992] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0086.992] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.992] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.992] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0086.993] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.993] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0086.993] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.993] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0086.993] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.993] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0086.993] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.993] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.993] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.993] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.993] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.993] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.993] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0086.993] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.993] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0086.994] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.994] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.994] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0086.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0086.994] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0086.994] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0086.994] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.994] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0086.994] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.994] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0086.994] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.995] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0086.995] FreeLibrary (hLibModule=0x76a10000) returned 1 [0086.995] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.995] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0086.995] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.995] CloseHandle (hObject=0x240) returned 1 [0086.996] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.996] CloseHandle (hObject=0x24c) returned 1 [0086.998] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0086.999] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0086.999] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0086.999] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0086.999] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/ctEdCOQfNgS.avi", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ctEdCOQfNgS.avi", lpFilePart=0x8bedf4*="ctEdCOQfNgS.avi") returned 0x2c [0086.999] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ctEdCOQfNgS.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\ctedcoqfngs.avi")) returned 0x20 [0086.999] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ctEdCOQfNgS.avi", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7caa8 [0086.999] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ctEdCOQfNgS.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\ctedcoqfngs.avi")) returned 1 [0087.007] FindNextFileW (in: hFindFile=0xa7caa8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0087.007] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0087.007] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.008] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.008] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.008] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/ctEdCOQfNgS.avi", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ctEdCOQfNgS.avi", lpFilePart=0x8bf650*="ctEdCOQfNgS.avi") returned 0x2c [0087.008] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ctEdCOQfNgS.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\ctedcoqfngs.avi")) returned 0xffffffff [0087.008] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.008] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.008] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.008] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.008] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.008] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.008] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.008] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.008] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.008] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.008] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.008] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.009] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.009] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.009] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.009] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.009] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.009] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.009] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0087.009] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.009] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.009] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.009] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.009] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.009] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0087.009] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.009] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.009] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.009] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.010] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.010] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/desktop.ini", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cee8 [0087.010] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0087.010] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.010] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.010] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.010] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.010] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.010] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.010] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.010] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.011] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.011] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.011] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.011] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.011] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.011] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0087.011] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.011] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.011] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0087.011] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.011] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0087.011] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.011] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.012] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.012] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.012] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.012] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.012] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0087.012] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0087.012] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.012] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.012] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.012] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.012] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.012] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.012] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a998, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0087.013] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0087.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0087.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a978, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0087.013] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0087.013] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0087.014] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.014] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.014] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0087.014] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.014] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0087.014] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.014] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.014] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.014] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.015] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.015] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.015] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.015] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.015] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.015] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.015] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.015] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.015] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.015] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0087.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.015] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0087.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.016] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.016] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.016] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.016] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.016] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.016] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.016] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.017] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.017] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.017] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.017] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.017] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.017] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.017] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.017] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.017] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.030] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.030] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.030] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.030] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.030] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.030] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.030] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.030] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.030] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.030] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.030] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.030] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.030] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8b818, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0087.031] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0087.031] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0087.031] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.031] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.031] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.031] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ce0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.031] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0087.031] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ca0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.032] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.032] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.032] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.032] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.032] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.032] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.032] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0087.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b650, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0087.033] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0087.033] CryptHashData (hHash=0xa7cc28, pbData=0x3983be0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0087.033] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.033] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.033] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.033] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.033] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.033] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.033] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.033] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.033] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.034] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.034] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.034] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.034] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.034] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0087.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b6e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0087.034] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0087.034] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cc28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7caa8) returned 1 [0087.034] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.034] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.035] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.035] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.035] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.035] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.035] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.035] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.035] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.035] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.035] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.035] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0087.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aa38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0087.035] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0087.036] CryptDestroyHash (hHash=0xa7cc28) returned 1 [0087.036] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.036] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0087.036] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.036] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0087.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.037] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.037] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.037] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0087.037] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/Lock.desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\lock.desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0087.038] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.038] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.038] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.038] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.041] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0087.041] ReadFile (in: hFile=0x24c, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x1f8, lpOverlapped=0x0) returned 1 [0087.042] ReadFile (in: hFile=0x24c, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0087.044] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.045] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.045] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.045] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0087.045] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.045] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0087.045] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.045] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.045] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.045] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.045] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.045] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.045] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.045] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.045] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.046] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.046] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.046] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.046] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.046] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.046] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.046] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.046] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.046] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.046] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.046] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.046] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.046] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.046] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.046] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.046] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.047] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.047] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.047] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.047] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.047] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.047] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.047] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.047] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.047] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.047] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.047] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0087.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b710, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0087.048] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0087.048] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x1f8, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x200) returned 1 [0087.048] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.048] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.049] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.049] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.049] CharLowerBuffW (in: lpsz="byte[512]", cchLength=0x9 | out: lpsz="byte[512]") returned 0x9 [0087.049] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.049] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.049] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.049] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.049] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.049] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.049] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.049] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0087.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b6c8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0087.050] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0087.050] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c85448*, pdwDataLen=0x8bef60*=0x1f8, dwBufLen=0x200 | out: pbData=0x2c85448*, pdwDataLen=0x8bef60*=0x200) returned 1 [0087.050] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.050] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.050] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.050] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.050] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.050] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.050] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.050] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.050] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.050] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.050] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.051] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.051] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.051] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.051] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.051] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.051] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.056] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.056] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.056] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.056] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.056] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.056] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.056] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.056] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.056] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.056] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.056] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.057] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.057] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.057] WriteFile (in: hFile=0x240, lpBuffer=0x2c045c0*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2c045c0*, lpNumberOfBytesWritten=0x8bf5e4*=0x200, lpOverlapped=0x0) returned 1 [0087.058] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.058] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.058] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0087.058] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.058] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0087.058] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.058] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.058] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.058] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.058] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.058] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.059] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.059] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8b1b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0087.059] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0087.059] CryptDestroyKey (hKey=0xa7caa8) returned 1 [0087.059] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.059] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.059] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.059] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.059] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.060] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.060] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.060] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.060] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.060] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.060] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.060] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.060] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.060] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.060] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.060] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.060] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.060] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.060] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.060] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.060] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.061] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.061] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.061] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.061] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.061] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.061] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.061] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.061] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.061] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.061] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.061] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.061] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.061] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.061] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.061] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.061] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.062] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.062] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.062] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.062] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.062] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.062] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.062] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.062] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.062] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.062] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.062] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.062] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.062] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.062] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.062] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.063] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0087.063] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0087.064] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0087.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.064] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.064] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.064] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.064] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.064] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.064] FreeLibrary (hLibModule=0x76a10000) returned 1 [0087.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.064] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.064] CloseHandle (hObject=0x24c) returned 1 [0087.065] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.065] CloseHandle (hObject=0x240) returned 1 [0087.067] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.067] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.067] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.067] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.067] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/desktop.ini", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini", lpFilePart=0x8bedf4*="desktop.ini") returned 0x28 [0087.067] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\desktop.ini")) returned 0x26 [0087.067] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cd28 [0087.067] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\desktop.ini")) returned 1 [0087.069] FindNextFileW (in: hFindFile=0xa7cd28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0087.069] FindClose (in: hFindFile=0xa7cd28 | out: hFindFile=0xa7cd28) returned 1 [0087.069] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.069] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.069] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.069] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/desktop.ini", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini", lpFilePart=0x8bf650*="desktop.ini") returned 0x28 [0087.069] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\desktop.ini")) returned 0xffffffff [0087.070] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.070] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.070] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yh3aSzBw6vqSD.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h3aSzBw6vqSD.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3aSzBw6vqSD.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aSzBw6vqSD.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SzBw6vqSD.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zBw6vqSD.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Bw6vqSD.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w6vqSD.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6vqSD.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vqSD.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qSD.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SD.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D.mp4", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.070] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yh3aSzBw6vqSD.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h3aSzBw6vqSD.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3aSzBw6vqSD.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aSzBw6vqSD.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SzBw6vqSD.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zBw6vqSD.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Bw6vqSD.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.070] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w6vqSD.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.071] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6vqSD.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.071] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vqSD.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.071] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qSD.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.071] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SD.mp4", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.071] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.071] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0087.071] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.071] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.071] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.071] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.071] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.071] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0087.071] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.071] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.071] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.071] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.071] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.072] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/Yh3aSzBw6vqSD.mp4", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cee8 [0087.072] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0087.072] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.072] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.072] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.072] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.072] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.072] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.072] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.072] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.073] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.073] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.073] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.073] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.073] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.073] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0087.073] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.073] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.073] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0087.073] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.073] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0087.073] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.074] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.074] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.074] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.074] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.074] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.074] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0087.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0087.074] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.074] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.074] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.074] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.074] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.074] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.074] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7abf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0087.075] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0087.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0087.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aaf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0087.075] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0087.075] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0087.076] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.078] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.078] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0087.078] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.078] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0087.078] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.078] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.078] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.078] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.078] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.078] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.078] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.079] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.079] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.079] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.079] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.079] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.079] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.079] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.079] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.079] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.079] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0087.079] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.079] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0087.079] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.080] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.080] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.080] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.080] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.080] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.095] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.095] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.095] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.095] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.095] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.095] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.095] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.095] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.095] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.095] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.095] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.096] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.096] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.096] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.096] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.096] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.096] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.096] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.096] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.096] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.096] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.096] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.096] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.096] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.096] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.096] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.096] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8b680, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0087.097] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0087.097] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0087.097] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.097] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.097] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.097] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c20, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.097] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0087.098] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b50, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.098] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.098] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.098] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.098] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.098] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.098] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.098] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0087.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b8a8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0087.099] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0087.099] CryptHashData (hHash=0xa7d0e8, pbData=0x3983af0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0087.099] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.099] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.099] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.099] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.099] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.099] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.099] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.099] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.100] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.100] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.100] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.100] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.100] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.100] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0087.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b6e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0087.100] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0087.100] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d0e8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cb28) returned 1 [0087.100] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.101] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.101] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.101] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.101] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.101] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.101] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.101] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.101] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.101] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.101] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.101] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0087.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0087.102] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0087.102] CryptDestroyHash (hHash=0xa7d0e8) returned 1 [0087.102] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.102] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.102] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.102] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.102] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.103] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/Yh3aSzBw6vqSD.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yh3aszbw6vqsd.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0087.103] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.103] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0087.103] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.103] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.103] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.103] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0087.104] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/Lock.Yh3aSzBw6vqSD.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\lock.yh3aszbw6vqsd.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0087.104] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.104] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.104] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.104] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.107] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0087.107] ReadFile (in: hFile=0x240, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0087.110] ReadFile (in: hFile=0x240, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0xc09, lpOverlapped=0x0) returned 1 [0087.110] ReadFile (in: hFile=0x240, lpBuffer=0x3a19010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a19010*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0087.115] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.116] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.116] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.116] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0087.118] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.118] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0087.119] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.119] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.119] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.119] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.119] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.119] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.119] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.119] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.119] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.119] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.119] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.119] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.119] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.119] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.119] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.120] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.157] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.157] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.157] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.158] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.158] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.158] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.158] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.158] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.158] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.158] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.158] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.158] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.158] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.158] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.158] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.158] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.158] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.158] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.159] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.159] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0087.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b710, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0087.160] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0087.160] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x10c09, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x10c10) returned 1 [0087.160] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.160] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.160] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.160] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.160] CharLowerBuffW (in: lpsz="byte[68624]", cchLength=0xb | out: lpsz="byte[68624]") returned 0xb [0087.160] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.163] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.163] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.163] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.163] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.163] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.163] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.163] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0087.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b650, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0087.164] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0087.164] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x39b6498*, pdwDataLen=0x8bef60*=0x10c09, dwBufLen=0x10c10 | out: pbData=0x39b6498*, pdwDataLen=0x8bef60*=0x10c10) returned 1 [0087.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.167] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.167] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.167] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.167] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.167] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.168] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.168] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.168] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.168] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.168] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.168] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.168] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.168] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.168] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.168] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.168] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.168] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.168] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.168] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.168] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.168] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.175] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.175] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.175] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.176] WriteFile (in: hFile=0x24c, lpBuffer=0x2ca4c28*, nNumberOfBytesToWrite=0x10c10, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2ca4c28*, lpNumberOfBytesWritten=0x8bf5e4*=0x10c10, lpOverlapped=0x0) returned 1 [0087.178] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.178] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.178] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0087.178] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.178] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0087.178] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.178] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.178] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.178] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.178] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.179] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.179] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.179] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8b140, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0087.179] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0087.179] CryptDestroyKey (hKey=0xa7cb28) returned 1 [0087.179] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.179] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.179] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.179] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.180] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.180] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.180] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.180] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.180] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.180] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.180] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.180] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.180] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.180] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.180] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.180] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.180] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.180] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.180] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.180] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.181] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.181] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.181] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.181] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.181] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.181] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.181] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.181] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.181] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.181] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.181] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.181] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.181] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.181] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.181] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.182] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.182] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.182] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.182] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.182] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.182] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.182] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.182] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.182] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.182] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.182] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.182] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.182] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.182] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.182] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.183] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.183] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.183] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7abb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0087.183] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0087.183] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0087.183] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.183] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.184] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.184] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.184] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.184] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.184] FreeLibrary (hLibModule=0x76a10000) returned 1 [0087.184] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.184] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.184] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.184] CloseHandle (hObject=0x240) returned 1 [0087.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.193] CloseHandle (hObject=0x24c) returned 1 [0087.199] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.201] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.202] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.202] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.202] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/Yh3aSzBw6vqSD.mp4", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Yh3aSzBw6vqSD.mp4", lpFilePart=0x8bedf4*="Yh3aSzBw6vqSD.mp4") returned 0x2e [0087.202] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Yh3aSzBw6vqSD.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yh3aszbw6vqsd.mp4")) returned 0x20 [0087.202] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Yh3aSzBw6vqSD.mp4", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d168 [0087.202] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Yh3aSzBw6vqSD.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yh3aszbw6vqsd.mp4")) returned 1 [0087.320] FindNextFileW (in: hFindFile=0xa7d168, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0087.320] FindClose (in: hFindFile=0xa7d168 | out: hFindFile=0xa7d168) returned 1 [0087.321] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 1 [0087.321] TranslateMessage (lpMsg=0x8bf968) returned 0 [0087.321] DispatchMessageW (lpMsg=0x8bf968) returned 0x0 [0087.321] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0087.321] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0087.321] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.321] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.321] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.321] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos/Yh3aSzBw6vqSD.mp4", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Yh3aSzBw6vqSD.mp4", lpFilePart=0x8bf650*="Yh3aSzBw6vqSD.mp4") returned 0x2e [0087.321] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Yh3aSzBw6vqSD.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yh3aszbw6vqsd.mp4")) returned 0xffffffff [0087.322] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.322] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.322] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.322] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.322] CharUpperBuffW (in: lpsz="A1600E02A1D", cchLength=0xb | out: lpsz="A1600E02A1D") returned 0xb [0087.322] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.322] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf2b8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.322] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.322] CharUpperBuffW (in: lpsz="SSA1600E02A1D", cchLength=0xd | out: lpsz="SSA1600E02A1D") returned 0xd [0087.322] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.322] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.322] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0087.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x2c8b050, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/]+\\z", lpUsedDefaultChar=0x0) returned 9 [0087.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\Documents", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0087.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\Documents", cchWideChar=32, lpMultiByteStr=0x2c87908, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpUsedDefaultChar=0x0) returned 32 [0087.322] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.323] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0087.323] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0087.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x2c7aa58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", lpUsedDefaultChar=0x0) returned 23 [0087.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x3983900, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.*", lpUsedDefaultChar=0x0) returned 4 [0087.323] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.323] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.323] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0xa7cfa8 [0087.323] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.323] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.323] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.323] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.324] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.325] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.325] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.326] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.326] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.327] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.327] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.327] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.328] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.328] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.328] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.328] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.328] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.328] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.328] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.328] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.328] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.328] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.328] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.328] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.328] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.328] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.328] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.328] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.329] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.329] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.329] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.329] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.329] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.329] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.329] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.329] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.329] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.329] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.329] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.330] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.331] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.332] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.333] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.333] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.333] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.333] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.334] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.335] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.335] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.335] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.335] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.335] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.335] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0087.335] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.335] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.335] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.335] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.335] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.335] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0 [0087.335] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.335] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.335] FindClose (in: hFindFile=0xa7cfa8 | out: hFindFile=0xa7cfa8) returned 1 [0087.336] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.336] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0087.336] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.336] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.336] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="33ks1nc2w.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3ks1nc2w.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks1nc2w.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s1nc2w.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1nc2w.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nc2w.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c2w.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2w.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.336] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="33ks1nc2w.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3ks1nc2w.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks1nc2w.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s1nc2w.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.337] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1nc2w.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.337] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nc2w.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.337] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c2w.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.337] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2w.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.337] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.337] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.337] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0087.337] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.337] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.337] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.337] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.337] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.337] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0087.337] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.337] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.337] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.337] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.337] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.337] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/33ks1nc2w.xlsx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d068 [0087.338] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0087.338] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.338] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.338] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.338] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.344] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.344] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.345] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.345] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.345] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.345] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.345] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.345] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.345] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.345] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0087.345] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.345] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.345] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0087.345] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.345] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0087.345] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.346] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.346] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.346] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.346] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.346] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.346] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0087.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0087.346] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.346] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.346] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.346] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.346] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.346] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.346] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0087.347] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0087.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0087.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab98, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0087.347] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0087.347] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0087.348] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.348] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.348] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0087.348] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.348] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0087.348] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.348] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.348] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.348] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.348] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.348] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.348] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.348] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.348] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.349] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.349] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.349] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.349] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.349] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.349] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.349] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.349] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0087.349] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.349] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0087.349] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.349] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.349] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.349] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.349] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.349] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.349] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.349] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.350] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.350] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.350] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.350] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.350] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.350] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.350] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.350] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.350] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.350] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.350] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.350] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.350] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.350] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.350] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.350] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad80, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0087.351] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0087.351] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0087.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.351] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0087.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e80, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.351] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.351] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.351] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0087.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b818, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0087.352] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0087.352] CryptHashData (hHash=0xa7cc28, pbData=0x3983e20, dwDataLen=0x3, dwFlags=0x1) returned 1 [0087.352] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.352] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.352] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.352] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.352] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.352] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.352] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.352] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.352] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.352] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.353] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.353] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.353] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.353] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0087.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b6f8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0087.353] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0087.353] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cc28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cf28) returned 1 [0087.353] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.353] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.353] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.353] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.353] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.353] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.354] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.354] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.354] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.354] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.354] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.354] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0087.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0087.354] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0087.354] CryptDestroyHash (hHash=0xa7cc28) returned 1 [0087.354] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.354] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.354] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.354] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.354] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.355] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/33ks1nc2w.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\33ks1nc2w.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0087.355] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.355] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0087.355] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.355] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.355] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.392] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0087.392] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.33ks1nc2w.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.33ks1nc2w.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0087.393] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.393] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.393] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.393] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.396] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0087.396] ReadFile (in: hFile=0x24c, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0087.398] ReadFile (in: hFile=0x24c, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x56d3, lpOverlapped=0x0) returned 1 [0087.399] ReadFile (in: hFile=0x24c, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0087.404] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.405] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.405] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.405] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0087.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.408] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0087.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.408] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.408] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.408] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.408] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.408] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.408] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.408] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.408] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.409] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.409] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.409] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.409] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.409] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.409] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.409] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.409] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.409] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.409] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.409] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.409] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.409] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.409] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.409] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.409] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.409] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.409] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.410] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.410] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.410] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.411] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0087.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8acf0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0087.412] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0087.412] CryptEncrypt (in: hKey=0xa7cf28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x156d3, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x156d8) returned 1 [0087.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.412] CharLowerBuffW (in: lpsz="byte[87768]", cchLength=0xb | out: lpsz="byte[87768]") returned 0xb [0087.412] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.415] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.415] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.415] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.415] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.415] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.415] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.417] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0087.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8af48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0087.417] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0087.417] CryptEncrypt (in: hKey=0xa7cf28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c94010*, pdwDataLen=0x8bef60*=0x156d3, dwBufLen=0x156d8 | out: pbData=0x2c94010*, pdwDataLen=0x8bef60*=0x156d8) returned 1 [0087.421] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.421] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.421] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.421] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.422] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.422] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.422] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.422] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.422] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.422] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.423] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.423] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.423] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.423] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.423] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.423] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.423] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.423] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.423] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.423] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.423] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.423] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.423] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.423] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.423] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.424] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.424] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.432] WriteFile (in: hFile=0x240, lpBuffer=0x3999730*, nNumberOfBytesToWrite=0x156d8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3999730*, lpNumberOfBytesWritten=0x8bf5e4*=0x156d8, lpOverlapped=0x0) returned 1 [0087.435] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.435] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.435] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0087.435] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.435] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0087.435] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.435] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.435] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.435] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.435] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.435] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.436] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.436] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a7f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0087.436] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0087.436] CryptDestroyKey (hKey=0xa7cf28) returned 1 [0087.436] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.436] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.436] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.436] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.436] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.436] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.436] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.437] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.437] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.437] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.437] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.437] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.437] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.437] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.437] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.437] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.438] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.438] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.438] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.438] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.438] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.438] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.438] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.438] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.438] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.494] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.494] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.494] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.494] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.494] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.494] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.494] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.494] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.494] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.494] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.495] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.495] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.495] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.495] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.495] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.495] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.495] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.495] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.495] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aab8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0087.495] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0087.495] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0087.496] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.496] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.496] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.496] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.496] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.496] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.496] FreeLibrary (hLibModule=0x76a10000) returned 1 [0087.496] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.496] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.496] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.496] CloseHandle (hObject=0x24c) returned 1 [0087.498] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.498] CloseHandle (hObject=0x240) returned 1 [0087.509] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.511] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.511] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.511] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.511] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/33ks1nc2w.xlsx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\33ks1nc2w.xlsx", lpFilePart=0x8bedf4*="33ks1nc2w.xlsx") returned 0x2e [0087.511] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\33ks1nc2w.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\33ks1nc2w.xlsx")) returned 0x20 [0087.512] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\33ks1nc2w.xlsx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cfa8 [0087.512] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\33ks1nc2w.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\33ks1nc2w.xlsx")) returned 1 [0087.520] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0087.520] FindClose (in: hFindFile=0xa7cfa8 | out: hFindFile=0xa7cfa8) returned 1 [0087.520] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.520] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.520] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.521] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/33ks1nc2w.xlsx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\33ks1nc2w.xlsx", lpFilePart=0x8bf650*="33ks1nc2w.xlsx") returned 0x2e [0087.521] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\33ks1nc2w.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\33ks1nc2w.xlsx")) returned 0xffffffff [0087.521] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.521] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.521] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4 oKstOLjt Ogj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" oKstOLjt Ogj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oKstOLjt Ogj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KstOLjt Ogj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="stOLjt Ogj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tOLjt Ogj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OLjt Ogj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ljt Ogj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jt Ogj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t Ogj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Ogj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ogj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gj.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.521] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4 oKstOLjt Ogj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" oKstOLjt Ogj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oKstOLjt Ogj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KstOLjt Ogj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="stOLjt Ogj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tOLjt Ogj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OLjt Ogj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ljt Ogj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jt Ogj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t Ogj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Ogj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ogj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gj.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.522] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.522] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0087.522] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.522] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.522] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.522] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.522] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.522] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0087.522] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.522] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.522] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.523] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.523] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.523] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/4 oKstOLjt Ogj.csv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cc28 [0087.523] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0087.523] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.523] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.523] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.523] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.523] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.523] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.523] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.523] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.524] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.524] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.524] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.524] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.524] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.524] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0087.524] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.524] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.524] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0087.524] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.524] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0087.524] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.524] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.524] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.525] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.525] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.525] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.525] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0087.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0087.525] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.525] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.525] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.525] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.525] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.525] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.525] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0087.526] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0087.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0087.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a978, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0087.526] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0087.526] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0087.527] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.527] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.527] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0087.527] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.527] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0087.527] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.527] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.527] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.527] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.527] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.527] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.527] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.527] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.527] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.527] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.527] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.527] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.528] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.528] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.528] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.528] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.528] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0087.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.528] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0087.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.528] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.528] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.528] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.528] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.528] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.529] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.529] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.529] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.529] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.529] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.529] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.529] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.529] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.529] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.529] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.529] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.529] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.529] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.529] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.529] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.529] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.529] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.530] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.530] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.530] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.530] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.530] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.530] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.530] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.537] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.537] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.537] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.537] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0087.537] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0087.537] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0087.537] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.538] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.538] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.538] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983dd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.538] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0087.538] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ed0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.538] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.538] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.538] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.538] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.538] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.538] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.538] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0087.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b7d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0087.539] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0087.539] CryptHashData (hHash=0xa7cf28, pbData=0x3983e80, dwDataLen=0x3, dwFlags=0x1) returned 1 [0087.539] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.539] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.539] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.539] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.539] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.539] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.539] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.539] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.539] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.539] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.540] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.540] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.540] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.540] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0087.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b6b0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0087.540] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0087.540] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cf28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d068) returned 1 [0087.540] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.540] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.540] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.540] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.540] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.540] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.541] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.541] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.541] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.541] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.541] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.541] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0087.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0087.541] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0087.541] CryptDestroyHash (hHash=0xa7cf28) returned 1 [0087.541] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.541] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.541] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.541] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.542] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.542] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/4 oKstOLjt Ogj.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4 okstoljt ogj.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0087.542] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.542] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0087.542] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.543] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.543] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.543] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0087.543] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.4 oKstOLjt Ogj.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.4 okstoljt ogj.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0087.543] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.544] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.544] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.544] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.546] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0087.546] ReadFile (in: hFile=0x240, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0087.549] ReadFile (in: hFile=0x240, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x212a, lpOverlapped=0x0) returned 1 [0087.550] ReadFile (in: hFile=0x240, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0087.556] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.556] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.556] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.556] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0087.557] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.557] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0087.557] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.557] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.557] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.557] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.557] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.557] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.557] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.557] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.557] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.557] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.557] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.557] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.558] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.558] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.558] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.558] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.558] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.558] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.558] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.558] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.558] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.558] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.558] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.558] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.558] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.558] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.558] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.559] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.559] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.559] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.559] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.559] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.560] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0087.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8afc0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0087.560] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0087.560] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x1212a, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x12130) returned 1 [0087.560] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.560] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.560] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.560] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.560] CharLowerBuffW (in: lpsz="byte[74032]", cchLength=0xb | out: lpsz="byte[74032]") returned 0xb [0087.560] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.565] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.565] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.565] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.565] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.565] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.565] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.567] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0087.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0087.567] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0087.567] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cca3b8*, pdwDataLen=0x8bef60*=0x1212a, dwBufLen=0x12130 | out: pbData=0x2cca3b8*, pdwDataLen=0x8bef60*=0x12130) returned 1 [0087.570] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.570] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.570] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.570] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.571] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.571] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.571] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.571] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.571] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.571] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.571] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.571] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.571] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.571] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.571] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.572] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.572] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.572] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.572] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.572] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.572] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.572] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.572] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.572] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.572] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.574] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.574] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.583] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.583] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.583] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.584] WriteFile (in: hFile=0x24c, lpBuffer=0x3996188*, nNumberOfBytesToWrite=0x12130, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3996188*, lpNumberOfBytesWritten=0x8bf5e4*=0x12130, lpOverlapped=0x0) returned 1 [0087.587] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.587] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.587] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0087.587] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.587] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0087.587] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.587] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.587] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.587] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.587] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.587] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.587] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.587] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a918, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0087.588] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0087.588] CryptDestroyKey (hKey=0xa7d068) returned 1 [0087.588] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.588] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.588] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.588] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.588] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.588] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.588] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.588] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.588] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.588] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.588] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.588] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.588] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.589] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.589] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.589] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.589] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.589] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.589] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.589] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.589] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.589] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.589] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.589] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.589] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.589] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.589] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.589] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.589] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.589] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.589] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.590] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.590] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.590] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.590] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.590] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.590] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.590] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.590] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.590] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.590] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.590] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.590] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.590] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.590] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.590] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.590] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.590] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.590] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.591] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.591] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.591] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.591] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0087.591] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0087.591] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0087.591] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.591] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.591] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.591] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.591] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.591] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.592] FreeLibrary (hLibModule=0x76a10000) returned 1 [0087.592] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.592] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.592] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.592] CloseHandle (hObject=0x240) returned 1 [0087.593] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.593] CloseHandle (hObject=0x24c) returned 1 [0087.599] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.601] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.601] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.601] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.601] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/4 oKstOLjt Ogj.csv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4 oKstOLjt Ogj.csv", lpFilePart=0x8bedf4*="4 oKstOLjt Ogj.csv") returned 0x32 [0087.601] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4 oKstOLjt Ogj.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4 okstoljt ogj.csv")) returned 0x20 [0087.602] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4 oKstOLjt Ogj.csv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d128 [0087.602] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4 oKstOLjt Ogj.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4 okstoljt ogj.csv")) returned 1 [0087.618] FindNextFileW (in: hFindFile=0xa7d128, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0087.618] FindClose (in: hFindFile=0xa7d128 | out: hFindFile=0xa7d128) returned 1 [0087.619] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.619] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.619] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.619] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/4 oKstOLjt Ogj.csv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4 oKstOLjt Ogj.csv", lpFilePart=0x8bf650*="4 oKstOLjt Ogj.csv") returned 0x32 [0087.619] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4 oKstOLjt Ogj.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4 okstoljt ogj.csv")) returned 0xffffffff [0087.619] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.619] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.619] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5IRX mV-dQwqDIWU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IRX mV-dQwqDIWU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RX mV-dQwqDIWU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X mV-dQwqDIWU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" mV-dQwqDIWU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mV-dQwqDIWU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V-dQwqDIWU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-dQwqDIWU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dQwqDIWU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QwqDIWU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wqDIWU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qDIWU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DIWU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IWU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WU8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.620] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5IRX mV-dQwqDIWU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IRX mV-dQwqDIWU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RX mV-dQwqDIWU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X mV-dQwqDIWU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" mV-dQwqDIWU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mV-dQwqDIWU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V-dQwqDIWU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-dQwqDIWU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dQwqDIWU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QwqDIWU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wqDIWU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qDIWU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DIWU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IWU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WU8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.621] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.621] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0087.621] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.621] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.621] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.621] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.621] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.621] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0087.621] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.621] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.621] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.621] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.621] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.621] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/5IRX mV-dQwqDIWU8l.docx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cfa8 [0087.622] FindClose (in: hFindFile=0xa7cfa8 | out: hFindFile=0xa7cfa8) returned 1 [0087.622] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.622] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.622] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.622] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.622] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.622] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.622] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.622] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.622] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.622] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.622] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.622] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.623] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.623] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0087.623] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.623] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.623] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0087.623] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.623] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0087.623] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.623] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.623] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.623] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.623] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.623] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.623] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0087.623] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0087.624] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.624] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.624] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.624] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.624] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.624] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.624] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0087.624] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0087.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0087.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a978, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0087.625] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0087.625] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0087.625] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.625] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.628] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0087.628] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.628] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0087.628] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.628] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.628] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.628] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.638] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.638] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.638] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.638] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.639] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.639] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.639] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.639] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.639] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.639] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.639] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.639] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.639] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0087.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.639] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0087.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.639] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.640] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.640] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.640] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.640] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.640] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.640] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.640] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.640] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.640] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.640] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.640] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.640] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.640] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.640] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.640] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.640] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.640] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.640] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.641] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.641] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.641] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.641] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.641] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.641] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.641] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.641] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.641] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.641] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.642] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.642] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.642] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.642] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad38, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0087.642] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0087.642] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0087.642] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.642] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.642] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.642] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.643] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0087.643] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983dc0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.643] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.643] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.643] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.643] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.643] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.643] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.643] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0087.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b8d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0087.644] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0087.644] CryptHashData (hHash=0xa7cd28, pbData=0x3983e70, dwDataLen=0x3, dwFlags=0x1) returned 1 [0087.644] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.644] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.644] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.644] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.644] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.644] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.644] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.644] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.644] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.644] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.644] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.644] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.645] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.645] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0087.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b5f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0087.645] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0087.645] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cd28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d068) returned 1 [0087.645] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.645] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.645] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.645] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.645] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.645] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.645] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.645] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.646] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.646] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.646] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.646] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0087.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aa78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0087.646] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0087.646] CryptDestroyHash (hHash=0xa7cd28) returned 1 [0087.646] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.646] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.646] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.646] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.646] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.647] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/5IRX mV-dQwqDIWU8l.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\5irx mv-dqwqdiwu8l.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0087.647] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.647] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0087.647] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.647] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.647] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.647] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0087.648] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.5IRX mV-dQwqDIWU8l.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.5irx mv-dqwqdiwu8l.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0087.648] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.648] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.648] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.648] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.651] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0087.651] ReadFile (in: hFile=0x24c, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0087.653] ReadFile (in: hFile=0x24c, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x3e00, lpOverlapped=0x0) returned 1 [0087.654] ReadFile (in: hFile=0x24c, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0087.661] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.662] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.662] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.662] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0087.663] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.664] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0087.664] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.664] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.664] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.664] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.664] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.664] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.664] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.664] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.664] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.664] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.664] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.664] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.664] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.664] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.664] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.664] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.664] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.665] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.665] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.665] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.665] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.665] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.665] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.665] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.684] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.684] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.684] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.684] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.684] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.684] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.684] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.684] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.684] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.684] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.684] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.685] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0087.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0087.686] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0087.686] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x13e00, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x13e08) returned 1 [0087.686] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.686] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.686] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.686] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.686] CharLowerBuffW (in: lpsz="byte[81416]", cchLength=0xb | out: lpsz="byte[81416]") returned 0xb [0087.686] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.689] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.689] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.689] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.690] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.690] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.690] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.690] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0087.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0087.690] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0087.690] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ccfa28*, pdwDataLen=0x8bef60*=0x13e00, dwBufLen=0x13e08 | out: pbData=0x2ccfa28*, pdwDataLen=0x8bef60*=0x13e08) returned 1 [0087.693] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.693] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.694] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.694] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.694] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.694] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.694] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.694] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.694] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.694] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.694] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.694] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.694] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.694] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.694] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.694] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.694] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.695] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.695] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.695] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.695] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.695] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.695] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.695] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.695] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.695] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.695] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.703] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.703] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.703] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.704] WriteFile (in: hFile=0x240, lpBuffer=0x3984050*, nNumberOfBytesToWrite=0x13e08, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3984050*, lpNumberOfBytesWritten=0x8bf5e4*=0x13e08, lpOverlapped=0x0) returned 1 [0087.708] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.708] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.708] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0087.708] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.708] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0087.708] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.708] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.709] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.709] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.709] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.709] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.709] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.709] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a798, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0087.709] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0087.709] CryptDestroyKey (hKey=0xa7d068) returned 1 [0087.713] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.713] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.714] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.714] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.714] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.714] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.714] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.714] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.714] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.714] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.714] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.714] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.714] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.714] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.714] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.714] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.714] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.715] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.715] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.715] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.715] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.715] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.715] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.715] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.715] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.715] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.715] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.715] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.715] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.715] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.715] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.715] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.715] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.716] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.716] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.716] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.716] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.716] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.716] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.716] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.716] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.716] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.716] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.716] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.716] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.716] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.716] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.716] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.716] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.717] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.717] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.717] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.717] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ab98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0087.717] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0087.717] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0087.717] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.718] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.718] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.718] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.718] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.718] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.718] FreeLibrary (hLibModule=0x76a10000) returned 1 [0087.718] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.718] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.718] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.718] CloseHandle (hObject=0x24c) returned 1 [0087.719] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.719] CloseHandle (hObject=0x240) returned 1 [0087.723] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.726] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.726] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.726] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.726] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/5IRX mV-dQwqDIWU8l.docx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\5IRX mV-dQwqDIWU8l.docx", lpFilePart=0x8bedf4*="5IRX mV-dQwqDIWU8l.docx") returned 0x37 [0087.726] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\5IRX mV-dQwqDIWU8l.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\5irx mv-dqwqdiwu8l.docx")) returned 0x20 [0087.726] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\5IRX mV-dQwqDIWU8l.docx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0087.727] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\5IRX mV-dQwqDIWU8l.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\5irx mv-dqwqdiwu8l.docx")) returned 1 [0087.739] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0087.739] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0087.739] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.739] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.739] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.739] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/5IRX mV-dQwqDIWU8l.docx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\5IRX mV-dQwqDIWU8l.docx", lpFilePart=0x8bf650*="5IRX mV-dQwqDIWU8l.docx") returned 0x37 [0087.740] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\5IRX mV-dQwqDIWU8l.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\5irx mv-dqwqdiwu8l.docx")) returned 0xffffffff [0087.740] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.740] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.740] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AkLAPzq8O4g_04G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kLAPzq8O4g_04G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LAPzq8O4g_04G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="APzq8O4g_04G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pzq8O4g_04G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zq8O4g_04G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q8O4g_04G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8O4g_04G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O4g_04G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4g_04G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g_04G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_04G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="04G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.744] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AkLAPzq8O4g_04G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kLAPzq8O4g_04G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LAPzq8O4g_04G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="APzq8O4g_04G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pzq8O4g_04G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zq8O4g_04G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q8O4g_04G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8O4g_04G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O4g_04G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4g_04G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g_04G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_04G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="04G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.745] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.745] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0087.745] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.745] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.745] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.745] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.745] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.745] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0087.745] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.745] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.746] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.746] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.746] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.746] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/AkLAPzq8O4g_04G.xlsx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cc28 [0087.746] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0087.746] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.746] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.746] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.746] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.746] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.746] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.747] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.747] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.747] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.747] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.747] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.747] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.747] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.747] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0087.747] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.747] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.747] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0087.747] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.747] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0087.747] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.748] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.748] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.748] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.748] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.748] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.748] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0087.748] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0087.748] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.748] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.748] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.748] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.748] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.748] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.748] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7acd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0087.749] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0087.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0087.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7acf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0087.749] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0087.749] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0087.750] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.750] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.750] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0087.750] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.750] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0087.750] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.750] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.750] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.751] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.751] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.751] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.751] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.751] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.751] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.751] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.751] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.751] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.751] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.751] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.751] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.752] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.752] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0087.752] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.752] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0087.752] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.752] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.752] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.752] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.752] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.752] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.752] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.752] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.752] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.752] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.752] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.753] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.753] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.753] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.753] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.753] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.753] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.753] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.753] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.753] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.753] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.753] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.753] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.753] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.753] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.753] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.754] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.754] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.754] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.754] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.754] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.754] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.754] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.754] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.754] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.754] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.754] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.754] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.754] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8aed0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0087.755] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0087.755] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0087.755] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.755] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.755] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.755] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e20, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.755] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0087.755] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983db0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.756] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.756] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.756] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.756] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.756] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.756] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.756] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0087.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b668, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0087.756] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0087.756] CryptHashData (hHash=0xa7caa8, pbData=0x3983e00, dwDataLen=0x3, dwFlags=0x1) returned 1 [0087.757] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.757] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.757] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.757] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.757] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.757] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.757] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.757] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.757] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.757] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.757] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.757] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.757] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.757] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0087.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b800, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0087.758] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0087.758] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7caa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cb28) returned 1 [0087.758] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.758] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.758] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.758] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.758] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.758] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.762] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.763] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.763] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.763] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.763] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.763] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0087.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7abd8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0087.763] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0087.764] CryptDestroyHash (hHash=0xa7caa8) returned 1 [0087.764] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.764] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.764] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.764] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.764] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.764] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/AkLAPzq8O4g_04G.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\aklapzq8o4g_04g.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0087.764] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.764] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0087.764] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.765] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.765] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.765] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0087.765] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.AkLAPzq8O4g_04G.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.aklapzq8o4g_04g.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0087.766] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.766] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.766] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.766] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.769] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0087.769] ReadFile (in: hFile=0x240, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x37fa, lpOverlapped=0x0) returned 1 [0087.771] ReadFile (in: hFile=0x240, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0087.776] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.776] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.776] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.776] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0087.776] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.776] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0087.776] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.776] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.776] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.776] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.776] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.776] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.776] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.777] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.777] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.777] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.777] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.778] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.778] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.778] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.778] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.778] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.778] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.778] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.778] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.778] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.778] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.778] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.778] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.778] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.779] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.779] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.779] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.779] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.779] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.779] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.779] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.779] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.779] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.779] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.779] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.779] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0087.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0087.780] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0087.780] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x37fa, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x3800) returned 1 [0087.780] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.780] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.780] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.780] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.780] CharLowerBuffW (in: lpsz="byte[14336]", cchLength=0xb | out: lpsz="byte[14336]") returned 0xb [0087.780] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.781] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.781] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.781] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.781] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.781] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.781] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.781] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0087.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8aed0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0087.782] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0087.783] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c9e828*, pdwDataLen=0x8bef60*=0x37fa, dwBufLen=0x3800 | out: pbData=0x2c9e828*, pdwDataLen=0x8bef60*=0x3800) returned 1 [0087.783] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.783] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.783] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.783] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.783] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.784] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.784] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.784] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.784] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.784] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.784] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.784] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.784] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.784] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.784] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.784] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.784] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.784] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.784] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.784] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.784] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.785] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.785] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.785] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.785] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.785] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.785] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.787] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.787] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.787] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.788] WriteFile (in: hFile=0x24c, lpBuffer=0x2c97818*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2c97818*, lpNumberOfBytesWritten=0x8bf5e4*=0x3800, lpOverlapped=0x0) returned 1 [0087.789] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.789] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.789] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0087.789] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.789] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0087.789] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.790] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.790] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.790] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.790] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.790] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.790] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.790] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a780, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0087.790] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0087.790] CryptDestroyKey (hKey=0xa7cb28) returned 1 [0087.790] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.791] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.791] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.791] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.791] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.791] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.791] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.791] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.791] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.791] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.791] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.791] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.791] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.791] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.791] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.791] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.791] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.792] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.792] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.800] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.800] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.800] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.800] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.800] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.800] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.800] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.800] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.800] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.800] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.800] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.800] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.800] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.800] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.800] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.801] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.801] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.801] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.801] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.801] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.801] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.801] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.801] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.801] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.801] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.801] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.801] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.801] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.801] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.801] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.801] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.802] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.802] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.802] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aaf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0087.802] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0087.802] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0087.802] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.802] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.802] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.802] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.802] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.803] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.803] FreeLibrary (hLibModule=0x76a10000) returned 1 [0087.803] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.803] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.803] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.803] CloseHandle (hObject=0x240) returned 1 [0087.804] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.804] CloseHandle (hObject=0x24c) returned 1 [0087.807] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.808] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.808] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.808] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.808] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/AkLAPzq8O4g_04G.xlsx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AkLAPzq8O4g_04G.xlsx", lpFilePart=0x8bedf4*="AkLAPzq8O4g_04G.xlsx") returned 0x34 [0087.808] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AkLAPzq8O4g_04G.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\aklapzq8o4g_04g.xlsx")) returned 0x20 [0087.808] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AkLAPzq8O4g_04G.xlsx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cb28 [0087.809] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AkLAPzq8O4g_04G.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\aklapzq8o4g_04g.xlsx")) returned 1 [0087.824] FindNextFileW (in: hFindFile=0xa7cb28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0087.824] FindClose (in: hFindFile=0xa7cb28 | out: hFindFile=0xa7cb28) returned 1 [0087.824] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.824] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.824] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.824] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/AkLAPzq8O4g_04G.xlsx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AkLAPzq8O4g_04G.xlsx", lpFilePart=0x8bf650*="AkLAPzq8O4g_04G.xlsx") returned 0x34 [0087.824] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AkLAPzq8O4g_04G.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\aklapzq8o4g_04g.xlsx")) returned 0xffffffff [0087.824] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.824] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.824] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cVtkaJxJuKDO0_4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VtkaJxJuKDO0_4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tkaJxJuKDO0_4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kaJxJuKDO0_4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aJxJuKDO0_4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JxJuKDO0_4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xJuKDO0_4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JuKDO0_4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uKDO0_4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KDO0_4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DO0_4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O0_4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0_4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HwRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wRfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RfX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fX.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.825] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cVtkaJxJuKDO0_4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VtkaJxJuKDO0_4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tkaJxJuKDO0_4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kaJxJuKDO0_4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aJxJuKDO0_4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JxJuKDO0_4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xJuKDO0_4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JuKDO0_4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uKDO0_4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KDO0_4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DO0_4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O0_4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0_4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HwRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wRfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RfX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fX.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.826] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.826] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0087.826] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.826] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.826] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.826] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.826] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.826] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0087.826] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.827] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.827] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.827] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.827] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.827] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/cVtkaJxJuKDO0_4HwRfX.pptx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d128 [0087.827] FindClose (in: hFindFile=0xa7d128 | out: hFindFile=0xa7d128) returned 1 [0087.827] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.827] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.827] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.827] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.827] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.828] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.828] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.828] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.828] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.828] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.828] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.828] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.828] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.828] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0087.828] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.828] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.828] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0087.829] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.829] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0087.829] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.829] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.829] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.829] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.829] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.829] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.829] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0087.829] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0087.829] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.830] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.830] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.830] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.830] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.830] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.830] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0087.830] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0087.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0087.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0087.831] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0087.831] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0087.831] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.832] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.832] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0087.832] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.832] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0087.832] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.832] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.832] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.832] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.832] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.832] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.832] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.832] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.832] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.832] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.832] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.832] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.832] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.833] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.833] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.833] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.833] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0087.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.833] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0087.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.835] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.835] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.835] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.836] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.836] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.836] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.836] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.836] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.836] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.836] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.836] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.836] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.836] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.836] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.836] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.836] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.836] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.836] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.840] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.840] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.840] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.840] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.840] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.840] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.840] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.840] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.840] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.840] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.840] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.840] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.841] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.841] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.842] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.842] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.842] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.843] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.843] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.843] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8aea0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0087.843] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0087.843] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0087.843] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.843] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.843] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.843] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983de0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.844] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0087.844] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ec0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.844] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.844] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.844] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.844] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.844] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.844] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.844] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0087.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b698, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0087.845] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0087.845] CryptHashData (hHash=0xa7d0a8, pbData=0x3983dc0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0087.845] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.846] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.846] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.846] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.846] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.846] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.846] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.846] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.846] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.846] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.846] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.847] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0087.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b800, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0087.847] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0087.847] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d0a8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cb28) returned 1 [0087.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.848] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.848] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.848] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.848] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.848] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.848] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.848] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.848] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.848] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0087.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0087.848] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0087.848] CryptDestroyHash (hHash=0xa7d0a8) returned 1 [0087.849] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.849] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.849] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.849] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.849] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.849] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/cVtkaJxJuKDO0_4HwRfX.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\cvtkajxjukdo0_4hwrfx.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0087.850] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.850] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0087.850] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.850] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.850] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.850] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0087.850] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.cVtkaJxJuKDO0_4HwRfX.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.cvtkajxjukdo0_4hwrfx.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0087.851] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.851] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.851] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.851] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.854] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0087.854] ReadFile (in: hFile=0x24c, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x2a8d, lpOverlapped=0x0) returned 1 [0087.855] ReadFile (in: hFile=0x24c, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0087.858] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.858] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.858] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.858] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0087.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.859] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0087.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.859] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.859] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.859] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.859] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.859] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.859] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.859] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.860] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.860] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.860] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.860] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.860] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.860] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.860] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.860] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.860] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.860] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.860] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.860] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.861] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.861] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.861] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.861] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.861] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.861] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.861] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.861] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.861] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.861] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0087.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0087.862] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0087.862] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x2a8d, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x2a90) returned 1 [0087.862] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.862] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.862] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.862] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.862] CharLowerBuffW (in: lpsz="byte[10896]", cchLength=0xb | out: lpsz="byte[10896]") returned 0xb [0087.862] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.862] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.862] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.862] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.862] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.863] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.863] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.863] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0087.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8adb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0087.863] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0087.863] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c99540*, pdwDataLen=0x8bef60*=0x2a8d, dwBufLen=0x2a90 | out: pbData=0x2c99540*, pdwDataLen=0x8bef60*=0x2a90) returned 1 [0087.864] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.864] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.864] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.864] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.864] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.864] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.864] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.864] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.864] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.869] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.869] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.869] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.869] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.869] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.869] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.869] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.869] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.870] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.870] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.870] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.870] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.870] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.870] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.870] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.870] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.870] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.870] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.872] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.873] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.873] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.873] WriteFile (in: hFile=0x240, lpBuffer=0x2c94010*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesWritten=0x8bf5e4*=0x2a90, lpOverlapped=0x0) returned 1 [0087.874] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.874] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.875] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0087.875] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.875] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0087.875] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.875] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.875] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.875] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.875] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.875] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.875] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0087.875] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a780, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0087.876] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0087.876] CryptDestroyKey (hKey=0xa7cb28) returned 1 [0087.876] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.876] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.876] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.876] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.876] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.876] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.876] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.877] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.877] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.877] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.877] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.877] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.877] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0087.877] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.877] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.877] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.877] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.877] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.877] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0087.877] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.877] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0087.877] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.877] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0087.878] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.878] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0087.878] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.878] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0087.878] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.878] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.878] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0087.878] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.878] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0087.878] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.878] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.878] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.878] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.878] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.878] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.879] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.879] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.879] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.879] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.879] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.879] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.879] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.879] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.879] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.879] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.879] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.879] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.879] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.879] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.879] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a998, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0087.880] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0087.880] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0087.880] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.880] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.880] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.880] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.880] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.880] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0087.880] FreeLibrary (hLibModule=0x76a10000) returned 1 [0087.880] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.880] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.881] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.881] CloseHandle (hObject=0x24c) returned 1 [0087.882] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.882] CloseHandle (hObject=0x240) returned 1 [0087.888] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.888] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.888] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.889] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.889] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/cVtkaJxJuKDO0_4HwRfX.pptx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\cVtkaJxJuKDO0_4HwRfX.pptx", lpFilePart=0x8bedf4*="cVtkaJxJuKDO0_4HwRfX.pptx") returned 0x39 [0087.889] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\cVtkaJxJuKDO0_4HwRfX.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\cvtkajxjukdo0_4hwrfx.pptx")) returned 0x20 [0087.889] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\cVtkaJxJuKDO0_4HwRfX.pptx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7ce28 [0087.889] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\cVtkaJxJuKDO0_4HwRfX.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\cvtkajxjukdo0_4hwrfx.pptx")) returned 1 [0087.907] FindNextFileW (in: hFindFile=0xa7ce28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0087.910] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0087.911] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.911] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.911] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.911] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/cVtkaJxJuKDO0_4HwRfX.pptx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\cVtkaJxJuKDO0_4HwRfX.pptx", lpFilePart=0x8bf650*="cVtkaJxJuKDO0_4HwRfX.pptx") returned 0x39 [0087.911] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\cVtkaJxJuKDO0_4HwRfX.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\cvtkajxjukdo0_4hwrfx.pptx")) returned 0xffffffff [0087.911] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.911] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.911] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Database1.accdb", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="atabase1.accdb", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tabase1.accdb", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="abase1.accdb", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="base1.accdb", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ase1.accdb", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="se1.accdb", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e1.accdb", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.accdb", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".accdb", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="accdb", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0087.912] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Database1.accdb", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="atabase1.accdb", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tabase1.accdb", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="abase1.accdb", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="base1.accdb", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ase1.accdb", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="se1.accdb", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e1.accdb", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.accdb", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".accdb", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0087.912] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0087.912] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0087.912] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.913] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.913] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0087.913] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0087.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.913] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0087.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.913] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Database1.accdb", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7c9a8 [0087.914] FindClose (in: hFindFile=0xa7c9a8 | out: hFindFile=0xa7c9a8) returned 1 [0087.914] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.914] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.914] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.914] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.914] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.914] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.914] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.914] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.914] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.914] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.914] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.915] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0087.915] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.915] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0087.915] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.915] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.915] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0087.915] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.915] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0087.915] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.915] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.915] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.916] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.916] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.916] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.918] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0087.919] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0087.919] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.919] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.919] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.919] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.919] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.919] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0087.919] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0087.920] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0087.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0087.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a978, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0087.920] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0087.920] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0087.921] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.921] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.921] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0087.921] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.921] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0087.921] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.921] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.921] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.921] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.921] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.922] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.922] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.922] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.922] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.922] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.922] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.922] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0087.922] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0087.922] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.922] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.922] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.923] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0087.923] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.923] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0087.923] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.923] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.923] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.923] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.924] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.924] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.924] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.924] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0087.924] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.924] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0087.924] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.924] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.924] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0087.924] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.924] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0087.924] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.924] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0087.924] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.924] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.924] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0087.924] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.924] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0087.925] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.925] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.925] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0087.925] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0087.925] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.925] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.925] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.925] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.925] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.925] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.925] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.925] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.925] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.925] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.925] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.925] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.925] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad38, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0087.926] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0087.926] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0087.926] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.926] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.926] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.926] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d50, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.927] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0087.927] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983dd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0087.927] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.927] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.927] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.927] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.927] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.927] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.927] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0087.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b6c8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0087.928] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0087.928] CryptHashData (hHash=0xa7cca8, pbData=0x3983d80, dwDataLen=0x3, dwFlags=0x1) returned 1 [0087.928] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.928] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.928] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.928] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.928] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.928] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.928] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.928] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.928] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0087.928] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.928] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0087.929] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.929] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0087.929] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0087.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b7b8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0087.929] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0087.929] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cca8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7c9e8) returned 1 [0087.929] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.929] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.930] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.930] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.930] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.930] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.930] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0087.930] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.930] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0087.930] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.930] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0087.930] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0087.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0087.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0087.931] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0087.931] CryptDestroyHash (hHash=0xa7cca8) returned 1 [0087.931] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0087.931] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.931] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.931] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.931] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.931] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Database1.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0087.932] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.932] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0087.932] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.932] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.932] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.932] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0087.932] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.Database1.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.database1.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0087.933] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.933] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.933] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.933] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0087.937] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0087.937] ReadFile (in: hFile=0x240, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0087.982] ReadFile (in: hFile=0x240, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0088.000] ReadFile (in: hFile=0x240, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0088.005] ReadFile (in: hFile=0x240, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0088.008] ReadFile (in: hFile=0x240, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0088.009] ReadFile (in: hFile=0x240, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x7000, lpOverlapped=0x0) returned 1 [0088.010] ReadFile (in: hFile=0x240, lpBuffer=0x3a1a018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x3a1a018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0088.035] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.038] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.038] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.038] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0088.049] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.049] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0088.049] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.049] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.049] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.049] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.049] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.049] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.049] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.076] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0088.076] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 1 [0088.077] TranslateMessage (lpMsg=0x8bf158) returned 0 [0088.077] DispatchMessageW (lpMsg=0x8bf158) returned 0x0 [0088.077] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0088.077] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0088.077] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.077] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0088.077] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.077] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.077] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0088.077] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.077] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0088.077] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.077] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.077] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.078] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.078] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0088.078] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.078] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0088.078] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.078] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.078] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.078] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.078] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.078] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.078] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.078] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.078] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.078] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.078] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.079] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.079] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.084] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0088.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0088.085] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0088.085] CryptEncrypt (in: hKey=0xa7c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x57000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x57008) returned 1 [0088.085] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.085] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.085] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.085] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.085] CharLowerBuffW (in: lpsz="byte[356360]", cchLength=0xc | out: lpsz="byte[356360]") returned 0xc [0088.085] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.105] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.105] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.105] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.105] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.105] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.105] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.247] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0088.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8adb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0088.247] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0088.248] CryptEncrypt (in: hKey=0xa7c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3ae8038*, pdwDataLen=0x8bef60*=0x57000, dwBufLen=0x57008 | out: pbData=0x3ae8038*, pdwDataLen=0x8bef60*=0x57008) returned 1 [0088.262] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.262] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.262] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.262] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.271] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.271] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.271] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.272] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0088.272] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.272] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0088.272] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.272] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.272] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0088.272] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.272] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0088.272] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.272] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.272] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.272] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.272] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0088.272] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.272] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0088.272] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.273] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.273] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.273] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.273] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.511] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.512] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.512] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.517] WriteFile (in: hFile=0x24c, lpBuffer=0x3c2e008*, nNumberOfBytesToWrite=0x57008, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3c2e008*, lpNumberOfBytesWritten=0x8bf5e4*=0x57008, lpOverlapped=0x0) returned 1 [0088.525] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.525] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.525] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0088.525] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0088.525] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0088.525] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0088.525] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0088.525] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.526] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0088.526] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.526] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0088.526] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0088.526] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0088.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a918, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0088.526] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0088.526] CryptDestroyKey (hKey=0xa7c9e8) returned 1 [0088.526] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0088.526] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0088.527] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0088.527] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0088.527] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0088.527] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0088.527] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0088.527] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0088.527] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0088.527] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0088.527] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0088.527] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0088.527] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0088.527] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0088.527] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0088.527] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0088.527] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0088.527] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0088.528] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0088.528] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0088.528] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0088.528] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0088.528] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0088.528] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.528] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0088.528] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.528] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0088.528] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.528] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.528] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0088.528] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.528] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0088.528] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.528] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.529] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.529] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.529] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0088.529] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0088.529] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0088.529] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0088.529] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0088.529] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.529] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.529] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.529] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.529] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.529] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.529] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0088.529] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.529] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0088.529] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.530] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.530] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0088.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0088.530] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0088.530] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0088.530] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.530] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.530] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.530] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.531] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.531] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.531] FreeLibrary (hLibModule=0x76a10000) returned 1 [0088.531] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.531] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.531] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.531] CloseHandle (hObject=0x240) returned 1 [0088.531] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.531] CloseHandle (hObject=0x24c) returned 1 [0088.584] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.584] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0088.584] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0088.584] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0088.584] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Database1.accdb", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", lpFilePart=0x8bedf4*="Database1.accdb") returned 0x2f [0088.584] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb")) returned 0x20 [0088.585] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d0e8 [0088.585] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb")) returned 1 [0088.755] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0088.755] FindClose (in: hFindFile=0xa7d0e8 | out: hFindFile=0xa7d0e8) returned 1 [0088.756] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0088.756] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0088.756] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0088.756] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Database1.accdb", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", lpFilePart=0x8bf650*="Database1.accdb") returned 0x2f [0088.756] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb")) returned 0xffffffff [0088.756] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0088.756] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0088.756] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0088.756] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.756] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.756] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0088.756] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.756] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0088.756] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0088.756] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0088.757] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0088.757] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0088.757] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0088.757] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0088.757] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0088.757] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0088.757] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0088.757] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0088.757] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0088.757] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0088.757] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0088.757] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0088.757] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0088.757] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.757] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0088.757] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.757] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.758] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.758] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.758] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.758] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/desktop.ini", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cb28 [0088.758] FindClose (in: hFindFile=0xa7cb28 | out: hFindFile=0xa7cb28) returned 1 [0088.758] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.758] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.758] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0088.758] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.758] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0088.759] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.759] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.759] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0088.759] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0088.759] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0088.759] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0088.759] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0088.759] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.759] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0088.760] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.760] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.760] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0088.760] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.760] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0088.760] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.760] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.760] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.760] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.760] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.760] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.761] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0088.761] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0088.761] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.761] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.761] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0088.761] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.761] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0088.761] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0088.761] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0088.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7abb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0088.762] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0088.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0088.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aaf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0088.763] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0088.763] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0088.764] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.764] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.764] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0088.764] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.764] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0088.764] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.764] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.764] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.764] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.764] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.765] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.765] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0088.765] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.765] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0088.765] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.765] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.765] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.765] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.765] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.765] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.765] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.765] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0088.765] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.765] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0088.766] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.766] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.766] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.766] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.766] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.766] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 1 [0088.826] TranslateMessage (lpMsg=0x8bf3b8) returned 0 [0088.826] DispatchMessageW (lpMsg=0x8bf3b8) returned 0x0 [0088.826] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0088.826] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0088.826] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.826] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.826] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0088.827] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.827] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0088.827] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.827] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.827] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0088.828] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.828] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0088.828] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.828] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.828] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.828] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.829] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0088.829] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.829] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0088.829] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.829] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.829] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.829] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.829] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.829] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.829] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.829] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.830] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.830] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.830] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.830] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0088.830] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.830] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0088.830] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.830] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.830] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0088.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8afc0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0088.831] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0088.832] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0088.832] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.832] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.832] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.832] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0088.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0088.832] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0088.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0088.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d30, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0088.833] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.833] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.833] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.833] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.833] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.833] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.833] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0088.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b6e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0088.834] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0088.834] CryptHashData (hHash=0xa7d0e8, pbData=0x3983d00, dwDataLen=0x3, dwFlags=0x1) returned 1 [0088.834] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.834] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.834] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.835] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.835] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.835] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.835] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.835] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.835] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0088.835] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.835] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0088.835] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.835] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.835] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0088.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b8c0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0088.836] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0088.836] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d0e8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7ce28) returned 1 [0088.836] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.836] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.836] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.836] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.836] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.836] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.836] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.836] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0088.837] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.837] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0088.837] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0088.837] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0088.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aa38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0088.837] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0088.837] CryptDestroyHash (hHash=0xa7d0e8) returned 1 [0088.837] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.837] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.838] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.838] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.838] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.838] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0088.838] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.838] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0088.838] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.838] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.838] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.839] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0088.839] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0088.928] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.928] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.928] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.928] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.931] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0088.932] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x192, lpOverlapped=0x0) returned 1 [0088.932] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0088.936] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.936] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.936] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.936] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0088.936] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.936] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0088.936] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.936] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.936] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.936] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.936] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.937] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.937] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.937] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0088.937] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.937] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0088.937] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.938] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.938] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0088.938] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.938] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0088.938] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.939] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.939] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.939] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.939] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0088.939] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.939] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0088.939] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.939] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.939] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.939] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.939] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.939] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.939] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.941] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.941] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.941] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.941] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.941] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.941] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.941] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0088.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0088.942] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0088.942] CryptEncrypt (in: hKey=0xa7ce28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x192, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x198) returned 1 [0088.942] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.942] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.942] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.943] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.943] CharLowerBuffW (in: lpsz="byte[408]", cchLength=0x9 | out: lpsz="byte[408]") returned 0x9 [0088.943] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.943] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.943] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.943] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.943] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.943] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.943] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.943] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0088.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8afc0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0088.944] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0088.944] CryptEncrypt (in: hKey=0xa7ce28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b80048*, pdwDataLen=0x8bef60*=0x192, dwBufLen=0x198 | out: pbData=0x3b80048*, pdwDataLen=0x8bef60*=0x198) returned 1 [0088.944] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.945] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.945] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.945] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.945] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.945] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.945] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.945] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0088.945] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.945] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0088.945] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.945] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.945] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0088.945] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.945] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0088.945] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.946] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.946] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.946] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.946] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0088.946] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.946] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0088.946] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.946] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.946] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.946] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.946] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.946] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.947] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.947] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.947] WriteFile (in: hFile=0x240, lpBuffer=0x2c043b8*, nNumberOfBytesToWrite=0x198, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2c043b8*, lpNumberOfBytesWritten=0x8bf5e4*=0x198, lpOverlapped=0x0) returned 1 [0088.948] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.948] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.948] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0088.948] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0088.948] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0088.948] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0088.948] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0088.949] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.949] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0088.949] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.949] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0088.949] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0088.949] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0088.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a858, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0088.949] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0088.950] CryptDestroyKey (hKey=0xa7ce28) returned 1 [0088.950] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0088.950] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0088.950] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0088.950] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0088.950] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0088.950] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0088.950] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0088.950] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0088.950] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0088.950] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0088.950] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0088.950] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0088.950] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0088.951] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0088.951] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0088.951] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0088.951] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0088.951] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0088.951] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0088.951] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0088.951] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0088.951] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0088.951] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0088.951] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.951] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0088.951] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.951] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0088.951] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.951] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.952] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0088.952] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.952] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0088.952] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.952] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.952] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.952] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.952] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0088.952] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0088.952] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0088.952] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0088.952] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0088.952] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.952] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.952] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.952] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.952] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.953] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.953] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0088.953] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.953] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0088.953] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.953] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.953] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0088.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0088.953] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0088.953] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0088.953] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.954] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.954] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.957] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.957] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.958] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0088.958] FreeLibrary (hLibModule=0x76a10000) returned 1 [0088.958] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.958] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.958] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.958] CloseHandle (hObject=0x24c) returned 1 [0088.961] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.961] CloseHandle (hObject=0x240) returned 1 [0088.964] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.964] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0088.965] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0088.965] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0088.965] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/desktop.ini", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini", lpFilePart=0x8bedf4*="desktop.ini") returned 0x2b [0088.965] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\desktop.ini")) returned 0x26 [0088.965] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cfa8 [0088.965] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\desktop.ini")) returned 1 [0088.967] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0088.967] FindClose (in: hFindFile=0xa7cfa8 | out: hFindFile=0xa7cfa8) returned 1 [0088.967] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0088.967] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0088.967] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0088.967] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/desktop.ini", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini", lpFilePart=0x8bf650*="desktop.ini") returned 0x2b [0088.967] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\desktop.ini")) returned 0xffffffff [0088.968] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0088.968] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0088.968] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dH8KjJr-DCE7s3hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H8KjJr-DCE7s3hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8KjJr-DCE7s3hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KjJr-DCE7s3hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jJr-DCE7s3hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jr-DCE7s3hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r-DCE7s3hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-DCE7s3hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DCE7s3hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CE7s3hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E7s3hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7s3hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s3hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hc0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0088.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0088.969] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dH8KjJr-DCE7s3hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H8KjJr-DCE7s3hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8KjJr-DCE7s3hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KjJr-DCE7s3hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jJr-DCE7s3hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jr-DCE7s3hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r-DCE7s3hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-DCE7s3hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DCE7s3hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CE7s3hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E7s3hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7s3hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s3hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0088.969] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hc0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0088.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0088.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0W.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0088.970] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0088.970] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0088.970] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0088.970] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0088.970] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0088.970] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0088.970] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.970] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0088.970] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.970] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.970] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.970] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.971] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.971] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/dH8KjJr-DCE7s3hc0W.rtf", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cf68 [0088.971] FindClose (in: hFindFile=0xa7cf68 | out: hFindFile=0xa7cf68) returned 1 [0088.971] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.971] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.971] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0088.971] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.971] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0088.971] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.971] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.971] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0088.972] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0088.972] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0088.972] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0088.972] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0088.976] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.976] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0088.977] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.977] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.977] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0088.977] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.977] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0088.977] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.977] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.977] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.977] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.977] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.977] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.977] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0088.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0088.977] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.977] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.977] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0088.978] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.978] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0088.978] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0088.978] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0088.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a958, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0088.978] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0088.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0088.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0088.978] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0088.979] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0088.979] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.979] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.979] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0088.979] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.979] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0088.979] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.980] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.980] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.980] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.980] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.980] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.980] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0088.980] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.980] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0088.980] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.980] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.980] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0088.980] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0088.980] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.980] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.980] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.980] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0088.980] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.981] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0088.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.981] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0088.981] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.981] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0088.981] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.981] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.981] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0088.981] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.981] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0088.981] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.982] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0088.982] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.982] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0088.982] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.982] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.982] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.982] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.982] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.983] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.983] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0088.983] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.983] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0088.983] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.983] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.983] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0088.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af48, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0088.983] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0088.983] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0088.983] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.984] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.984] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.984] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0088.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0088.984] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0088.984] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0088.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d70, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0088.985] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.985] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.985] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.985] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.985] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.985] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.985] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0088.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b680, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0088.987] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0088.987] CryptHashData (hHash=0xa7cf68, pbData=0x3983e70, dwDataLen=0x3, dwFlags=0x1) returned 1 [0088.987] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.987] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.987] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.987] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.987] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.988] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.988] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.988] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.988] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0088.988] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.988] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0088.988] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.988] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0088.988] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0088.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b830, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0088.988] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0088.988] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cf68, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7c9a8) returned 1 [0088.988] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.988] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.988] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.989] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.989] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.989] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.989] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0088.989] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0088.989] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0088.989] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0088.989] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0088.989] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0088.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0088.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0088.989] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0088.989] CryptDestroyHash (hHash=0xa7cf68) returned 1 [0088.989] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0088.989] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.989] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.990] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.990] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.990] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/dH8KjJr-DCE7s3hc0W.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dh8kjjr-dce7s3hc0w.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0088.991] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.991] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0088.991] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.991] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.991] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.991] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0088.991] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.dH8KjJr-DCE7s3hc0W.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.dh8kjjr-dce7s3hc0w.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0088.992] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.992] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.992] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.992] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0088.995] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0088.995] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x7da0, lpOverlapped=0x0) returned 1 [0088.997] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0089.002] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.015] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0089.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.015] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0089.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.015] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.016] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.016] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.016] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.016] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.016] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.016] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.016] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.017] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.017] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.017] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.017] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.017] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.017] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.017] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.017] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.017] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.017] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.017] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.017] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.018] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.018] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.018] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.018] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.018] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.018] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.018] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.018] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.018] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0089.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0089.019] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0089.019] CryptEncrypt (in: hKey=0xa7c9a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x7da0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x7da8) returned 1 [0089.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.019] CharLowerBuffW (in: lpsz="byte[32168]", cchLength=0xb | out: lpsz="byte[32168]") returned 0xb [0089.019] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.020] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.020] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.020] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.020] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.021] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0089.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0089.021] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0089.021] CryptEncrypt (in: hKey=0xa7c9a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ccc920*, pdwDataLen=0x8bef60*=0x7da0, dwBufLen=0x7da8 | out: pbData=0x2ccc920*, pdwDataLen=0x8bef60*=0x7da8) returned 1 [0089.022] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.022] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.022] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.023] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.023] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.023] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.023] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.023] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.023] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.023] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.023] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.023] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.023] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.023] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.023] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.023] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.023] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.023] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.024] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.024] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.029] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.029] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.029] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.029] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.029] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.029] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.029] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.036] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.037] WriteFile (in: hFile=0x24c, lpBuffer=0x2cbcdd8*, nNumberOfBytesToWrite=0x7da8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cbcdd8*, lpNumberOfBytesWritten=0x8bf5e4*=0x7da8, lpOverlapped=0x0) returned 1 [0089.039] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.039] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.039] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0089.039] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.039] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0089.039] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.039] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.039] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.039] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.039] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.039] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.039] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.039] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0089.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a930, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0089.040] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0089.040] CryptDestroyKey (hKey=0xa7c9a8) returned 1 [0089.040] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.040] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.040] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.040] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.040] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.040] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.040] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.040] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.040] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.041] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.041] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.041] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.041] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.041] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.041] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.041] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.041] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.041] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.041] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.041] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.041] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.041] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.041] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.041] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.041] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.041] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.042] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.042] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.042] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.042] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.042] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.042] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.042] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.042] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.042] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.042] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.042] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.042] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.042] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.042] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.042] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.045] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.045] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.045] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.045] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.045] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.045] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.045] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.045] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.046] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.046] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.046] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.046] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0089.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0089.046] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0089.046] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0089.046] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.046] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.046] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.046] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.046] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.047] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.047] FreeLibrary (hLibModule=0x76a10000) returned 1 [0089.047] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.047] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.047] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.047] CloseHandle (hObject=0x240) returned 1 [0089.050] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.050] CloseHandle (hObject=0x24c) returned 1 [0089.055] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.055] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.056] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.056] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.056] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/dH8KjJr-DCE7s3hc0W.rtf", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\dH8KjJr-DCE7s3hc0W.rtf", lpFilePart=0x8bedf4*="dH8KjJr-DCE7s3hc0W.rtf") returned 0x36 [0089.056] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\dH8KjJr-DCE7s3hc0W.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dh8kjjr-dce7s3hc0w.rtf")) returned 0x20 [0089.056] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\dH8KjJr-DCE7s3hc0W.rtf", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7caa8 [0089.056] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\dH8KjJr-DCE7s3hc0W.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dh8kjjr-dce7s3hc0w.rtf")) returned 1 [0089.061] FindNextFileW (in: hFindFile=0xa7caa8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0089.061] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0089.061] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.061] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.061] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.061] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/dH8KjJr-DCE7s3hc0W.rtf", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\dH8KjJr-DCE7s3hc0W.rtf", lpFilePart=0x8bf650*="dH8KjJr-DCE7s3hc0W.rtf") returned 0x36 [0089.061] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\dH8KjJr-DCE7s3hc0W.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dh8kjjr-dce7s3hc0w.rtf")) returned 0xffffffff [0089.061] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.062] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.062] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DzQxuyYypsLJ110Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zQxuyYypsLJ110Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QxuyYypsLJ110Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xuyYypsLJ110Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uyYypsLJ110Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yYypsLJ110Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YypsLJ110Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ypsLJ110Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="psLJ110Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sLJ110Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJ110Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J110Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="110Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="10Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Td.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.062] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DzQxuyYypsLJ110Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zQxuyYypsLJ110Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QxuyYypsLJ110Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.062] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xuyYypsLJ110Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.063] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uyYypsLJ110Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.063] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yYypsLJ110Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.063] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YypsLJ110Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.063] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ypsLJ110Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.063] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="psLJ110Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.063] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sLJ110Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.063] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJ110Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.063] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J110Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.063] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="110Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.063] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="10Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.063] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.063] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Td.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.063] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.063] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.063] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0089.063] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.063] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.064] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.064] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.064] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.064] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0089.064] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.064] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.064] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.064] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.064] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.064] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/DzQxuyYypsLJ110Td.docx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cca8 [0089.064] FindClose (in: hFindFile=0xa7cca8 | out: hFindFile=0xa7cca8) returned 1 [0089.065] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.065] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.065] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.065] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.065] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.065] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.065] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.065] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.065] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.065] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.065] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.065] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.065] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.065] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0089.066] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.066] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.066] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0089.066] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.066] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0089.066] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.066] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.066] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.066] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.066] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.066] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.066] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0089.066] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0089.066] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.066] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.066] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.066] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.066] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.066] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.066] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0089.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0089.067] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0089.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0089.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0089.067] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0089.067] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0089.068] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.068] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.068] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0089.068] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.068] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0089.068] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.068] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.068] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.068] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.068] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.068] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.068] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.068] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.068] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.068] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.069] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.069] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.069] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.069] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.069] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.069] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.069] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0089.069] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.069] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0089.069] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.069] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.069] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.069] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.069] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.069] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.069] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.069] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.069] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.069] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.070] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.070] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.070] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.070] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.070] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.070] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.070] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.070] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.070] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.070] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.070] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.070] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.070] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.070] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.070] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.070] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.070] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.070] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.071] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.071] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.071] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.071] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.071] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.071] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.071] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.071] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.071] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.071] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0089.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0089.071] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0089.071] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0089.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.071] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.072] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.079] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0089.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d50, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0089.079] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0089.079] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0089.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0089.079] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.079] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.080] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.080] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.080] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.080] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.080] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0089.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b5f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0089.080] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0089.080] CryptHashData (hHash=0xa7cda8, pbData=0x3983ed0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0089.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.080] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.080] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.080] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.081] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.081] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.081] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0089.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b680, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0089.081] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0089.081] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cda8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cce8) returned 1 [0089.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.081] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.082] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.082] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.082] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.082] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.082] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.082] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0089.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0089.082] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0089.082] CryptDestroyHash (hHash=0xa7cda8) returned 1 [0089.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.082] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.082] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.082] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.082] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.083] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/DzQxuyYypsLJ110Td.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dzqxuyyypslj110td.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0089.083] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.083] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0089.083] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.083] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.083] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.083] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0089.083] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.DzQxuyYypsLJ110Td.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.dzqxuyyypslj110td.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0089.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.086] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0089.086] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0089.088] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x2669, lpOverlapped=0x0) returned 1 [0089.088] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0089.092] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.092] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.092] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.093] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0089.094] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.094] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0089.094] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.094] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.094] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.095] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.095] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.095] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.095] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.095] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.095] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.095] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.095] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.095] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.095] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.095] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.095] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.095] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.095] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.095] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.095] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.095] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.096] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.096] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.096] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.096] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.096] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.096] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.096] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.096] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.096] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.096] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.096] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.096] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.097] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.097] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.097] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.097] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0089.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8af90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0089.098] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0089.098] CryptEncrypt (in: hKey=0xa7cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x12669, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x12670) returned 1 [0089.098] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.098] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.098] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.098] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.098] CharLowerBuffW (in: lpsz="byte[75376]", cchLength=0xb | out: lpsz="byte[75376]") returned 0xb [0089.098] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.101] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.101] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.101] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.101] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.101] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.101] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.102] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0089.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0089.103] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0089.103] CryptEncrypt (in: hKey=0xa7cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c40680*, pdwDataLen=0x8bef60*=0x12669, dwBufLen=0x12670 | out: pbData=0x3c40680*, pdwDataLen=0x8bef60*=0x12670) returned 1 [0089.105] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.105] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.106] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.106] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.106] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.106] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.106] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.106] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.106] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.107] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.107] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.107] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.107] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.107] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.107] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.107] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.107] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.107] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.107] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.107] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.107] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.107] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.107] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.107] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.107] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.107] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.107] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.119] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.126] WriteFile (in: hFile=0x240, lpBuffer=0x2cc76a0*, nNumberOfBytesToWrite=0x12670, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cc76a0*, lpNumberOfBytesWritten=0x8bf5e4*=0x12670, lpOverlapped=0x0) returned 1 [0089.128] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.128] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.128] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0089.128] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.128] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0089.128] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.128] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.128] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.128] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.128] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.129] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.129] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.129] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0089.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a768, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0089.129] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0089.129] CryptDestroyKey (hKey=0xa7cce8) returned 1 [0089.129] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.129] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.129] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.129] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.129] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.129] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.129] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.129] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.129] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.130] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.130] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.130] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.130] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.130] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.130] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.130] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.130] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.130] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.130] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.130] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.130] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.130] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.130] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.130] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.130] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.130] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.130] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.130] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.131] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.131] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.131] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.131] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.131] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.131] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.131] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.131] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.131] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.131] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.131] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.131] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.131] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.131] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.131] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.131] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.131] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.131] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.131] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.131] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.132] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.132] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.132] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.132] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.132] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0089.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0089.132] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0089.132] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0089.132] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.132] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.132] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.132] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.132] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.133] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.133] FreeLibrary (hLibModule=0x76a10000) returned 1 [0089.133] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.133] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.133] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.133] CloseHandle (hObject=0x24c) returned 1 [0089.134] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.134] CloseHandle (hObject=0x240) returned 1 [0089.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.140] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.140] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.140] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.140] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/DzQxuyYypsLJ110Td.docx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DzQxuyYypsLJ110Td.docx", lpFilePart=0x8bedf4*="DzQxuyYypsLJ110Td.docx") returned 0x36 [0089.140] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DzQxuyYypsLJ110Td.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dzqxuyyypslj110td.docx")) returned 0x20 [0089.141] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DzQxuyYypsLJ110Td.docx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cce8 [0089.141] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DzQxuyYypsLJ110Td.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dzqxuyyypslj110td.docx")) returned 1 [0089.177] FindNextFileW (in: hFindFile=0xa7cce8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0089.177] FindClose (in: hFindFile=0xa7cce8 | out: hFindFile=0xa7cce8) returned 1 [0089.178] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.178] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.178] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.178] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/DzQxuyYypsLJ110Td.docx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DzQxuyYypsLJ110Td.docx", lpFilePart=0x8bf650*="DzQxuyYypsLJ110Td.docx") returned 0x36 [0089.178] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DzQxuyYypsLJ110Td.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dzqxuyyypslj110td.docx")) returned 0xffffffff [0089.178] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.178] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.178] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e4YsgwXPFnJ1eF_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4YsgwXPFnJ1eF_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YsgwXPFnJ1eF_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sgwXPFnJ1eF_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gwXPFnJ1eF_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wXPFnJ1eF_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XPFnJ1eF_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PFnJ1eF_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FnJ1eF_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nJ1eF_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J1eF_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1eF_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eF_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aq_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_.rtf", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.179] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e4YsgwXPFnJ1eF_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4YsgwXPFnJ1eF_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YsgwXPFnJ1eF_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sgwXPFnJ1eF_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gwXPFnJ1eF_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wXPFnJ1eF_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XPFnJ1eF_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PFnJ1eF_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FnJ1eF_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nJ1eF_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J1eF_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1eF_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eF_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aq_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q_.rtf", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.180] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.180] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0089.180] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.180] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.180] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.180] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.180] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.180] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0089.180] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.180] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.180] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.180] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.180] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.180] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/e4YsgwXPFnJ1eF_aq_.rtf", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cf28 [0089.181] FindClose (in: hFindFile=0xa7cf28 | out: hFindFile=0xa7cf28) returned 1 [0089.181] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.181] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.181] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.181] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.181] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.181] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.181] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.181] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.181] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.181] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.181] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.181] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.181] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.181] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0089.182] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.182] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.182] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0089.182] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.182] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0089.182] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.182] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.182] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.182] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.182] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.182] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.182] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0089.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0089.182] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.182] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.182] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.183] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.183] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.183] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.183] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0089.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a998, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0089.183] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0089.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0089.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aab8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0089.183] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0089.183] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0089.184] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.184] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.184] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0089.184] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.184] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0089.184] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.184] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.184] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.184] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.184] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.184] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.185] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.185] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.185] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.185] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.185] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.186] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.187] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.187] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.187] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.187] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.187] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0089.187] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.187] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0089.187] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.187] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.187] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.187] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.187] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.187] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.187] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.187] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.187] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.187] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.187] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.187] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.188] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.188] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.188] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.188] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.188] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.188] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.188] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.188] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.188] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.188] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.188] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.188] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.188] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.188] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.188] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.189] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.189] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.189] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.189] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.189] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.189] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.189] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.189] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.189] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.189] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.189] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.189] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0089.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad50, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0089.190] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0089.190] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0089.190] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.190] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.190] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.190] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0089.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983da0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0089.190] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0089.190] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0089.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0089.190] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.190] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.190] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.190] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.191] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.191] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.191] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0089.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b698, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0089.191] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0089.191] CryptHashData (hHash=0xa7cd28, pbData=0x3983ea0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0089.191] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.191] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.191] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.191] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.191] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.191] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.191] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.191] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.192] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.192] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.192] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.192] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.192] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.192] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0089.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b698, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0089.192] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0089.192] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cd28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d0a8) returned 1 [0089.192] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.192] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.192] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.193] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.193] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.193] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.193] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.193] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.193] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.193] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.193] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.193] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0089.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a958, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0089.193] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0089.193] CryptDestroyHash (hHash=0xa7cd28) returned 1 [0089.194] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.194] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.194] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.194] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.194] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.194] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/e4YsgwXPFnJ1eF_aq_.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\e4ysgwxpfnj1ef_aq_.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0089.194] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.194] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0089.194] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.194] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.194] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.195] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0089.195] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.e4YsgwXPFnJ1eF_aq_.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.e4ysgwxpfnj1ef_aq_.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0089.195] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.195] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.195] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.195] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.198] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0089.198] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0089.200] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x6a5f, lpOverlapped=0x0) returned 1 [0089.201] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0089.205] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.206] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.206] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.206] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0089.209] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.209] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0089.209] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.209] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.209] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.209] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.209] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.209] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.209] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.209] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.209] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.209] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.209] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.209] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.209] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.209] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.210] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.210] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.210] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.210] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.210] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.210] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.210] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.210] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.210] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.210] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.210] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.210] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.210] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.210] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.210] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.214] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.214] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.214] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.214] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.214] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.214] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.215] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0089.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0089.215] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0089.215] CryptEncrypt (in: hKey=0xa7d0a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x16a5f, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x16a60) returned 1 [0089.215] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.215] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.216] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.216] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.216] CharLowerBuffW (in: lpsz="byte[92768]", cchLength=0xb | out: lpsz="byte[92768]") returned 0xb [0089.216] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.218] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.218] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.218] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.218] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.218] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.218] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.220] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0089.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8adb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0089.220] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0089.220] CryptEncrypt (in: hKey=0xa7d0a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c44a70*, pdwDataLen=0x8bef60*=0x16a5f, dwBufLen=0x16a60 | out: pbData=0x3c44a70*, pdwDataLen=0x8bef60*=0x16a60) returned 1 [0089.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.224] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.224] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.224] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.224] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.224] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.224] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.224] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.225] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.225] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.225] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.225] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.225] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.225] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.225] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.225] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.225] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.225] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.225] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.225] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.225] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.225] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.225] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.225] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.234] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.234] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.234] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.235] WriteFile (in: hFile=0x24c, lpBuffer=0x2ccba90*, nNumberOfBytesToWrite=0x16a60, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2ccba90*, lpNumberOfBytesWritten=0x8bf5e4*=0x16a60, lpOverlapped=0x0) returned 1 [0089.237] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.237] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.237] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0089.238] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.238] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0089.238] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.238] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.238] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.238] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.238] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.238] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.238] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.238] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0089.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a780, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0089.238] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0089.239] CryptDestroyKey (hKey=0xa7d0a8) returned 1 [0089.239] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.239] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.239] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.239] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.239] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.239] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.239] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.239] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.239] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.239] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.239] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.239] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.239] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.239] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.239] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.239] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.239] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.240] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.240] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.240] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.240] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.240] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.240] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.240] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.240] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.240] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.240] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.240] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.240] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.240] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.240] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.240] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.240] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.240] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.240] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.241] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.241] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.241] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.241] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.241] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.241] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.241] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.241] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.241] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.241] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.241] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.241] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.241] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.241] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.241] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.241] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.241] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.242] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0089.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ab58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0089.242] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0089.242] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0089.242] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.242] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.242] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.242] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.242] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.242] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.242] FreeLibrary (hLibModule=0x76a10000) returned 1 [0089.242] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.243] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.243] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.243] CloseHandle (hObject=0x240) returned 1 [0089.245] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.245] CloseHandle (hObject=0x24c) returned 1 [0089.262] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.263] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.264] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.264] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.264] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/e4YsgwXPFnJ1eF_aq_.rtf", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\e4YsgwXPFnJ1eF_aq_.rtf", lpFilePart=0x8bedf4*="e4YsgwXPFnJ1eF_aq_.rtf") returned 0x36 [0089.264] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\e4YsgwXPFnJ1eF_aq_.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\e4ysgwxpfnj1ef_aq_.rtf")) returned 0x20 [0089.264] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\e4YsgwXPFnJ1eF_aq_.rtf", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cfa8 [0089.264] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\e4YsgwXPFnJ1eF_aq_.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\e4ysgwxpfnj1ef_aq_.rtf")) returned 1 [0089.280] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0089.280] FindClose (in: hFindFile=0xa7cfa8 | out: hFindFile=0xa7cfa8) returned 1 [0089.281] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.281] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.281] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.281] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/e4YsgwXPFnJ1eF_aq_.rtf", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\e4YsgwXPFnJ1eF_aq_.rtf", lpFilePart=0x8bf650*="e4YsgwXPFnJ1eF_aq_.rtf") returned 0x36 [0089.281] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\e4YsgwXPFnJ1eF_aq_.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\e4ysgwxpfnj1ef_aq_.rtf")) returned 0xffffffff [0089.281] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.281] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.281] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FsWV1eA3OkafmtB.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sWV1eA3OkafmtB.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WV1eA3OkafmtB.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V1eA3OkafmtB.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1eA3OkafmtB.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eA3OkafmtB.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A3OkafmtB.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3OkafmtB.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OkafmtB.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kafmtB.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afmtB.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fmtB.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mtB.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tB.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.282] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FsWV1eA3OkafmtB.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sWV1eA3OkafmtB.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WV1eA3OkafmtB.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V1eA3OkafmtB.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1eA3OkafmtB.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eA3OkafmtB.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A3OkafmtB.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3OkafmtB.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OkafmtB.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kafmtB.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afmtB.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fmtB.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mtB.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tB.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.282] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.282] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0089.282] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.282] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.282] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.282] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.283] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.283] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0089.283] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.283] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.287] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.287] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.287] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.287] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/FsWV1eA3OkafmtB.xlsx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cd28 [0089.288] FindClose (in: hFindFile=0xa7cd28 | out: hFindFile=0xa7cd28) returned 1 [0089.288] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.288] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.288] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.288] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.288] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.288] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.288] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.288] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.288] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.288] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.288] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.288] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.288] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.288] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0089.289] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.289] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.289] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0089.289] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.289] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0089.289] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.289] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.289] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.289] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.289] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.289] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.289] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0089.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0089.289] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.289] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.289] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.289] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.290] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.290] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.290] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0089.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0089.290] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0089.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0089.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac98, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0089.290] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0089.290] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0089.291] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.291] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.291] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0089.291] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.291] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0089.291] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.291] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.291] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.291] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.292] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.292] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.292] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.292] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.292] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.292] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.292] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.292] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.292] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.292] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.292] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.292] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.292] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0089.292] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.292] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0089.292] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.292] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.292] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.292] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.292] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.293] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.293] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.293] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.293] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.293] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.293] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.293] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.293] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.293] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.293] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.293] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.293] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.293] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.293] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.293] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.293] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.293] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.293] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.293] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.293] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.294] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.294] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.294] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.294] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.294] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.294] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.294] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.294] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.294] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.294] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.294] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.294] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.294] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.294] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0089.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0089.295] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0089.295] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0089.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0089.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0089.295] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0089.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0089.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0089.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.295] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.295] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.295] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.295] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.295] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.296] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0089.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b8c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0089.296] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0089.296] CryptHashData (hHash=0xa7cd28, pbData=0x3983cf0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0089.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.296] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.296] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.296] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.296] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.296] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.296] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.296] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.296] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.296] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.296] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.297] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0089.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b698, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0089.297] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0089.297] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cd28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cda8) returned 1 [0089.297] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.297] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.297] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.297] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.297] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.298] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.298] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.298] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.298] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.298] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.298] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.298] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0089.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a9f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0089.298] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0089.298] CryptDestroyHash (hHash=0xa7cd28) returned 1 [0089.298] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.298] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.301] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.301] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.302] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.302] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/FsWV1eA3OkafmtB.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fswv1ea3okafmtb.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0089.303] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.303] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0089.303] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.303] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.303] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.303] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0089.303] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.FsWV1eA3OkafmtB.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.fswv1ea3okafmtb.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0089.304] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.304] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.304] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.304] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.307] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0089.307] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0xfe72, lpOverlapped=0x0) returned 1 [0089.310] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0089.313] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.316] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.316] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.317] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0089.317] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.317] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0089.317] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.317] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.317] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.317] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.317] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.318] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.318] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.318] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.318] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.318] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.318] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.318] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.318] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.318] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.318] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.318] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.318] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.318] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.318] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.318] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.318] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.318] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.318] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.318] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.319] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.319] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.319] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.319] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.319] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.319] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.319] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.319] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.319] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.319] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.319] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.320] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0089.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0089.321] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0089.321] CryptEncrypt (in: hKey=0xa7cda8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xfe72, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xfe78) returned 1 [0089.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.321] CharLowerBuffW (in: lpsz="byte[65144]", cchLength=0xb | out: lpsz="byte[65144]") returned 0xb [0089.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.323] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.324] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.324] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.324] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.324] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.324] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.325] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0089.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0089.325] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0089.325] CryptEncrypt (in: hKey=0xa7cda8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c2e008*, pdwDataLen=0x8bef60*=0xfe72, dwBufLen=0xfe78 | out: pbData=0x3c2e008*, pdwDataLen=0x8bef60*=0xfe78) returned 1 [0089.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.329] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.329] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.329] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.329] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.329] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.329] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.329] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.329] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.329] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.329] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.329] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.329] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.329] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.335] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.335] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.335] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.335] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.335] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.335] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.335] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.335] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.335] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.335] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.341] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.341] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.341] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.342] WriteFile (in: hFile=0x240, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0xfe78, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0xfe78, lpOverlapped=0x0) returned 1 [0089.344] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.344] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.344] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0089.344] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.345] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0089.345] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.345] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.345] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.345] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.345] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.345] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.345] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.345] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0089.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a7f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0089.345] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0089.345] CryptDestroyKey (hKey=0xa7cda8) returned 1 [0089.349] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.349] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.349] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.349] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.349] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.349] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.350] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.350] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.350] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.350] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.350] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.350] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.350] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.350] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.350] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.350] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.350] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.350] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.350] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.350] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.350] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.350] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.350] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.351] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.376] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.377] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.377] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.377] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.377] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.377] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.377] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.377] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.377] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.377] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.377] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.377] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.377] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.377] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.377] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.377] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.377] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.377] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.377] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.378] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.378] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.378] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.378] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.378] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.378] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.378] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.378] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.378] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.378] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0089.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ab38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0089.378] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0089.378] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0089.379] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.379] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.379] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.379] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.379] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.379] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.379] FreeLibrary (hLibModule=0x76a10000) returned 1 [0089.379] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.379] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.379] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.379] CloseHandle (hObject=0x24c) returned 1 [0089.380] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.380] CloseHandle (hObject=0x240) returned 1 [0089.384] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.385] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.385] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.385] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.386] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/FsWV1eA3OkafmtB.xlsx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FsWV1eA3OkafmtB.xlsx", lpFilePart=0x8bedf4*="FsWV1eA3OkafmtB.xlsx") returned 0x34 [0089.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FsWV1eA3OkafmtB.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fswv1ea3okafmtb.xlsx")) returned 0x20 [0089.386] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FsWV1eA3OkafmtB.xlsx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d068 [0089.386] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FsWV1eA3OkafmtB.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fswv1ea3okafmtb.xlsx")) returned 1 [0089.511] FindNextFileW (in: hFindFile=0xa7d068, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0089.511] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0089.511] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.512] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.512] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.512] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/FsWV1eA3OkafmtB.xlsx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FsWV1eA3OkafmtB.xlsx", lpFilePart=0x8bf650*="FsWV1eA3OkafmtB.xlsx") returned 0x34 [0089.512] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FsWV1eA3OkafmtB.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fswv1ea3okafmtb.xlsx")) returned 0xffffffff [0089.512] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.512] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.512] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G-L JfK4PzqcH7ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-L JfK4PzqcH7ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L JfK4PzqcH7ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" JfK4PzqcH7ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JfK4PzqcH7ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fK4PzqcH7ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K4PzqcH7ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4PzqcH7ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PzqcH7ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zqcH7ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qcH7ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cH7ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H7ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ER.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R.csv", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.513] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G-L JfK4PzqcH7ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-L JfK4PzqcH7ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L JfK4PzqcH7ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" JfK4PzqcH7ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JfK4PzqcH7ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fK4PzqcH7ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K4PzqcH7ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4PzqcH7ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PzqcH7ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zqcH7ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qcH7ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cH7ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H7ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ER.csv", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.513] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.513] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0089.513] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.513] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.513] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.513] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.513] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.513] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0089.514] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.514] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.514] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.514] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.514] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.514] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/G-L JfK4PzqcH7ER.csv", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cc28 [0089.514] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0089.514] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.514] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.514] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.514] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.514] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.515] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.515] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.515] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.515] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.515] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.515] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.515] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.515] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.515] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0089.515] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.515] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.515] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0089.515] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.515] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0089.516] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.516] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.516] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.516] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.516] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.516] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.516] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0089.516] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0089.516] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.516] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.516] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.516] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.516] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.516] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.516] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0089.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0089.517] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0089.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0089.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7acb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0089.517] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0089.517] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0089.518] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.518] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.518] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0089.518] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.518] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0089.518] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.518] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.518] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.518] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.518] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.518] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.518] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.518] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.518] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.519] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.519] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.519] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.519] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.519] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.519] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.519] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.519] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0089.519] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.520] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0089.520] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.520] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.520] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.520] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.520] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.520] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.520] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.520] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.520] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.520] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.520] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.520] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.520] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.520] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.521] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.521] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.521] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.521] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.521] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.521] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.521] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.521] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.521] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.521] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.521] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.521] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.678] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 1 [0089.678] TranslateMessage (lpMsg=0x8bf3b8) returned 0 [0089.679] DispatchMessageW (lpMsg=0x8bf3b8) returned 0x0 [0089.679] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0089.679] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0089.679] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.679] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.679] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.679] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.679] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.679] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.679] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.679] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.679] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.679] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.679] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.679] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.679] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0089.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8af90, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0089.680] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0089.680] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0089.680] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.680] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.680] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.680] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0089.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e10, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0089.680] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0089.680] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0089.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d30, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0089.680] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.680] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.680] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.680] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.681] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.681] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.681] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0089.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b8c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0089.681] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0089.681] CryptHashData (hHash=0xa7cb68, pbData=0x3983eb0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0089.681] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.681] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.681] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.681] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.681] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.681] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.681] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.682] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.682] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.682] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.682] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.682] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.682] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.682] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0089.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b698, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0089.682] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0089.682] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cb68, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cd28) returned 1 [0089.683] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.683] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.683] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.683] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.683] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.683] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.683] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.683] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.683] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.683] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.683] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.683] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0089.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7acb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0089.684] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0089.684] CryptDestroyHash (hHash=0xa7cb68) returned 1 [0089.684] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.684] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.684] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.684] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.684] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.685] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/G-L JfK4PzqcH7ER.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g-l jfk4pzqch7er.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0089.685] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.685] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0089.685] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.685] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.686] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.686] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0089.686] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.G-L JfK4PzqcH7ER.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.g-l jfk4pzqch7er.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0089.686] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.687] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.687] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.687] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.689] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0089.689] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x66a2, lpOverlapped=0x0) returned 1 [0089.693] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0089.696] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.696] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.696] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.696] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0089.697] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.697] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0089.697] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.697] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.697] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.697] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.697] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.697] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.697] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.697] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.697] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.697] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.697] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.697] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.697] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.697] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.698] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.698] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.698] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.698] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.698] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.698] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.698] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.698] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.698] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.698] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.698] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.698] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.698] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.698] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.698] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.698] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.698] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.699] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.699] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.699] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.699] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.699] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0089.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0089.700] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0089.700] CryptEncrypt (in: hKey=0xa7cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x66a2, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x66a8) returned 1 [0089.700] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.700] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.700] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.700] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.700] CharLowerBuffW (in: lpsz="byte[26280]", cchLength=0xb | out: lpsz="byte[26280]") returned 0xb [0089.700] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.701] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.701] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.701] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.701] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.701] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.701] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.701] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0089.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0089.702] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0089.702] CryptEncrypt (in: hKey=0xa7cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cc8438*, pdwDataLen=0x8bef60*=0x66a2, dwBufLen=0x66a8 | out: pbData=0x2cc8438*, pdwDataLen=0x8bef60*=0x66a8) returned 1 [0089.703] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.703] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.703] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.703] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.703] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.703] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.703] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.703] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.703] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.703] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.704] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.704] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.704] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.704] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.704] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.704] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.704] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.704] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.704] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.704] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.704] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.704] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.704] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.705] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.705] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.705] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.705] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.706] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.706] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.706] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.706] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0x66a8, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0x66a8, lpOverlapped=0x0) returned 1 [0089.708] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.708] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.708] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0089.708] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.708] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0089.708] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.708] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.708] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.708] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.708] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.708] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.708] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.708] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0089.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a7f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0089.709] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0089.709] CryptDestroyKey (hKey=0xa7cd28) returned 1 [0089.709] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.709] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.709] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.709] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.709] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.709] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.709] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.709] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.709] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.709] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.709] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.709] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.710] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.710] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.710] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.710] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.710] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.710] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.710] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.710] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.710] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.710] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.710] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.710] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.710] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.710] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.710] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.711] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.711] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.711] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.711] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.711] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.711] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.711] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.711] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.711] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.711] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.711] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.711] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.711] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.711] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.711] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.711] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.711] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.711] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.712] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.712] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.712] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.712] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.712] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.712] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.712] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.712] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0089.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ab98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0089.712] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0089.712] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0089.712] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.713] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.713] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.713] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.713] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.713] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.713] FreeLibrary (hLibModule=0x76a10000) returned 1 [0089.713] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.713] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.713] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.713] CloseHandle (hObject=0x240) returned 1 [0089.714] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.714] CloseHandle (hObject=0x24c) returned 1 [0089.765] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.766] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.767] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.767] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.767] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/G-L JfK4PzqcH7ER.csv", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\G-L JfK4PzqcH7ER.csv", lpFilePart=0x8bedf4*="G-L JfK4PzqcH7ER.csv") returned 0x34 [0089.767] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\G-L JfK4PzqcH7ER.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g-l jfk4pzqch7er.csv")) returned 0x20 [0089.767] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\G-L JfK4PzqcH7ER.csv", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cd28 [0089.768] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\G-L JfK4PzqcH7ER.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g-l jfk4pzqch7er.csv")) returned 1 [0089.786] FindNextFileW (in: hFindFile=0xa7cd28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0089.786] FindClose (in: hFindFile=0xa7cd28 | out: hFindFile=0xa7cd28) returned 1 [0089.790] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.790] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.790] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.790] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/G-L JfK4PzqcH7ER.csv", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\G-L JfK4PzqcH7ER.csv", lpFilePart=0x8bf650*="G-L JfK4PzqcH7ER.csv") returned 0x34 [0089.790] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\G-L JfK4PzqcH7ER.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g-l jfk4pzqch7er.csv")) returned 0xffffffff [0089.791] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.791] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.791] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ihhj7L6.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hhj7L6.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hj7L6.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j7L6.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7L6.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L6.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.791] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ihhj7L6.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hhj7L6.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hj7L6.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j7L6.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7L6.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L6.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.791] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.792] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0089.792] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.792] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.792] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.792] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.792] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.792] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0089.792] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.792] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.792] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.792] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.792] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.792] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Ihhj7L6.docx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cee8 [0089.793] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0089.793] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.793] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.793] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.793] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.793] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.793] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.793] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.793] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.793] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.793] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.794] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.794] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.794] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.794] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0089.794] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.794] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.794] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0089.794] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.794] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0089.794] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.794] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.794] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.795] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.795] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.795] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.795] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0089.795] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0089.795] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.795] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.795] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.795] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.795] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.795] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.795] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0089.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0089.796] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0089.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0089.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aad8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0089.796] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0089.796] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0089.797] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.822] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.822] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0089.822] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.822] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0089.822] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.822] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.822] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.822] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.822] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.822] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.822] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.822] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.822] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.823] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.823] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.823] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.823] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.823] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.823] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.823] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.823] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0089.823] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.823] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0089.823] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.823] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.823] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.823] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.823] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.823] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.823] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.823] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.824] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.824] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.824] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.824] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.824] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.824] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.824] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.824] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.824] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.824] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.824] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.824] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.824] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.824] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.824] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.824] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.824] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.825] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.825] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.825] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.825] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.825] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.825] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.825] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.825] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.825] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.825] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.825] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.825] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.825] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.825] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0089.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8afc0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0089.826] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0089.826] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0089.826] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.826] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.826] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.826] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0089.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e70, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0089.826] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0089.826] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0089.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983dc0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0089.827] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.827] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.827] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.827] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.827] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.827] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.827] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0089.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b6e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0089.827] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0089.827] CryptHashData (hHash=0xa7cda8, pbData=0x3983ed0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0089.827] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.828] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.828] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.828] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.828] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.828] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.828] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.828] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.828] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.828] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.828] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.828] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.828] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.828] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0089.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b848, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0089.828] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0089.829] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cda8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cc28) returned 1 [0089.829] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.829] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.830] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.830] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.830] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.830] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.830] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.830] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.830] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.830] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.830] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.830] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0089.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0089.830] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0089.830] CryptDestroyHash (hHash=0xa7cda8) returned 1 [0089.831] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.831] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.831] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.831] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.831] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.831] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Ihhj7L6.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ihhj7l6.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0089.831] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.831] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0089.831] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.831] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.831] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.831] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0089.832] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.Ihhj7L6.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.ihhj7l6.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0089.832] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.832] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.832] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.832] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.835] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0089.835] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x90ec, lpOverlapped=0x0) returned 1 [0089.837] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0089.840] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.840] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.840] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.840] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0089.841] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.841] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0089.841] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.841] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.841] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.841] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.841] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.841] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.841] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.841] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.841] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.841] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.841] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.842] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.842] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.842] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.842] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.842] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.857] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.857] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.857] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.857] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.857] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.857] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.857] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.857] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.857] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.857] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.858] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.858] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.858] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.858] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.858] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.858] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.858] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.858] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.858] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0089.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8acf0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0089.859] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0089.859] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x90ec, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x90f0) returned 1 [0089.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.859] CharLowerBuffW (in: lpsz="byte[37104]", cchLength=0xb | out: lpsz="byte[37104]") returned 0xb [0089.859] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.863] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.863] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.863] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.863] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.863] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.863] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.864] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0089.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8af30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0089.864] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0089.864] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cd0310*, pdwDataLen=0x8bef60*=0x90ec, dwBufLen=0x90f0 | out: pbData=0x2cd0310*, pdwDataLen=0x8bef60*=0x90f0) returned 1 [0089.866] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.866] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.866] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.866] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.867] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.867] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.867] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.867] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.867] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.868] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.868] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.868] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.868] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.868] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.868] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.868] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.868] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.868] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.868] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.868] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.868] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.868] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.868] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.868] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.868] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.868] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.868] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.872] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.872] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.872] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.873] WriteFile (in: hFile=0x240, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0x90f0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0x90f0, lpOverlapped=0x0) returned 1 [0089.875] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.875] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.875] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0089.875] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.875] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0089.875] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.875] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.875] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.875] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.875] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.876] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.876] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.876] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0089.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a7f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0089.876] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0089.877] CryptDestroyKey (hKey=0xa7cc28) returned 1 [0089.877] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.877] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.877] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.877] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.877] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.877] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.877] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.877] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.877] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.877] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.877] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.877] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.877] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.877] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.877] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.877] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.878] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.878] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.878] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0089.878] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.878] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.878] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.878] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.878] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.878] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.878] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.878] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.878] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.878] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.878] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.878] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.878] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.878] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.878] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.879] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.879] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.879] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.879] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.879] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.879] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.879] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.879] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.879] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.879] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.879] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.879] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.879] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.879] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.879] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.879] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.879] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.879] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.879] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0089.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a9b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0089.880] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0089.880] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0089.880] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.880] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.880] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.880] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.880] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.880] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0089.880] FreeLibrary (hLibModule=0x76a10000) returned 1 [0089.880] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.880] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.880] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.880] CloseHandle (hObject=0x24c) returned 1 [0089.882] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.890] CloseHandle (hObject=0x240) returned 1 [0089.896] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.897] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.897] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.897] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.897] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Ihhj7L6.docx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Ihhj7L6.docx", lpFilePart=0x8bedf4*="Ihhj7L6.docx") returned 0x2c [0089.897] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Ihhj7L6.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ihhj7l6.docx")) returned 0x20 [0089.897] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Ihhj7L6.docx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d0e8 [0089.898] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Ihhj7L6.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ihhj7l6.docx")) returned 1 [0089.910] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0089.911] FindClose (in: hFindFile=0xa7d0e8 | out: hFindFile=0xa7d0e8) returned 1 [0089.911] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.911] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.911] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.911] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Ihhj7L6.docx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Ihhj7L6.docx", lpFilePart=0x8bf650*="Ihhj7L6.docx") returned 0x2c [0089.911] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Ihhj7L6.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ihhj7l6.docx")) returned 0xffffffff [0089.911] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.912] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.912] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IRevt7-Vo2dY1p.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Revt7-Vo2dY1p.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="evt7-Vo2dY1p.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vt7-Vo2dY1p.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t7-Vo2dY1p.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7-Vo2dY1p.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Vo2dY1p.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vo2dY1p.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o2dY1p.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2dY1p.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dY1p.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y1p.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1p.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0089.912] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IRevt7-Vo2dY1p.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Revt7-Vo2dY1p.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="evt7-Vo2dY1p.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vt7-Vo2dY1p.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t7-Vo2dY1p.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7-Vo2dY1p.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Vo2dY1p.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vo2dY1p.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o2dY1p.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2dY1p.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dY1p.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y1p.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1p.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0089.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0089.913] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0089.913] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0089.913] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.913] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.913] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0089.913] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0089.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.913] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0089.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.914] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.914] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.914] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.914] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.914] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/IRevt7-Vo2dY1p.docx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cda8 [0089.914] FindClose (in: hFindFile=0xa7cda8 | out: hFindFile=0xa7cda8) returned 1 [0089.914] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.915] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.915] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.915] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.915] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.915] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.915] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.915] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.915] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.915] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.915] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.915] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0089.915] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.915] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0089.916] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.916] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.916] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0089.916] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.916] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0089.916] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.916] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.916] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.916] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.916] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.916] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.916] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0089.917] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0089.917] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.917] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.917] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.917] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.917] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.917] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0089.917] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0089.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7acd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0089.918] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0089.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0089.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0089.918] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0089.918] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0089.919] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.919] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.919] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0089.919] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.919] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0089.919] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.919] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.919] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.920] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.920] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.920] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.920] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.920] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.920] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.920] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.920] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.920] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0089.920] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0089.920] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.920] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.920] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.920] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0089.920] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.921] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0089.921] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.921] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.921] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.921] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.921] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.921] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.921] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.921] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.921] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.921] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.921] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.921] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.921] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.922] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.922] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.922] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.922] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.922] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.922] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.922] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.922] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.922] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.922] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.922] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.922] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.922] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.922] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.923] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.923] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.923] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.923] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.923] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.923] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.923] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.923] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.923] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.923] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.923] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.923] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0089.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad38, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0089.924] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0089.924] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0089.924] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.924] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.924] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.924] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0089.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983de0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0089.924] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0089.924] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0089.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983de0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0089.925] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.925] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.925] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.925] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.926] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.926] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.926] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0089.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b8c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0089.926] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0089.926] CryptHashData (hHash=0xa7c9a8, pbData=0x3983ec0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0089.926] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.926] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.926] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.926] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.927] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.927] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.927] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.927] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.927] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0089.927] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.927] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0089.927] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.927] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.937] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0089.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b710, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0089.937] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0089.938] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7c9a8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cf28) returned 1 [0089.938] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.938] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.938] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.938] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.938] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.938] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.938] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.938] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.938] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.939] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.939] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0089.939] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0089.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0089.939] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0089.939] CryptDestroyHash (hHash=0xa7c9a8) returned 1 [0089.939] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.939] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.939] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.939] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.940] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.941] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/IRevt7-Vo2dY1p.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\irevt7-vo2dy1p.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0089.941] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.941] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0089.941] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.941] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.941] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.941] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0089.942] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.IRevt7-Vo2dY1p.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.irevt7-vo2dy1p.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0089.942] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.943] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.943] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.943] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.946] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0089.946] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0089.949] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x742f, lpOverlapped=0x0) returned 1 [0089.950] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0089.956] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.956] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.956] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.956] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0089.957] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.957] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0089.957] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.957] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.957] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.957] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.957] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.957] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.957] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.957] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0089.957] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.957] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0089.957] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.957] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.957] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.958] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.958] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.958] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.958] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.958] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.958] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.958] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0089.958] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.958] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0089.958] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.958] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.958] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.958] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.958] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.958] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.958] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.959] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.959] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.959] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.959] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.959] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.959] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.960] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0089.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0089.960] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0089.961] CryptEncrypt (in: hKey=0xa7cf28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x1742f, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x17430) returned 1 [0089.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.961] CharLowerBuffW (in: lpsz="byte[95280]", cchLength=0xb | out: lpsz="byte[95280]") returned 0xb [0089.961] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.966] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.966] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.966] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.966] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.966] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.966] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0089.968] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0089.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8adb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0089.968] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0089.968] CryptEncrypt (in: hKey=0xa7cf28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c45440*, pdwDataLen=0x8bef60*=0x1742f, dwBufLen=0x17430 | out: pbData=0x3c45440*, pdwDataLen=0x8bef60*=0x17430) returned 1 [0089.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.980] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.980] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.980] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.980] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.980] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.980] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.980] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.980] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.980] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.980] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.981] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.981] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.981] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.981] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0089.981] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.981] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0089.981] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.981] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0089.981] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.981] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0089.981] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.981] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0089.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0089.990] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.991] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.991] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.992] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0x17430, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0x17430, lpOverlapped=0x0) returned 1 [0089.995] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.995] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0089.995] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0089.995] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.995] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0089.995] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.995] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.995] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0089.995] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.996] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0089.996] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.996] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0089.996] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0089.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0089.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a918, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0089.996] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0089.996] CryptDestroyKey (hKey=0xa7cf28) returned 1 [0089.996] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.996] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0089.997] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0089.997] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.997] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0089.997] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.997] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0089.997] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0089.997] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0089.997] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0089.997] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.005] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.005] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.005] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.005] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.005] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.006] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.006] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.006] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.006] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.006] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.006] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.006] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.006] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.006] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.006] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.006] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.006] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.006] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.006] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.006] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.006] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.007] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.007] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.007] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.007] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.007] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.007] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.007] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.007] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.007] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.007] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.007] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.007] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.007] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.007] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.008] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.008] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.008] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.008] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.008] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.008] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.008] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0090.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7acd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0090.008] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0090.009] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0090.009] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.009] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.009] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.009] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.009] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.009] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.009] FreeLibrary (hLibModule=0x76a10000) returned 1 [0090.009] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.009] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.009] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.009] CloseHandle (hObject=0x240) returned 1 [0090.013] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.013] CloseHandle (hObject=0x24c) returned 1 [0090.022] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.024] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.024] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.024] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.024] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/IRevt7-Vo2dY1p.docx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\IRevt7-Vo2dY1p.docx", lpFilePart=0x8bedf4*="IRevt7-Vo2dY1p.docx") returned 0x33 [0090.025] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\IRevt7-Vo2dY1p.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\irevt7-vo2dy1p.docx")) returned 0x20 [0090.025] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\IRevt7-Vo2dY1p.docx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cc28 [0090.025] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\IRevt7-Vo2dY1p.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\irevt7-vo2dy1p.docx")) returned 1 [0090.058] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0090.058] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0090.058] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.059] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.059] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.059] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/IRevt7-Vo2dY1p.docx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\IRevt7-Vo2dY1p.docx", lpFilePart=0x8bf650*="IRevt7-Vo2dY1p.docx") returned 0x33 [0090.059] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\IRevt7-Vo2dY1p.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\irevt7-vo2dy1p.docx")) returned 0xffffffff [0090.059] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.059] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.059] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.059] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jg83kL7EHzk5tOx.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.059] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g83kL7EHzk5tOx.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.059] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="83kL7EHzk5tOx.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.059] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3kL7EHzk5tOx.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.059] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kL7EHzk5tOx.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.059] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L7EHzk5tOx.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.059] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7EHzk5tOx.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.059] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EHzk5tOx.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.059] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Hzk5tOx.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.059] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zk5tOx.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.059] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k5tOx.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.059] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5tOx.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tOx.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ox.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.060] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jg83kL7EHzk5tOx.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g83kL7EHzk5tOx.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="83kL7EHzk5tOx.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3kL7EHzk5tOx.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kL7EHzk5tOx.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L7EHzk5tOx.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7EHzk5tOx.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EHzk5tOx.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Hzk5tOx.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zk5tOx.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k5tOx.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5tOx.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tOx.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ox.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.060] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.060] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.060] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0090.061] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.061] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.061] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.061] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.061] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.061] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0090.061] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.061] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.061] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.061] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.061] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.061] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/jg83kL7EHzk5tOx.pptx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d068 [0090.062] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0090.062] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.062] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.062] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.062] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.062] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.062] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.062] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.062] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.062] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.062] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.063] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.063] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.063] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.063] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0090.063] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.063] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.063] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0090.063] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.063] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0090.063] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.063] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.064] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.064] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0090.064] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0090.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.064] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.064] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.064] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.064] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.064] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.064] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0090.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aaf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0090.065] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0090.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0090.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0090.066] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0090.066] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0090.066] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.067] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.067] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0090.067] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.067] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0090.067] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.067] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.067] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.067] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.067] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.067] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.067] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.067] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.067] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.067] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.067] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.068] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.068] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.068] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.068] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.068] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.068] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0090.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.068] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0090.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.068] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.068] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.069] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.069] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.069] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.085] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.086] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.086] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.086] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.086] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.086] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.086] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.086] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.086] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.086] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.086] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.086] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.086] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.086] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.087] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.087] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.087] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.087] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.087] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.087] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.087] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.087] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.087] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.087] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.087] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.087] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.087] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.087] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0090.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad68, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0090.088] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0090.088] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0090.088] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.088] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.088] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.088] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0090.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0090.088] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0090.089] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0090.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983db0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0090.089] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.089] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.089] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.089] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.089] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.089] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.089] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0090.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b758, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0090.090] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0090.090] CryptHashData (hHash=0xa7c9e8, pbData=0x3983e10, dwDataLen=0x3, dwFlags=0x1) returned 1 [0090.090] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.090] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.090] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.090] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.090] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.090] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.090] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.090] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.090] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.090] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.090] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.090] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.091] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.091] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0090.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b710, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0090.091] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0090.091] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7c9e8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cd28) returned 1 [0090.091] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.091] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.091] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.091] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.092] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.092] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.092] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.092] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.092] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.092] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.092] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0090.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0090.093] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0090.093] CryptDestroyHash (hHash=0xa7c9e8) returned 1 [0090.093] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.093] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.093] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.093] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.093] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.095] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/jg83kL7EHzk5tOx.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jg83kl7ehzk5tox.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0090.095] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.095] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0090.095] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.096] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.096] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.096] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0090.096] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.jg83kL7EHzk5tOx.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.jg83kl7ehzk5tox.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0090.097] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.097] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.097] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.097] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.100] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0090.100] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0090.103] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x5abd, lpOverlapped=0x0) returned 1 [0090.104] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0090.111] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.111] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.111] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.111] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0090.113] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.114] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0090.114] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.114] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.114] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.114] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.114] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.114] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.114] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.114] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.114] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.114] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.115] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.115] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.115] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.115] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.115] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.115] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.115] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.115] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.115] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.115] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.115] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.115] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.116] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.116] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.116] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.116] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.116] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.116] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.116] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.116] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.116] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.116] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.116] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.116] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.117] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.119] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0090.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0090.120] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0090.120] CryptEncrypt (in: hKey=0xa7cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x15abd, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x15ac0) returned 1 [0090.120] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.120] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.120] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.120] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.120] CharLowerBuffW (in: lpsz="byte[88768]", cchLength=0xb | out: lpsz="byte[88768]") returned 0xb [0090.122] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.125] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.125] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.125] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.125] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.159] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.159] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.161] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0090.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0090.161] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0090.161] CryptEncrypt (in: hKey=0xa7cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c43ad0*, pdwDataLen=0x8bef60*=0x15abd, dwBufLen=0x15ac0 | out: pbData=0x3c43ad0*, pdwDataLen=0x8bef60*=0x15ac0) returned 1 [0090.165] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.165] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.208] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.208] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.211] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.211] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.211] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.211] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.211] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.211] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.211] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.211] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.212] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.212] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.212] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.212] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.212] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.212] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.212] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.212] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.212] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.212] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.212] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.212] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.212] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.212] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.212] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.223] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.223] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.223] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.224] WriteFile (in: hFile=0x240, lpBuffer=0x2ccaaf0*, nNumberOfBytesToWrite=0x15ac0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2ccaaf0*, lpNumberOfBytesWritten=0x8bf5e4*=0x15ac0, lpOverlapped=0x0) returned 1 [0090.226] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.226] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.226] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0090.227] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.227] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0090.227] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.227] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.227] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.227] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.227] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.227] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.227] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.227] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0090.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a798, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0090.227] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0090.227] CryptDestroyKey (hKey=0xa7cd28) returned 1 [0090.228] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.228] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.228] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.228] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.228] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.228] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.228] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.228] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.228] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.228] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.228] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.228] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.228] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.228] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.228] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.228] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.229] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.229] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.229] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.229] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.229] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.229] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.229] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.229] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.229] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.229] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.229] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.229] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.229] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.229] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.229] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.229] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.229] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.230] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.230] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.230] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.230] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.230] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.230] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.230] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.230] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.230] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.230] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.230] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.230] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.230] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.230] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.230] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.230] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.231] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.231] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.231] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.231] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0090.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0090.231] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0090.231] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0090.231] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.231] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.231] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.231] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.232] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.232] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.232] FreeLibrary (hLibModule=0x76a10000) returned 1 [0090.232] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.232] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.232] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.232] CloseHandle (hObject=0x24c) returned 1 [0090.234] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.234] CloseHandle (hObject=0x240) returned 1 [0090.246] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.249] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.249] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.249] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.249] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/jg83kL7EHzk5tOx.pptx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jg83kL7EHzk5tOx.pptx", lpFilePart=0x8bedf4*="jg83kL7EHzk5tOx.pptx") returned 0x34 [0090.249] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jg83kL7EHzk5tOx.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jg83kl7ehzk5tox.pptx")) returned 0x20 [0090.249] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jg83kL7EHzk5tOx.pptx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7ce28 [0090.250] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jg83kL7EHzk5tOx.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jg83kl7ehzk5tox.pptx")) returned 1 [0090.268] FindNextFileW (in: hFindFile=0xa7ce28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0090.268] FindClose (in: hFindFile=0xa7ce28 | out: hFindFile=0xa7ce28) returned 1 [0090.268] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.269] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.269] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.269] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/jg83kL7EHzk5tOx.pptx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jg83kL7EHzk5tOx.pptx", lpFilePart=0x8bf650*="jg83kL7EHzk5tOx.pptx") returned 0x34 [0090.269] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jg83kL7EHzk5tOx.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jg83kl7ehzk5tox.pptx")) returned 0xffffffff [0090.269] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.269] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.269] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KwL8B1f2HAeXB.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wL8B1f2HAeXB.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8B1f2HAeXB.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8B1f2HAeXB.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B1f2HAeXB.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1f2HAeXB.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f2HAeXB.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2HAeXB.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HAeXB.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AeXB.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eXB.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XB.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B.ots", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.270] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KwL8B1f2HAeXB.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wL8B1f2HAeXB.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8B1f2HAeXB.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8B1f2HAeXB.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B1f2HAeXB.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1f2HAeXB.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f2HAeXB.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2HAeXB.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HAeXB.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AeXB.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eXB.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XB.ots", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.270] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.270] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0090.270] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.270] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.270] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.271] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.271] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.271] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0090.271] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.271] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.271] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.271] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.271] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.271] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/KwL8B1f2HAeXB.ots", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d128 [0090.271] FindClose (in: hFindFile=0xa7d128 | out: hFindFile=0xa7d128) returned 1 [0090.271] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.272] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.272] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.272] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.272] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.272] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.272] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.272] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.272] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.272] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.272] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.272] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.272] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.272] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0090.273] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.273] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.273] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0090.273] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.286] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0090.286] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.286] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.286] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.287] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.287] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.287] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.287] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0090.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0090.287] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.287] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.287] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.287] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.287] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.287] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.287] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0090.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0090.288] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0090.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0090.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aab8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0090.288] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0090.288] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0090.289] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.289] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.289] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0090.289] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.289] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0090.289] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.289] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.289] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.290] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.290] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.290] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.290] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.290] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.290] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.290] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.290] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.290] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.290] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.290] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.290] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.290] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.290] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0090.290] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.291] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0090.291] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.291] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.291] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.291] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.291] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.291] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.291] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.291] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.291] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.291] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.291] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.291] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.291] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.291] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.292] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.292] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.292] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.292] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.292] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.292] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.292] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.292] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.292] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.292] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.292] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.292] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.292] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.292] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.292] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.292] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.292] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.293] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.293] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.293] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.293] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.293] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.293] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.293] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.293] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0090.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8afc0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0090.293] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0090.293] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0090.293] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.294] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.294] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.294] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0090.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e80, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0090.294] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0090.294] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0090.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e30, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0090.294] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.294] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.294] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.294] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.294] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.294] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.294] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0090.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b668, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0090.295] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0090.295] CryptHashData (hHash=0xa7caa8, pbData=0x3983d40, dwDataLen=0x3, dwFlags=0x1) returned 1 [0090.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.295] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.295] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.295] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.295] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.295] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.295] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.295] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.295] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.296] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.296] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.296] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.296] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0090.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b8c0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0090.296] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0090.296] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7caa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7c9a8) returned 1 [0090.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.296] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.296] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.297] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.297] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.297] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.297] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.297] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0090.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a9b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0090.297] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0090.297] CryptDestroyHash (hHash=0xa7caa8) returned 1 [0090.297] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.297] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.298] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.298] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.298] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.298] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/KwL8B1f2HAeXB.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\kwl8b1f2haexb.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0090.298] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.298] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0090.298] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.298] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.299] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.299] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0090.299] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.KwL8B1f2HAeXB.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.kwl8b1f2haexb.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0090.299] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.299] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.299] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.300] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.302] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0090.302] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0090.304] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x6d85, lpOverlapped=0x0) returned 1 [0090.305] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0090.309] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.310] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.310] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.310] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0090.312] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.312] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0090.312] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.317] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.317] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.317] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.317] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.317] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.317] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.317] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.317] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.317] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.317] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.317] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.317] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.317] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.318] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.318] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.318] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.318] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.318] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.318] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.318] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.318] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.318] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.318] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.318] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.318] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.318] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.318] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.318] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.319] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.319] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.319] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.319] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.319] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.319] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.320] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0090.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0090.320] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0090.320] CryptEncrypt (in: hKey=0xa7c9a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x16d85, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x16d88) returned 1 [0090.320] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.320] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.320] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.320] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.321] CharLowerBuffW (in: lpsz="byte[93576]", cchLength=0xb | out: lpsz="byte[93576]") returned 0xb [0090.321] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.323] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.323] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.323] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.323] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.323] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.323] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.324] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0090.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8af48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0090.324] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0090.324] CryptEncrypt (in: hKey=0xa7c9a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c44d98*, pdwDataLen=0x8bef60*=0x16d85, dwBufLen=0x16d88 | out: pbData=0x3c44d98*, pdwDataLen=0x8bef60*=0x16d88) returned 1 [0090.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.328] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.328] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.328] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.328] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.329] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.329] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.329] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.329] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.329] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.329] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.329] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.329] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.332] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.332] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.332] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.332] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.332] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.332] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.332] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.332] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.332] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.341] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.341] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.341] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.342] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0x16d88, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0x16d88, lpOverlapped=0x0) returned 1 [0090.347] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.348] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.348] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0090.348] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.348] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0090.348] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.348] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.348] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.348] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.348] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.348] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.348] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.348] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0090.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a900, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0090.349] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0090.349] CryptDestroyKey (hKey=0xa7c9a8) returned 1 [0090.349] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.349] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.349] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.349] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.349] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.349] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.349] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.349] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.349] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.350] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.350] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.350] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.350] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.350] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.350] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.350] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.350] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.350] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.350] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.350] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.350] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.350] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.350] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.350] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.350] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.350] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.351] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.351] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.351] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.351] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.351] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.351] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.351] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.351] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.351] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.351] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.351] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.351] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.351] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.351] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.351] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.351] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.351] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.351] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.352] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.352] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.352] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.357] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.357] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.357] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.358] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.358] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.358] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0090.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ab38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0090.358] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0090.358] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0090.358] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.358] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.358] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.358] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.359] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.359] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.359] FreeLibrary (hLibModule=0x76a10000) returned 1 [0090.359] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.359] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.359] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.359] CloseHandle (hObject=0x240) returned 1 [0090.360] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.360] CloseHandle (hObject=0x24c) returned 1 [0090.365] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.367] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.367] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.367] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.367] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/KwL8B1f2HAeXB.ots", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\KwL8B1f2HAeXB.ots", lpFilePart=0x8bedf4*="KwL8B1f2HAeXB.ots") returned 0x31 [0090.367] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\KwL8B1f2HAeXB.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\kwl8b1f2haexb.ots")) returned 0x20 [0090.367] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\KwL8B1f2HAeXB.ots", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cee8 [0090.367] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\KwL8B1f2HAeXB.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\kwl8b1f2haexb.ots")) returned 1 [0090.380] FindNextFileW (in: hFindFile=0xa7cee8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0090.380] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0090.381] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.381] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.381] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.381] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/KwL8B1f2HAeXB.ots", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\KwL8B1f2HAeXB.ots", lpFilePart=0x8bf650*="KwL8B1f2HAeXB.ots") returned 0x31 [0090.381] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\KwL8B1f2HAeXB.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\kwl8b1f2haexb.ots")) returned 0xffffffff [0090.381] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.381] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.381] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lqoCl6y.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qoCl6y.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oCl6y.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cl6y.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l6y.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6y.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.382] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lqoCl6y.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qoCl6y.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oCl6y.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cl6y.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l6y.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6y.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.382] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.382] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0090.382] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.382] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.382] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.382] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.382] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.382] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0090.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.383] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/lqoCl6y.xlsx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d068 [0090.383] FindClose (in: hFindFile=0xa7d068 | out: hFindFile=0xa7d068) returned 1 [0090.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.383] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.383] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.383] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.383] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.383] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.384] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.384] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.384] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.384] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.384] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.384] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0090.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.384] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0090.384] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.384] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0090.384] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.384] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.385] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.385] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.385] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.385] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.385] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0090.385] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0090.385] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.385] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.385] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.385] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.385] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.385] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.385] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0090.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aab8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0090.386] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0090.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0090.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aaf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0090.386] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0090.386] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0090.387] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.387] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.387] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0090.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.387] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0090.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.387] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.387] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.387] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.387] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.387] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.387] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.388] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.388] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.388] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0090.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.388] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0090.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.388] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.389] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.389] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.389] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.389] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.389] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.389] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.389] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.389] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.389] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.389] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.389] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.389] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.389] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.389] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.389] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.389] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.390] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.390] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.390] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.390] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.390] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.390] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.390] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.390] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.390] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.390] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.390] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.390] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.390] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0090.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad80, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0090.391] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0090.391] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0090.391] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.391] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.392] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.392] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0090.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0090.392] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0090.392] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0090.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0090.392] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.392] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.392] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.395] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.395] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.395] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.395] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0090.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b758, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0090.396] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0090.396] CryptHashData (hHash=0xa7cd28, pbData=0x3983e50, dwDataLen=0x3, dwFlags=0x1) returned 1 [0090.396] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.396] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.396] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.396] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.396] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.396] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.396] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.396] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.396] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.396] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.396] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.396] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.396] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.397] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0090.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b668, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0090.397] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0090.397] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cd28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7ce28) returned 1 [0090.397] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.397] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.397] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.397] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.397] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.397] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.397] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.398] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.398] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.398] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.398] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.398] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0090.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ab98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0090.398] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0090.398] CryptDestroyHash (hHash=0xa7cd28) returned 1 [0090.398] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.398] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.398] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.398] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.398] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.399] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/lqoCl6y.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lqocl6y.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0090.400] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.400] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0090.400] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.400] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.400] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.400] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0090.400] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.lqoCl6y.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.lqocl6y.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0090.401] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.401] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.401] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.401] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.404] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0090.404] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0090.406] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0xf75, lpOverlapped=0x0) returned 1 [0090.407] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0090.411] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.412] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.412] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.412] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0090.414] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.414] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0090.414] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.414] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.414] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.414] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.414] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.415] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.415] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.415] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.415] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.415] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.415] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.415] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.415] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.415] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.415] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.415] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.415] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.415] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.415] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.415] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.415] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.415] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.416] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.416] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.416] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.416] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.416] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.416] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.416] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.416] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.416] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.416] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.418] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0090.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0090.419] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0090.419] CryptEncrypt (in: hKey=0xa7ce28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x10f75, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x10f78) returned 1 [0090.419] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.419] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.419] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.419] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.419] CharLowerBuffW (in: lpsz="byte[69496]", cchLength=0xb | out: lpsz="byte[69496]") returned 0xb [0090.419] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.421] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.421] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.421] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.421] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.421] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.421] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.422] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0090.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8acf0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0090.422] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0090.422] CryptEncrypt (in: hKey=0xa7ce28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c2e008*, pdwDataLen=0x8bef60*=0x10f75, dwBufLen=0x10f78 | out: pbData=0x3c2e008*, pdwDataLen=0x8bef60*=0x10f78) returned 1 [0090.426] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 1 [0090.426] TranslateMessage (lpMsg=0x8bf3b8) returned 0 [0090.426] DispatchMessageW (lpMsg=0x8bf3b8) returned 0x0 [0090.426] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0090.426] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0090.427] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.427] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.427] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.427] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.427] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.427] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.427] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.427] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.427] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.427] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.427] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.427] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.428] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.428] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.428] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.428] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.428] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.428] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.428] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.428] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.428] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.428] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.428] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.428] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.428] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.428] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.428] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.435] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.435] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.435] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.437] WriteFile (in: hFile=0x240, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0x10f78, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0x10f78, lpOverlapped=0x0) returned 1 [0090.461] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.461] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.461] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0090.461] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.461] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0090.461] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.461] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.461] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.461] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.461] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.461] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.461] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.461] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0090.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a918, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0090.462] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0090.462] CryptDestroyKey (hKey=0xa7ce28) returned 1 [0090.462] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.462] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.462] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.462] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.462] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.462] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.462] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.462] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.462] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.463] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.463] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.463] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.463] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.463] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.463] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.463] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.463] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.463] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.463] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.463] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.463] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.463] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.463] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.463] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.464] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.464] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.464] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.464] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.464] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.464] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.464] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.464] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.464] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.464] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.464] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.464] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.464] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.464] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.464] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.464] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.464] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.465] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.465] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.465] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.465] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.465] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.465] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.465] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.465] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.465] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.465] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.465] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.465] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0090.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7acd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0090.465] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0090.466] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0090.466] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.466] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.466] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.466] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.466] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.466] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.466] FreeLibrary (hLibModule=0x76a10000) returned 1 [0090.466] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.466] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.466] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.466] CloseHandle (hObject=0x24c) returned 1 [0090.468] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.468] CloseHandle (hObject=0x240) returned 1 [0090.477] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.479] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.479] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.479] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.479] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/lqoCl6y.xlsx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\lqoCl6y.xlsx", lpFilePart=0x8bedf4*="lqoCl6y.xlsx") returned 0x2c [0090.479] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\lqoCl6y.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lqocl6y.xlsx")) returned 0x20 [0090.480] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\lqoCl6y.xlsx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cda8 [0090.480] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\lqoCl6y.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lqocl6y.xlsx")) returned 1 [0090.500] FindNextFileW (in: hFindFile=0xa7cda8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0090.500] FindClose (in: hFindFile=0xa7cda8 | out: hFindFile=0xa7cda8) returned 1 [0090.501] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.501] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.501] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.501] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/lqoCl6y.xlsx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\lqoCl6y.xlsx", lpFilePart=0x8bf650*="lqoCl6y.xlsx") returned 0x2c [0090.501] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\lqoCl6y.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lqocl6y.xlsx")) returned 0xffffffff [0090.501] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.502] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.502] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o5UgHIGv4h72IU.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5UgHIGv4h72IU.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UgHIGv4h72IU.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gHIGv4h72IU.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIGv4h72IU.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IGv4h72IU.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Gv4h72IU.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v4h72IU.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4h72IU.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h72IU.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="72IU.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2IU.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IU.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.502] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o5UgHIGv4h72IU.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5UgHIGv4h72IU.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UgHIGv4h72IU.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gHIGv4h72IU.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIGv4h72IU.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IGv4h72IU.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Gv4h72IU.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v4h72IU.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4h72IU.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h72IU.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="72IU.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2IU.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IU.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.503] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.503] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0090.503] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.503] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.503] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.503] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.504] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.504] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0090.504] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.504] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.504] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.504] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.504] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.504] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/o5UgHIGv4h72IU.pptx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cee8 [0090.504] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0090.505] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.505] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.505] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.505] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.505] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.505] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.505] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.505] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.505] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.505] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.505] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.505] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.505] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.505] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0090.506] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.506] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.506] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0090.506] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.506] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0090.506] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.506] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.506] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.507] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.507] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.507] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.507] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0090.507] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0090.507] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.507] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.507] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.507] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.507] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.507] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.507] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0090.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7abf8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0090.508] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0090.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0090.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0090.508] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0090.508] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0090.509] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.509] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.509] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0090.509] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.509] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0090.510] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.510] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.510] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.510] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.510] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.510] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.510] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.510] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.510] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.510] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.510] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.510] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.510] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.510] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.510] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.511] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.511] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0090.511] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.511] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0090.511] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.511] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.511] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.511] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.511] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.511] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.511] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.511] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.511] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.511] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.512] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.512] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.512] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.512] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.512] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.512] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.512] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.512] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.512] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.512] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.512] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.512] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.512] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.512] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.512] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.512] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.513] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.513] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.513] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.513] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.513] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.513] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.513] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.513] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.513] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.513] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.513] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.513] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.513] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0090.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8acf0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0090.514] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0090.514] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0090.514] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.514] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.514] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.514] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0090.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d70, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0090.515] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0090.515] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0090.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ec0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0090.515] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.515] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.515] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.515] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.515] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.515] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.515] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0090.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b680, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0090.516] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0090.516] CryptHashData (hHash=0xa7d068, pbData=0x3983e50, dwDataLen=0x3, dwFlags=0x1) returned 1 [0090.516] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.516] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.516] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.516] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.516] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.516] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.516] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.516] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.516] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.516] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.517] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.517] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.517] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.517] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0090.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b6c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0090.517] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0090.517] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d068, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cda8) returned 1 [0090.517] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.518] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.518] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.518] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.518] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.518] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.518] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.518] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.518] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.518] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.518] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.518] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0090.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0090.519] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0090.519] CryptDestroyHash (hHash=0xa7d068) returned 1 [0090.519] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.519] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.519] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.519] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.519] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.520] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/o5UgHIGv4h72IU.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\o5ughigv4h72iu.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0090.521] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.521] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0090.521] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.521] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.521] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.521] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0090.521] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.o5UgHIGv4h72IU.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.o5ughigv4h72iu.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0090.522] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.522] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.522] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.523] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.526] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0090.533] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0090.536] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0xa72, lpOverlapped=0x0) returned 1 [0090.536] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0090.541] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.541] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.541] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.554] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0090.555] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.555] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0090.555] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.555] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.555] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.555] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.555] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.555] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.555] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.555] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.556] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.556] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.556] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.556] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.556] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.556] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.556] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.556] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.556] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.556] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.556] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.556] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.556] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.556] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.557] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.557] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.557] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.557] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.557] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.557] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.557] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.557] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.557] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.557] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.557] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.557] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.557] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.559] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0090.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8adb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0090.560] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0090.560] CryptEncrypt (in: hKey=0xa7cda8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x10a72, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x10a78) returned 1 [0090.560] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.560] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.560] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.560] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.560] CharLowerBuffW (in: lpsz="byte[68216]", cchLength=0xb | out: lpsz="byte[68216]") returned 0xb [0090.561] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.564] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.564] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.564] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.564] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.564] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.565] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.566] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0090.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0090.567] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0090.567] CryptEncrypt (in: hKey=0xa7cda8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c2e008*, pdwDataLen=0x8bef60*=0x10a72, dwBufLen=0x10a78 | out: pbData=0x3c2e008*, pdwDataLen=0x8bef60*=0x10a78) returned 1 [0090.570] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.570] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.570] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.570] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.571] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.571] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.571] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.571] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.571] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.572] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.572] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.572] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.572] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.572] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.572] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.572] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.572] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.572] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.572] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.572] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.572] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.572] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.572] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.572] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.573] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.573] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.573] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.581] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.581] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.581] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.583] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0x10a78, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0x10a78, lpOverlapped=0x0) returned 1 [0090.585] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.585] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.585] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0090.585] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.585] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0090.585] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.586] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.586] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.586] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.586] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.586] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.586] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.586] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0090.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a780, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0090.586] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0090.586] CryptDestroyKey (hKey=0xa7cda8) returned 1 [0090.587] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.587] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.587] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.587] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.587] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.587] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.587] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.587] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.587] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.587] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.587] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.587] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.587] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.587] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.587] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.588] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.588] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.588] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.588] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.588] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.588] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.588] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.588] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.588] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.588] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.588] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.588] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.588] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.588] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.588] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.589] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.589] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.589] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.589] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.589] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.589] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.589] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.589] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.589] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.589] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.589] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.589] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.589] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.589] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.593] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.593] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.593] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.593] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.593] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0090.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0090.594] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0090.594] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0090.594] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.595] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.595] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.595] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.595] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.595] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.595] FreeLibrary (hLibModule=0x76a10000) returned 1 [0090.595] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.595] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.595] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.595] CloseHandle (hObject=0x240) returned 1 [0090.597] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.597] CloseHandle (hObject=0x24c) returned 1 [0090.607] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.609] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.609] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.609] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.609] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/o5UgHIGv4h72IU.pptx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\o5UgHIGv4h72IU.pptx", lpFilePart=0x8bedf4*="o5UgHIGv4h72IU.pptx") returned 0x33 [0090.609] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\o5UgHIGv4h72IU.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\o5ughigv4h72iu.pptx")) returned 0x20 [0090.610] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\o5UgHIGv4h72IU.pptx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cc28 [0090.611] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\o5UgHIGv4h72IU.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\o5ughigv4h72iu.pptx")) returned 1 [0090.616] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0090.616] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0090.617] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.617] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.617] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.617] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/o5UgHIGv4h72IU.pptx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\o5UgHIGv4h72IU.pptx", lpFilePart=0x8bf650*="o5UgHIGv4h72IU.pptx") returned 0x33 [0090.617] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\o5UgHIGv4h72IU.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\o5ughigv4h72iu.pptx")) returned 0xffffffff [0090.617] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.617] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.617] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.617] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oNfvs3LGk1TKi1J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.617] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nfvs3LGk1TKi1J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fvs3LGk1TKi1J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vs3LGk1TKi1J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s3LGk1TKi1J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3LGk1TKi1J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LGk1TKi1J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Gk1TKi1J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k1TKi1J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1TKi1J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TKi1J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ki1J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i1J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aSN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SN.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N.xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xlsx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.618] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oNfvs3LGk1TKi1J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nfvs3LGk1TKi1J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fvs3LGk1TKi1J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vs3LGk1TKi1J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s3LGk1TKi1J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3LGk1TKi1J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LGk1TKi1J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Gk1TKi1J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k1TKi1J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1TKi1J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TKi1J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ki1J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i1J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aSN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SN.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N.xlsx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.619] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.619] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0090.619] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.619] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.619] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.619] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.620] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.620] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0090.620] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.620] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.620] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.620] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.620] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.620] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/oNfvs3LGk1TKi1J4_aSN.xlsx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7caa8 [0090.620] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0090.620] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.620] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.620] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.621] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.621] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.621] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.621] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.621] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.621] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.621] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.621] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.621] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.621] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.621] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0090.621] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.621] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.622] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0090.622] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.622] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0090.622] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.622] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.622] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.622] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.622] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.622] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.622] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0090.622] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0090.622] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.622] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.622] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.622] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.622] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.623] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.623] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0090.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7acd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0090.623] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0090.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0090.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7abb8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0090.623] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0090.623] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0090.624] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.624] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.624] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0090.624] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.624] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0090.625] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.625] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.625] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.625] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.625] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.625] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.625] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.625] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.625] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.625] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.625] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.625] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.626] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.626] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.626] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.626] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.626] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0090.626] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.626] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0090.626] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.626] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.627] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.627] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.627] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.627] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.627] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.628] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.628] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.628] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.628] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.628] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.628] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.628] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.628] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.628] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.628] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.628] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.633] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.633] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.633] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.633] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.633] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.634] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.634] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.634] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.634] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.634] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.634] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.634] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.634] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.634] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.634] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.634] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0090.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8acf0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0090.635] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0090.635] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0090.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0090.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0090.635] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0090.636] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0090.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0090.646] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.646] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.646] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.646] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.646] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.646] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.646] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0090.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b6f8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0090.647] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0090.647] CryptHashData (hHash=0xa7cc28, pbData=0x3983d10, dwDataLen=0x3, dwFlags=0x1) returned 1 [0090.647] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.647] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.647] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.647] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.647] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.647] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.647] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.647] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.647] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.647] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.647] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.647] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.647] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.648] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0090.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b860, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0090.648] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0090.648] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cc28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d0e8) returned 1 [0090.648] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.648] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.648] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.648] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.648] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.648] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.649] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.649] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.649] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.649] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.649] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.649] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0090.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0090.649] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0090.649] CryptDestroyHash (hHash=0xa7cc28) returned 1 [0090.649] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.649] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.650] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.650] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.650] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.651] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/oNfvs3LGk1TKi1J4_aSN.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onfvs3lgk1tki1j4_asn.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0090.651] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.651] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0090.651] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.651] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.652] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.652] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0090.652] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.oNfvs3LGk1TKi1J4_aSN.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.onfvs3lgk1tki1j4_asn.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0090.653] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.653] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.653] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.653] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.656] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0090.656] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x990, lpOverlapped=0x0) returned 1 [0090.659] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0090.662] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.662] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.662] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.662] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0090.662] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.662] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0090.662] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.663] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.663] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.663] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.663] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.663] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.663] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.663] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.663] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.663] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.663] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.663] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.663] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.663] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.663] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.663] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.664] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.664] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.664] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.664] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.664] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.664] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.664] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.664] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.664] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.664] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.664] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.664] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.664] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.664] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.664] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.665] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.665] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.665] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.665] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.665] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0090.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0090.665] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0090.665] CryptEncrypt (in: hKey=0xa7d0e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x990, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x998) returned 1 [0090.665] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.666] CharLowerBuffW (in: lpsz="byte[2456]", cchLength=0xa | out: lpsz="byte[2456]") returned 0xa [0090.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.666] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.666] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.666] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.666] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.666] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.666] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.666] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0090.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8af90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0090.667] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0090.667] CryptEncrypt (in: hKey=0xa7d0e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cb6358*, pdwDataLen=0x8bef60*=0x990, dwBufLen=0x998 | out: pbData=0x2cb6358*, pdwDataLen=0x8bef60*=0x998) returned 1 [0090.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.667] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.668] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.668] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.668] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.668] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.668] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.668] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.668] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.668] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.668] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.668] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.668] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.668] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.668] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.668] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.668] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.668] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.669] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.669] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.669] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.669] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.669] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.669] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.669] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.669] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.669] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.669] WriteFile (in: hFile=0x240, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0x998, lpOverlapped=0x0) returned 1 [0090.671] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.671] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.676] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0090.676] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.676] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0090.676] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.677] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.677] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.677] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.677] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.677] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.677] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.677] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0090.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a798, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0090.677] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0090.678] CryptDestroyKey (hKey=0xa7d0e8) returned 1 [0090.678] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.678] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.678] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.678] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.678] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.678] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.678] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.678] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.678] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.678] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.678] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.678] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.678] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.679] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.679] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.679] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.679] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.679] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.679] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.679] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.679] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.679] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.679] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.679] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.679] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.679] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.679] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.680] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.680] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.680] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.680] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.680] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.680] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.680] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.680] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.680] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.680] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.680] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.680] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.680] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.680] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.680] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.681] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.681] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.681] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.681] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.681] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.681] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.681] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.681] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.681] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.681] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.681] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0090.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ab98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0090.682] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0090.682] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0090.682] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.682] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.682] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.682] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.682] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.682] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.682] FreeLibrary (hLibModule=0x76a10000) returned 1 [0090.683] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.683] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.683] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.683] CloseHandle (hObject=0x24c) returned 1 [0090.684] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.684] CloseHandle (hObject=0x240) returned 1 [0090.689] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.690] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.690] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.690] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.690] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/oNfvs3LGk1TKi1J4_aSN.xlsx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oNfvs3LGk1TKi1J4_aSN.xlsx", lpFilePart=0x8bedf4*="oNfvs3LGk1TKi1J4_aSN.xlsx") returned 0x39 [0090.690] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oNfvs3LGk1TKi1J4_aSN.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onfvs3lgk1tki1j4_asn.xlsx")) returned 0x20 [0090.691] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oNfvs3LGk1TKi1J4_aSN.xlsx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7d0e8 [0090.691] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oNfvs3LGk1TKi1J4_aSN.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onfvs3lgk1tki1j4_asn.xlsx")) returned 1 [0090.696] FindNextFileW (in: hFindFile=0xa7d0e8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0090.696] FindClose (in: hFindFile=0xa7d0e8 | out: hFindFile=0xa7d0e8) returned 1 [0090.697] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.697] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.697] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.697] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/oNfvs3LGk1TKi1J4_aSN.xlsx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oNfvs3LGk1TKi1J4_aSN.xlsx", lpFilePart=0x8bf650*="oNfvs3LGk1TKi1J4_aSN.xlsx") returned 0x39 [0090.697] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oNfvs3LGk1TKi1J4_aSN.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onfvs3lgk1tki1j4_asn.xlsx")) returned 0xffffffff [0090.697] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.697] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.697] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sj6SoGBJ.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j6SoGBJ.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6SoGBJ.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SoGBJ.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oGBJ.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GBJ.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BJ.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.698] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sj6SoGBJ.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j6SoGBJ.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6SoGBJ.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SoGBJ.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oGBJ.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GBJ.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BJ.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.698] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.698] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0090.699] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.699] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.699] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.699] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.699] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.699] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0090.699] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.699] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.699] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.699] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.699] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.699] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Sj6SoGBJ.pptx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7c9e8 [0090.700] FindClose (in: hFindFile=0xa7c9e8 | out: hFindFile=0xa7c9e8) returned 1 [0090.700] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.700] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.700] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.700] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.700] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.700] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.700] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.700] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.700] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.700] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.701] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.701] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.701] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.701] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0090.701] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.701] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.701] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0090.701] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.701] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0090.701] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.701] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.702] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.702] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.702] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.702] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.702] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0090.702] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0090.702] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.702] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.702] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.702] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.702] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.702] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.702] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0090.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a9f8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0090.703] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0090.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0090.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7abf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0090.703] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0090.704] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0090.704] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.704] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.705] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0090.705] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.705] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0090.705] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.705] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.705] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.706] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.706] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.706] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.706] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.706] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.706] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.706] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.706] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.706] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.706] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.708] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.708] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.708] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.708] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0090.708] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.708] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0090.708] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.708] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.708] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.708] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.708] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.708] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.708] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.709] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.709] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.709] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.709] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.709] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.709] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.709] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.709] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.709] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.709] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.709] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.709] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.709] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.709] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.709] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.710] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.710] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.710] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.710] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.710] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.710] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.710] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.710] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.710] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.710] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.710] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.710] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.710] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.710] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.711] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.711] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.711] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0090.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0090.711] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0090.711] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0090.711] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.711] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.712] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.712] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0090.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ea0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0090.712] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0090.712] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0090.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983da0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0090.712] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.712] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.712] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.712] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.712] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.712] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.713] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0090.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b7b8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0090.713] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0090.713] CryptHashData (hHash=0xa7cb28, pbData=0x3983d70, dwDataLen=0x3, dwFlags=0x1) returned 1 [0090.713] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.713] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.713] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.713] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.713] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.714] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.714] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.714] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.714] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.714] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.714] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.714] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.714] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.714] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0090.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b6e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0090.715] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0090.715] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cb28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7caa8) returned 1 [0090.715] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.715] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.715] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.715] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.715] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.715] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.715] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.715] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.715] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.715] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.716] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.716] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0090.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7abd8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0090.716] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0090.716] CryptDestroyHash (hHash=0xa7cb28) returned 1 [0090.716] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.716] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.716] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.716] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.717] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.717] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Sj6SoGBJ.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\sj6sogbj.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0090.717] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.717] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0090.717] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.717] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.717] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.718] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0090.718] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.Sj6SoGBJ.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.sj6sogbj.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0090.719] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.719] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.719] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.719] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.723] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0090.723] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x89a8, lpOverlapped=0x0) returned 1 [0090.732] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0090.736] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.737] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.737] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.737] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0090.738] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.738] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0090.738] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.738] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.738] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.738] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.738] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.738] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.738] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.738] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.738] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.738] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.738] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.738] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.739] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.739] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.739] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.739] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.739] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.739] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.739] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.739] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.739] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.739] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.739] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.739] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.739] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.740] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.740] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.740] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.740] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.740] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.740] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.740] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.773] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.773] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.773] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.774] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0090.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0090.775] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0090.775] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x89a8, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x89b0) returned 1 [0090.775] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.775] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.775] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.775] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.775] CharLowerBuffW (in: lpsz="byte[35248]", cchLength=0xb | out: lpsz="byte[35248]") returned 0xb [0090.775] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.778] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.778] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.778] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.778] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.778] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.778] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.779] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0090.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8afc0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0090.779] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0090.779] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cced38*, pdwDataLen=0x8bef60*=0x89a8, dwBufLen=0x89b0 | out: pbData=0x2cced38*, pdwDataLen=0x8bef60*=0x89b0) returned 1 [0090.781] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.781] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.781] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.781] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.781] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.781] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.782] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.782] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.782] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.782] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.782] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.782] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.783] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.783] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.783] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.783] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.783] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.783] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.783] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.783] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.783] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.783] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.783] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.783] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.783] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.784] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.784] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.790] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.790] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.790] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.790] WriteFile (in: hFile=0x24c, lpBuffer=0x2cbd9e0*, nNumberOfBytesToWrite=0x89b0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cbd9e0*, lpNumberOfBytesWritten=0x8bf5e4*=0x89b0, lpOverlapped=0x0) returned 1 [0090.792] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.793] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.793] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0090.793] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.793] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0090.793] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.793] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.793] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.793] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.793] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.793] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.793] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0090.794] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0090.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a930, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0090.794] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0090.794] CryptDestroyKey (hKey=0xa7caa8) returned 1 [0090.794] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.794] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.795] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.795] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.795] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.795] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.795] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.795] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.795] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.795] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.795] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.795] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.795] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0090.795] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.796] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.796] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.796] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.796] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.796] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0090.796] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.796] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0090.796] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.796] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0090.796] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.796] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.796] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.797] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.797] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.797] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.797] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.797] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.797] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.797] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.797] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.797] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.845] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.845] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.845] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.845] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.846] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.846] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.846] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.847] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.847] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.847] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.847] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.847] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.847] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.847] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.847] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.847] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.847] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.847] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0090.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0090.848] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0090.848] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0090.848] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.848] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.848] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.848] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.848] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.848] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0090.848] FreeLibrary (hLibModule=0x76a10000) returned 1 [0090.848] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.848] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.848] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.849] CloseHandle (hObject=0x240) returned 1 [0090.851] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.851] CloseHandle (hObject=0x24c) returned 1 [0090.855] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.856] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.856] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.856] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.856] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Sj6SoGBJ.pptx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Sj6SoGBJ.pptx", lpFilePart=0x8bedf4*="Sj6SoGBJ.pptx") returned 0x2d [0090.857] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Sj6SoGBJ.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\sj6sogbj.pptx")) returned 0x20 [0090.857] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Sj6SoGBJ.pptx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cc28 [0090.857] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Sj6SoGBJ.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\sj6sogbj.pptx")) returned 1 [0090.884] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0090.885] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0090.885] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.885] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.885] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.885] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Sj6SoGBJ.pptx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Sj6SoGBJ.pptx", lpFilePart=0x8bf650*="Sj6SoGBJ.pptx") returned 0x2d [0090.886] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Sj6SoGBJ.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\sj6sogbj.pptx")) returned 0xffffffff [0090.886] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.886] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.886] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vgl6TzQ9uzGXrbslc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gl6TzQ9uzGXrbslc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l6TzQ9uzGXrbslc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6TzQ9uzGXrbslc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TzQ9uzGXrbslc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zQ9uzGXrbslc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q9uzGXrbslc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9uzGXrbslc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uzGXrbslc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zGXrbslc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GXrbslc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xrbslc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rbslc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bslc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="slc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lc.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0090.887] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vgl6TzQ9uzGXrbslc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gl6TzQ9uzGXrbslc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l6TzQ9uzGXrbslc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6TzQ9uzGXrbslc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TzQ9uzGXrbslc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zQ9uzGXrbslc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q9uzGXrbslc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9uzGXrbslc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uzGXrbslc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zGXrbslc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GXrbslc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xrbslc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rbslc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bslc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="slc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lc.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0090.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0090.888] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0090.888] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0090.888] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.888] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.888] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0090.888] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.888] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.888] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0090.888] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.889] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.889] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.889] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.921] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.921] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/vgl6TzQ9uzGXrbslc.pptx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cee8 [0090.921] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0090.922] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.922] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.922] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.922] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.922] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.922] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.922] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.922] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.922] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.922] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.922] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.922] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0090.923] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.923] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0090.923] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.923] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.923] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0090.923] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.923] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0090.923] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.923] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.927] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.927] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.927] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.927] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.927] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0090.927] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0090.927] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.927] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.928] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.928] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.928] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.928] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0090.928] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0090.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0090.928] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0090.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0090.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7aa78, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0090.929] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0090.929] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0090.930] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.930] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.930] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0090.930] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.930] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0090.930] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.930] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.931] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.931] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.931] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.931] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.931] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.931] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.931] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.931] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.931] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.931] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0090.931] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0090.931] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.931] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.931] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.932] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0090.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.932] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0090.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.932] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.932] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.932] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.932] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.933] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.933] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.933] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.933] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.933] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.933] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.933] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.933] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.933] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.933] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.933] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.933] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.933] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.934] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.934] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.934] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.934] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.934] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.934] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.934] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.934] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.934] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.934] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.934] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.934] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.934] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.935] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.935] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.935] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0090.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0090.935] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0090.935] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0090.935] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.936] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.936] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.936] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0090.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983db0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0090.936] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0090.936] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0090.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e70, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0090.936] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.936] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.936] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.937] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.937] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.937] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.937] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0090.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b7e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0090.937] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0090.937] CryptHashData (hHash=0xa7d068, pbData=0x3983e90, dwDataLen=0x3, dwFlags=0x1) returned 1 [0090.937] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.938] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.938] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.938] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.938] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.938] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.938] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.938] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.939] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0090.939] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.939] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0090.939] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.939] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.939] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0090.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b710, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0090.939] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0090.940] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d068, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7caa8) returned 1 [0090.940] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.940] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.940] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.940] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.940] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.940] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.940] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.940] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.940] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.940] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.940] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0090.941] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0090.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0090.941] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0090.941] CryptDestroyHash (hHash=0xa7d068) returned 1 [0090.941] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.941] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.941] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.941] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.949] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.950] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/vgl6TzQ9uzGXrbslc.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\vgl6tzq9uzgxrbslc.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0090.950] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.950] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0090.950] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.950] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.950] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.950] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0090.951] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.vgl6TzQ9uzGXrbslc.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.vgl6tzq9uzgxrbslc.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0090.952] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.952] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.952] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.952] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.959] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0090.959] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0xfdb9, lpOverlapped=0x0) returned 1 [0090.967] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0090.977] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.977] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.977] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0090.977] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0090.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.978] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0090.978] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.979] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.979] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.979] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.979] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.979] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.979] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.979] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0090.979] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.979] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0090.979] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.979] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.979] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.979] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.980] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.980] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.980] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.980] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.980] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.980] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0090.980] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.980] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0090.980] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.980] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.980] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.980] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.981] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.981] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.981] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.981] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.981] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.981] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.983] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0090.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0090.984] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0090.984] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xfdb9, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xfdc0) returned 1 [0090.984] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.984] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.984] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.984] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.985] CharLowerBuffW (in: lpsz="byte[64960]", cchLength=0xb | out: lpsz="byte[64960]") returned 0xb [0090.985] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.988] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.989] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0090.989] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.989] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0090.989] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.989] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0090.991] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0090.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0090.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8acf0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0090.992] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0090.992] CryptEncrypt (in: hKey=0xa7caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c2e008*, pdwDataLen=0x8bef60*=0xfdb9, dwBufLen=0xfdc0 | out: pbData=0x3c2e008*, pdwDataLen=0x8bef60*=0xfdc0) returned 1 [0090.995] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.995] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.995] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.996] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.997] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.997] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.997] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0090.997] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0090.997] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.997] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0090.997] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.997] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.997] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0090.997] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.998] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0090.998] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.998] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.998] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0090.998] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.998] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0090.998] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.998] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0090.998] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.998] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0090.998] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.998] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0090.999] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.015] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.017] WriteFile (in: hFile=0x240, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0xfdc0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0xfdc0, lpOverlapped=0x0) returned 1 [0091.022] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.023] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.023] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0091.023] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.023] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0091.023] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.023] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.023] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.023] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.023] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.023] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.023] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.023] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a960, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0091.024] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0091.024] CryptDestroyKey (hKey=0xa7caa8) returned 1 [0091.024] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.024] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.024] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.024] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.024] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.025] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.025] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.025] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.025] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.025] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.025] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.025] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.025] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.025] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.025] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.025] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.025] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.025] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.026] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.026] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.026] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.026] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.026] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.026] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.026] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.026] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.026] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.026] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.028] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.028] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.028] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.028] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.029] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.029] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.029] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.029] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.029] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.029] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.029] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.029] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.029] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.029] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.029] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.029] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.029] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.030] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.030] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.030] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.030] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.030] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.030] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.030] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.030] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a958, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0091.031] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0091.031] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0091.031] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.031] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.031] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.031] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.031] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.031] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.031] FreeLibrary (hLibModule=0x76a10000) returned 1 [0091.031] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.031] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.031] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.032] CloseHandle (hObject=0x24c) returned 1 [0091.033] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.033] CloseHandle (hObject=0x240) returned 1 [0091.042] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.045] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.045] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.045] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.045] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/vgl6TzQ9uzGXrbslc.pptx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\vgl6TzQ9uzGXrbslc.pptx", lpFilePart=0x8bedf4*="vgl6TzQ9uzGXrbslc.pptx") returned 0x36 [0091.045] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\vgl6TzQ9uzGXrbslc.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\vgl6tzq9uzgxrbslc.pptx")) returned 0x20 [0091.046] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\vgl6TzQ9uzGXrbslc.pptx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cfa8 [0091.046] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\vgl6TzQ9uzGXrbslc.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\vgl6tzq9uzgxrbslc.pptx")) returned 1 [0091.052] FindNextFileW (in: hFindFile=0xa7cfa8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0091.052] FindClose (in: hFindFile=0xa7cfa8 | out: hFindFile=0xa7cfa8) returned 1 [0091.052] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.052] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.053] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.053] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/vgl6TzQ9uzGXrbslc.pptx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\vgl6TzQ9uzGXrbslc.pptx", lpFilePart=0x8bf650*="vgl6TzQ9uzGXrbslc.pptx") returned 0x36 [0091.053] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\vgl6TzQ9uzGXrbslc.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\vgl6tzq9uzgxrbslc.pptx")) returned 0xffffffff [0091.053] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.053] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.053] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.053] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VgQS p2zoBtKpHSKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.053] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gQS p2zoBtKpHSKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.053] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QS p2zoBtKpHSKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.053] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S p2zoBtKpHSKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" p2zoBtKpHSKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p2zoBtKpHSKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2zoBtKpHSKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zoBtKpHSKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oBtKpHSKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BtKpHSKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tKpHSKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KpHSKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pHSKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HSKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SKB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KB.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.054] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VgQS p2zoBtKpHSKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gQS p2zoBtKpHSKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QS p2zoBtKpHSKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S p2zoBtKpHSKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" p2zoBtKpHSKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p2zoBtKpHSKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2zoBtKpHSKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zoBtKpHSKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oBtKpHSKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BtKpHSKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tKpHSKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KpHSKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pHSKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HSKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SKB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KB.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.055] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.055] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0091.055] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.055] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.055] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.056] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.056] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.056] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0091.056] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.056] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.056] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.056] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.056] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.056] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/VgQS p2zoBtKpHSKB.docx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7c9a8 [0091.057] FindClose (in: hFindFile=0xa7c9a8 | out: hFindFile=0xa7c9a8) returned 1 [0091.057] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.057] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.057] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.057] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.057] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.057] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.057] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.057] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.057] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.057] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.058] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.058] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.058] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.058] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0091.058] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.058] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.058] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0091.058] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.059] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0091.059] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.059] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.059] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.059] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.059] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.059] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.059] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0091.059] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0091.059] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.059] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.059] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.059] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.060] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.060] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.060] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ab18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0091.060] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0091.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0091.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7abd8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0091.061] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0091.061] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0091.062] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.062] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.062] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0091.062] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.062] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0091.062] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.062] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.062] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.062] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.062] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.063] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.063] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.063] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.063] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.063] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.064] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.064] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.064] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.064] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.064] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.064] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.064] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0091.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.065] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0091.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.065] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.065] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.065] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.065] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.065] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.065] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.066] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.066] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.066] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.066] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.066] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.066] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.066] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.066] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.066] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.066] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.066] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.066] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.066] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.067] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.067] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.076] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.076] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.076] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.076] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.077] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.077] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.077] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.077] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.077] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.077] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.077] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8acf0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0091.078] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0091.078] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0091.078] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.078] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.078] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.078] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e70, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.078] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0091.078] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983dd0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.079] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.079] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.079] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.079] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.079] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.079] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.080] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0091.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b758, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0091.080] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0091.080] CryptHashData (hHash=0xa7cb28, pbData=0x3983d40, dwDataLen=0x3, dwFlags=0x1) returned 1 [0091.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.080] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.080] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.081] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.081] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.081] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.081] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.081] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0091.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b8c0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0091.082] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0091.082] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cb28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cc28) returned 1 [0091.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.082] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.082] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.083] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.083] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.083] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.083] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.083] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aa58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0091.083] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0091.083] CryptDestroyHash (hHash=0xa7cb28) returned 1 [0091.083] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.085] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/VgQS p2zoBtKpHSKB.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\vgqs p2zobtkphskb.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0091.085] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.085] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0091.086] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.086] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.086] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.086] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0091.086] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.VgQS p2zoBtKpHSKB.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.vgqs p2zobtkphskb.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0091.087] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.087] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.087] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.087] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.091] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0091.091] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0xc409, lpOverlapped=0x0) returned 1 [0091.093] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0091.098] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.098] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.098] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.098] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0091.099] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.099] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0091.099] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.099] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.099] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.099] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.100] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.100] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.100] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.100] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.100] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.100] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.100] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.100] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.100] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.100] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.100] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.100] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.100] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.100] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.101] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.101] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.101] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.101] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.101] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.101] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.101] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.101] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.101] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.101] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.101] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.101] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.101] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.101] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.101] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.102] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.102] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.102] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.103] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.103] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0xc409, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0xc410) returned 1 [0091.103] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.103] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.103] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.103] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.103] CharLowerBuffW (in: lpsz="byte[50192]", cchLength=0xb | out: lpsz="byte[50192]") returned 0xb [0091.104] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.106] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.106] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.106] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.106] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.106] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.106] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.106] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8adb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.107] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.107] CryptEncrypt (in: hKey=0xa7cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cd9c70*, pdwDataLen=0x8bef60*=0xc409, dwBufLen=0xc410 | out: pbData=0x2cd9c70*, pdwDataLen=0x8bef60*=0xc410) returned 1 [0091.109] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.109] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.109] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.109] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.109] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.110] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.110] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.110] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.113] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.113] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.113] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.113] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.113] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.113] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.113] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.113] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.113] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.113] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.113] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.115] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.115] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.115] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.116] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.116] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.116] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.116] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.116] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.122] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.122] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.122] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.123] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0xc410, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0xc410, lpOverlapped=0x0) returned 1 [0091.125] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.125] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.125] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0091.125] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.126] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0091.126] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.126] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.126] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.126] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.126] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.126] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.126] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.126] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a780, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0091.127] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0091.127] CryptDestroyKey (hKey=0xa7cc28) returned 1 [0091.127] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.127] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.127] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.128] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.128] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.128] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.128] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.128] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.128] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.128] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.128] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.128] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.128] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.128] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.128] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.128] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.128] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.129] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.129] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.129] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.129] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.129] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.129] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.129] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.129] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.129] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.129] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.129] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.129] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.129] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.129] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.129] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.130] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.130] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.130] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.130] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.130] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.130] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.130] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.130] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.130] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.130] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.130] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.130] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.130] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.131] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.131] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.131] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.131] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.131] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.131] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.131] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.131] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7a978, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0091.132] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0091.132] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0091.132] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.132] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.132] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.132] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.132] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.132] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.132] FreeLibrary (hLibModule=0x76a10000) returned 1 [0091.132] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.132] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.132] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.132] CloseHandle (hObject=0x240) returned 1 [0091.135] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.135] CloseHandle (hObject=0x24c) returned 1 [0091.148] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.149] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.149] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.149] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.149] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/VgQS p2zoBtKpHSKB.docx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\VgQS p2zoBtKpHSKB.docx", lpFilePart=0x8bedf4*="VgQS p2zoBtKpHSKB.docx") returned 0x36 [0091.149] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\VgQS p2zoBtKpHSKB.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\vgqs p2zobtkphskb.docx")) returned 0x20 [0091.149] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\VgQS p2zoBtKpHSKB.docx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cce8 [0091.150] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\VgQS p2zoBtKpHSKB.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\vgqs p2zobtkphskb.docx")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0xa7cce8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0091.159] FindClose (in: hFindFile=0xa7cce8 | out: hFindFile=0xa7cce8) returned 1 [0091.160] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.160] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.160] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.160] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/VgQS p2zoBtKpHSKB.docx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\VgQS p2zoBtKpHSKB.docx", lpFilePart=0x8bf650*="VgQS p2zoBtKpHSKB.docx") returned 0x36 [0091.160] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\VgQS p2zoBtKpHSKB.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\vgqs p2zobtkphskb.docx")) returned 0xffffffff [0091.160] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.160] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.160] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WoAfC7fH.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oAfC7fH.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AfC7fH.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fC7fH.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C7fH.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7fH.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fH.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.161] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WoAfC7fH.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oAfC7fH.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AfC7fH.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fC7fH.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C7fH.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7fH.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fH.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.162] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.162] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0091.162] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.162] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.162] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.162] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.162] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.162] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0091.162] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.162] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.162] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.162] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.163] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.163] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/WoAfC7fH.docx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cc28 [0091.163] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0091.163] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.163] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.163] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.163] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.164] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.164] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.164] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.164] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.164] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.164] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.164] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.164] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.164] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.164] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0091.165] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.165] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.165] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0091.165] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.165] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0091.165] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.165] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.165] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.165] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.165] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.165] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.165] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0091.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0091.166] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.166] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.166] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.166] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.166] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.166] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.166] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7acd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0091.167] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0091.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0091.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7abf8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0091.167] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0091.167] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0091.168] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.168] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.168] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0091.168] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.209] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0091.210] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 1 [0091.210] TranslateMessage (lpMsg=0x8bf248) returned 0 [0091.210] DispatchMessageW (lpMsg=0x8bf248) returned 0x0 [0091.210] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0091.210] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0091.210] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.210] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.210] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.210] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.210] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.210] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.210] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.210] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.211] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.211] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.211] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.211] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.211] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.211] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.211] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.211] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.211] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0091.211] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.211] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0091.211] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.211] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.211] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.211] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.212] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.212] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.212] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.212] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.212] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.212] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.212] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.212] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.212] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.212] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.212] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.212] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.212] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.212] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.213] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.213] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.213] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.213] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.213] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.213] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.213] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.213] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.213] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.213] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.213] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.213] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.213] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.213] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.213] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.214] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.214] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.214] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.214] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.214] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.214] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad50, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0091.214] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0091.217] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0091.217] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.217] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.217] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.217] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983db0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.217] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0091.217] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.217] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.218] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.218] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.218] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.218] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.218] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.218] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0091.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b860, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0091.221] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0091.221] CryptHashData (hHash=0xa7c9a8, pbData=0x3983e50, dwDataLen=0x3, dwFlags=0x1) returned 1 [0091.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.221] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.221] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.221] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.221] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.221] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.221] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.221] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.222] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.222] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.222] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.222] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.222] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0091.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b6b0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0091.222] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0091.223] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7c9a8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cee8) returned 1 [0091.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.223] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.223] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.223] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.223] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.223] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.223] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.223] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0091.224] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0091.224] CryptDestroyHash (hHash=0xa7c9a8) returned 1 [0091.224] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.224] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.224] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.224] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.225] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.226] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/WoAfC7fH.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\woafc7fh.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0091.226] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.226] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0091.227] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.227] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.227] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.227] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0091.227] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.WoAfC7fH.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.woafc7fh.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0091.228] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.228] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.228] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.228] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.232] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0091.232] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0091.235] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x5358, lpOverlapped=0x0) returned 1 [0091.236] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0091.242] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.242] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.243] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.243] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0091.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.243] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0091.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.243] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.244] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.244] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.244] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.244] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.244] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.244] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.244] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.244] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.244] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.244] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.244] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.244] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.244] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.245] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.245] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.245] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.245] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.245] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.245] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.245] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.245] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.245] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.245] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.245] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.245] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.246] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.246] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.246] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.246] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.246] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.246] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.246] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.247] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.248] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.248] CryptEncrypt (in: hKey=0xa7cee8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x15358, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x15360) returned 1 [0091.248] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.248] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.248] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.248] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.248] CharLowerBuffW (in: lpsz="byte[86880]", cchLength=0xb | out: lpsz="byte[86880]") returned 0xb [0091.248] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.250] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.250] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.250] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.251] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.251] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.251] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.268] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8af48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.268] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.269] CryptEncrypt (in: hKey=0xa7cee8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c43368*, pdwDataLen=0x8bef60*=0x15358, dwBufLen=0x15360 | out: pbData=0x3c43368*, pdwDataLen=0x8bef60*=0x15360) returned 1 [0091.273] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.273] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.273] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.273] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.275] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.275] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.275] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.275] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.276] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.276] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.276] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.276] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.276] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.276] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.276] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.276] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.276] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.276] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.276] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.276] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.276] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.276] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.276] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.277] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.277] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.277] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.277] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.288] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.288] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.288] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.289] WriteFile (in: hFile=0x240, lpBuffer=0x2cca390*, nNumberOfBytesToWrite=0x15360, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cca390*, lpNumberOfBytesWritten=0x8bf5e4*=0x15360, lpOverlapped=0x0) returned 1 [0091.292] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.292] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.292] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0091.293] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.293] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0091.293] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.293] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.293] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.293] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.293] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.293] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.293] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.293] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a7c8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0091.293] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0091.294] CryptDestroyKey (hKey=0xa7cee8) returned 1 [0091.294] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.294] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.294] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.294] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.294] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.294] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.294] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.294] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.294] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.294] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.294] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.294] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.294] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.294] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.294] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.295] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.295] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.295] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.295] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.295] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.295] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.295] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.295] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.295] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.295] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.295] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.295] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.295] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.295] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.295] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.295] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.295] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.296] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.296] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.296] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.296] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.296] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.296] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.296] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.296] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.296] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.296] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.296] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.296] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.296] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.296] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.296] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.296] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.296] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.297] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.297] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.297] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.297] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ab38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0091.297] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0091.297] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0091.297] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.297] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.297] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.297] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.298] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.298] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.298] FreeLibrary (hLibModule=0x76a10000) returned 1 [0091.298] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.298] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.298] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.298] CloseHandle (hObject=0x24c) returned 1 [0091.300] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.300] CloseHandle (hObject=0x240) returned 1 [0091.329] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.331] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.336] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.336] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.336] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/WoAfC7fH.docx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WoAfC7fH.docx", lpFilePart=0x8bedf4*="WoAfC7fH.docx") returned 0x2d [0091.336] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WoAfC7fH.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\woafc7fh.docx")) returned 0x20 [0091.336] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WoAfC7fH.docx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cee8 [0091.337] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WoAfC7fH.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\woafc7fh.docx")) returned 1 [0091.376] FindNextFileW (in: hFindFile=0xa7cee8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0091.376] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0091.376] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.376] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.376] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.377] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/WoAfC7fH.docx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WoAfC7fH.docx", lpFilePart=0x8bf650*="WoAfC7fH.docx") returned 0x2d [0091.377] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WoAfC7fH.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\woafc7fh.docx")) returned 0xffffffff [0091.377] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.377] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.377] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WUpSn9HARv5eBhQKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UpSn9HARv5eBhQKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pSn9HARv5eBhQKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sn9HARv5eBhQKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n9HARv5eBhQKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9HARv5eBhQKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HARv5eBhQKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ARv5eBhQKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rv5eBhQKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v5eBhQKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5eBhQKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eBhQKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BhQKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hQKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QKKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KKyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KyI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yI.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I.docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".docx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.378] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WUpSn9HARv5eBhQKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UpSn9HARv5eBhQKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pSn9HARv5eBhQKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sn9HARv5eBhQKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n9HARv5eBhQKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9HARv5eBhQKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HARv5eBhQKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ARv5eBhQKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rv5eBhQKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v5eBhQKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5eBhQKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eBhQKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BhQKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hQKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QKKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KKyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KyI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yI.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I.docx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.378] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.378] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0091.378] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.379] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.379] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.379] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.379] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.379] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0091.379] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.379] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.379] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.379] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.379] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.379] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/WUpSn9HARv5eBhQKKyI.docx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cb28 [0091.379] FindClose (in: hFindFile=0xa7cb28 | out: hFindFile=0xa7cb28) returned 1 [0091.380] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.380] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.380] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.380] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.380] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.380] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.380] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.380] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.380] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.380] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.380] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.380] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.380] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.380] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0091.381] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.381] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.381] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0091.381] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.381] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0091.381] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.381] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.381] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.381] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.381] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.381] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.381] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0091.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0091.381] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.381] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.382] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.382] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.382] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.382] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.382] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0091.382] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0091.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0091.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a958, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0091.383] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0091.383] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0091.383] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.383] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.383] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0091.383] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.384] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0091.384] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.384] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.384] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.384] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.384] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.384] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.384] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.384] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.384] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.384] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.384] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.384] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.384] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.385] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0091.385] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.385] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0091.385] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.385] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.385] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.385] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.385] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.385] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.385] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.385] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.385] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.385] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.385] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.385] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.385] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.385] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.385] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.386] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.386] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.386] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.386] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.386] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.386] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.386] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.386] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.386] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.386] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.386] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.386] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.386] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.386] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.386] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.386] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.386] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.386] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.387] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.387] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.387] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.387] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.387] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.387] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad38, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0091.387] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0091.387] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0091.387] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.387] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e40, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.388] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0091.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e30, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.388] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.388] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.388] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.388] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.388] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.388] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.388] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0091.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b860, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0091.389] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0091.389] CryptHashData (hHash=0xa7cee8, pbData=0x3983d40, dwDataLen=0x3, dwFlags=0x1) returned 1 [0091.389] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.389] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.389] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.389] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.389] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.389] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.389] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.389] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.389] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.389] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.389] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.390] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.390] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.390] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0091.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b758, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0091.390] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0091.390] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cee8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d0e8) returned 1 [0091.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.390] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.427] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.428] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.428] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.428] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.428] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.428] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.428] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.428] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.428] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.428] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7abd8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0091.428] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0091.429] CryptDestroyHash (hHash=0xa7cee8) returned 1 [0091.429] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.429] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.429] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.429] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.429] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.429] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/WUpSn9HARv5eBhQKKyI.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wupsn9harv5ebhqkkyi.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0091.429] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.429] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0091.429] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.429] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.430] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.430] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0091.430] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.WUpSn9HARv5eBhQKKyI.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.wupsn9harv5ebhqkkyi.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0091.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.431] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.434] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0091.434] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x77d8, lpOverlapped=0x0) returned 1 [0091.435] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0091.442] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.442] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.442] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.442] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0091.442] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.443] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0091.443] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.443] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.443] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.443] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.443] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.443] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.443] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.443] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.443] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.443] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.443] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.443] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.443] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.443] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.443] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.443] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.444] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.444] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.444] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.444] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.444] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.444] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.444] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.444] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.444] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.444] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.444] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.444] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.444] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.444] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.444] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.444] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.444] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.445] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.445] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.445] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.445] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.445] CryptEncrypt (in: hKey=0xa7d0e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x77d8, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x77e0) returned 1 [0091.446] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.446] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.446] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.446] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.446] CharLowerBuffW (in: lpsz="byte[30688]", cchLength=0xb | out: lpsz="byte[30688]") returned 0xb [0091.446] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.447] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.447] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.447] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.447] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.447] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.447] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.447] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.447] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.447] CryptEncrypt (in: hKey=0xa7d0e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ccb7c8*, pdwDataLen=0x8bef60*=0x77d8, dwBufLen=0x77e0 | out: pbData=0x2ccb7c8*, pdwDataLen=0x8bef60*=0x77e0) returned 1 [0091.449] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.449] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.449] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.449] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.449] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.449] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.449] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.449] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.449] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.449] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.449] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.449] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.449] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.449] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.449] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.449] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.449] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.450] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.450] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.450] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.450] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.450] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.450] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.450] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.450] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.450] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.450] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.454] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.454] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.454] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.454] WriteFile (in: hFile=0x24c, lpBuffer=0x2cbc810*, nNumberOfBytesToWrite=0x77e0, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cbc810*, lpNumberOfBytesWritten=0x8bf5e4*=0x77e0, lpOverlapped=0x0) returned 1 [0091.456] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.456] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.456] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0091.456] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.456] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0091.456] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.456] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.457] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.457] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.457] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.457] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.457] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.457] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a798, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0091.457] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0091.457] CryptDestroyKey (hKey=0xa7d0e8) returned 1 [0091.457] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.457] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.457] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.458] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.458] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.458] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.458] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.458] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.458] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.458] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.458] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.458] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.458] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.469] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.469] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.469] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.469] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.469] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.469] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.469] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.469] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.470] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.470] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.470] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.470] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.470] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.470] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.470] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.470] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.470] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.470] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.470] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.470] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.470] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.470] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.470] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.470] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.471] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.471] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.471] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.471] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.471] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.471] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.471] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.471] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.471] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.471] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.471] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.471] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.471] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.471] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.471] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.471] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0091.472] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0091.472] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0091.472] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.472] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.472] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.472] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.472] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.472] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.472] FreeLibrary (hLibModule=0x76a10000) returned 1 [0091.472] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.472] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.473] CloseHandle (hObject=0x240) returned 1 [0091.475] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.475] CloseHandle (hObject=0x24c) returned 1 [0091.478] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.478] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.479] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.479] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.479] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/WUpSn9HARv5eBhQKKyI.docx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WUpSn9HARv5eBhQKKyI.docx", lpFilePart=0x8bedf4*="WUpSn9HARv5eBhQKKyI.docx") returned 0x38 [0091.479] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WUpSn9HARv5eBhQKKyI.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wupsn9harv5ebhqkkyi.docx")) returned 0x20 [0091.479] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WUpSn9HARv5eBhQKKyI.docx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7c9e8 [0091.479] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WUpSn9HARv5eBhQKKyI.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wupsn9harv5ebhqkkyi.docx")) returned 1 [0091.482] FindNextFileW (in: hFindFile=0xa7c9e8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0091.482] FindClose (in: hFindFile=0xa7c9e8 | out: hFindFile=0xa7c9e8) returned 1 [0091.482] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.482] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.482] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.482] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/WUpSn9HARv5eBhQKKyI.docx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WUpSn9HARv5eBhQKKyI.docx", lpFilePart=0x8bf650*="WUpSn9HARv5eBhQKKyI.docx") returned 0x38 [0091.482] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WUpSn9HARv5eBhQKKyI.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wupsn9harv5ebhqkkyi.docx")) returned 0xffffffff [0091.483] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.483] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.483] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XYua.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yua.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ua.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a.pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.483] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XYua.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yua.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ua.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a.pptx", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.483] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.483] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0091.483] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.483] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.483] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.484] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.484] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.484] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0091.484] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.484] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.484] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.484] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.484] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.484] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/XYua.pptx", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cc28 [0091.484] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0091.484] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.484] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.485] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.485] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.485] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.495] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.495] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.495] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.495] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.496] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.496] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.496] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.496] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.496] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0091.496] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.496] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.496] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0091.496] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.496] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0091.496] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.496] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.496] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.496] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.497] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.497] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.497] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0091.497] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0091.497] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.497] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.497] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.497] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.497] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.497] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.497] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a9d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0091.497] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0091.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0091.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a9b8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0091.498] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0091.498] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0091.499] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.499] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.499] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0091.499] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.499] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0091.499] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.499] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.499] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.499] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.499] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.499] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.499] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.499] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.499] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.499] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.499] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.499] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.499] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.500] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.500] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.500] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.500] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0091.500] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.500] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0091.500] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.500] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.500] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.500] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.500] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.500] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.500] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.500] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.501] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.501] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.501] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.501] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.501] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.502] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.510] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.510] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.510] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.510] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.510] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.510] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.510] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.510] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.510] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.510] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.510] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.510] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.510] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.510] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.510] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.510] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.511] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.511] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.511] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.511] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.511] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.511] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.511] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.511] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.511] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8ad38, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0091.511] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0091.511] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0091.512] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.512] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.512] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.512] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983d90, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.512] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0091.512] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983e00, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.512] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.512] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.512] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.512] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.512] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.512] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.513] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0091.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b7b8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0091.513] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0091.513] CryptHashData (hHash=0xa7cb28, pbData=0x3983ee0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0091.513] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.513] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.513] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.513] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.513] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.513] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.513] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.513] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.513] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.514] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.514] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.514] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.514] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.514] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0091.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b7e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0091.514] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0091.514] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7cb28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cda8) returned 1 [0091.514] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.514] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.514] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.514] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.514] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.515] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.515] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.515] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.515] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.515] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.515] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.515] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7ac38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0091.515] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0091.515] CryptDestroyHash (hHash=0xa7cb28) returned 1 [0091.515] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.515] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.516] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.516] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.516] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.516] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/XYua.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\xyua.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0091.517] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.517] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0091.517] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.517] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.517] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.517] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0091.517] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.XYua.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.xyua.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0091.518] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.518] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.518] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.518] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.521] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0091.521] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0091.523] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x1600, lpOverlapped=0x0) returned 1 [0091.523] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0091.527] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.527] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.528] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.528] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0091.529] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.529] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0091.529] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.529] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.530] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.530] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.530] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.530] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.530] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.530] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.530] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.530] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.530] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.530] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.530] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.530] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.530] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.530] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.530] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.530] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.530] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.530] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.531] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.531] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.531] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.531] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.531] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.531] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.531] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.531] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.531] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.531] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.531] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.531] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.531] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.531] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.531] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.533] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8ad50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.533] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.533] CryptEncrypt (in: hKey=0xa7cda8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x11600, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x11608) returned 1 [0091.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.533] CharLowerBuffW (in: lpsz="byte[71176]", cchLength=0xb | out: lpsz="byte[71176]") returned 0xb [0091.533] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.536] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.536] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.536] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.536] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.536] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.536] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.538] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8acf0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.538] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.538] CryptEncrypt (in: hKey=0xa7cda8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c3f610*, pdwDataLen=0x8bef60*=0x11600, dwBufLen=0x11608 | out: pbData=0x3c3f610*, pdwDataLen=0x8bef60*=0x11608) returned 1 [0091.541] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.541] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.541] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.541] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.546] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.546] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.546] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.546] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.546] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.546] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.546] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.546] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.546] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.546] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.546] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.546] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.546] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.546] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.547] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.547] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.547] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.547] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.547] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.547] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.547] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.547] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.547] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.554] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.555] WriteFile (in: hFile=0x240, lpBuffer=0x2cc6638*, nNumberOfBytesToWrite=0x11608, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cc6638*, lpNumberOfBytesWritten=0x8bf5e4*=0x11608, lpOverlapped=0x0) returned 1 [0091.559] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.559] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.559] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0091.559] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.559] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0091.559] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.559] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.559] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.559] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.560] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.560] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.560] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.560] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a798, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0091.561] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0091.561] CryptDestroyKey (hKey=0xa7cda8) returned 1 [0091.561] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.561] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.561] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.561] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.562] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.562] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.562] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.562] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.562] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.562] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.562] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.562] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.562] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.562] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.562] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.562] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.562] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.562] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.562] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.562] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.562] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.562] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.563] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.563] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.563] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.563] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.563] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.564] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.564] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.564] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.564] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.564] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.564] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.564] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.564] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.564] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.564] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.564] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.564] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.564] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.564] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.564] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.564] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.564] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.564] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.565] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.565] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.565] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.565] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.565] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.565] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.565] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.565] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7acb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0091.565] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0091.565] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0091.566] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.566] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.566] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.566] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.566] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.566] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.566] FreeLibrary (hLibModule=0x76a10000) returned 1 [0091.566] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.566] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.566] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.566] CloseHandle (hObject=0x24c) returned 1 [0091.567] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.567] CloseHandle (hObject=0x240) returned 1 [0091.575] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.577] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.577] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.577] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.577] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/XYua.pptx", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\XYua.pptx", lpFilePart=0x8bedf4*="XYua.pptx") returned 0x29 [0091.577] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\XYua.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\xyua.pptx")) returned 0x20 [0091.577] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\XYua.pptx", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cee8 [0091.577] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\XYua.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\xyua.pptx")) returned 1 [0091.583] FindNextFileW (in: hFindFile=0xa7cee8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0091.583] FindClose (in: hFindFile=0xa7cee8 | out: hFindFile=0xa7cee8) returned 1 [0091.584] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.584] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.584] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.584] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/XYua.pptx", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\XYua.pptx", lpFilePart=0x8bf650*="XYua.pptx") returned 0x29 [0091.584] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\XYua.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\xyua.pptx")) returned 0xffffffff [0091.584] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.584] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.584] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y1zhfb0f.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1zhfb0f.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zhfb0f.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hfb0f.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.585] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fb0f.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.585] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0f.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.585] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0f.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.585] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f.pps", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.585] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.585] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y1zhfb0f.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.585] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1zhfb0f.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.585] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zhfb0f.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.585] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hfb0f.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.585] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fb0f.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.585] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0f.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.585] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0f.pps", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.585] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.585] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0091.585] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.585] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.585] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.585] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf3a8, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.585] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.585] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0091.585] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.586] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.586] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.586] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.586] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.586] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Y1zhfb0f.pps", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7d128 [0091.586] FindClose (in: hFindFile=0xa7d128 | out: hFindFile=0xa7d128) returned 1 [0091.586] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.586] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.586] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.586] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.586] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.586] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.587] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.587] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.587] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.587] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.587] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.587] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.587] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.587] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0091.587] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.587] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.587] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0091.587] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.587] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0091.587] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.587] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.588] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.588] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.588] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.588] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.588] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0091.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0091.589] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.589] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.589] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.589] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.589] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.589] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.589] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7aa58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0091.589] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0091.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0091.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7acd8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0091.590] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0091.590] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0091.590] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.590] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.590] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0091.591] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.591] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0091.591] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.591] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.591] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.591] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.591] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.591] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.591] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.591] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.591] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.591] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.591] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.591] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.591] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.591] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.591] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.591] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.592] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0091.592] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.592] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0091.592] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.592] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.592] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.592] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.592] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.592] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.592] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.592] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.592] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.592] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.592] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.592] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.592] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.592] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.592] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.593] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.593] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.593] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.593] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.593] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.593] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.593] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.593] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.593] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.593] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.593] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.593] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.593] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.593] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.593] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.593] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.593] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.593] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.594] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.594] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.594] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.594] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.594] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.594] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8acf0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0091.594] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0091.594] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0091.594] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.595] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.595] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.595] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983df0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.595] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0091.595] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983cf0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.596] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.596] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.596] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.596] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.596] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.596] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.597] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0091.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b788, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0091.597] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0091.597] CryptHashData (hHash=0xa7ce28, pbData=0x3983df0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0091.597] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.597] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.597] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.597] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.597] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.597] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.597] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.597] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.598] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.598] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.598] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.598] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.598] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.598] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0091.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b6b0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0091.598] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0091.598] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7ce28, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d068) returned 1 [0091.598] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.598] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.599] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.599] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.599] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.599] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.599] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.599] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.599] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.599] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.599] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.599] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7acf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0091.599] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0091.599] CryptDestroyHash (hHash=0xa7ce28) returned 1 [0091.600] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.600] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.601] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Y1zhfb0f.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\y1zhfb0f.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0091.601] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.601] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0091.601] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.601] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.601] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.601] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0091.602] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Lock.Y1zhfb0f.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\lock.y1zhfb0f.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0091.602] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.602] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.602] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.602] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.605] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0091.605] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x10000, lpOverlapped=0x0) returned 1 [0091.608] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x8e77, lpOverlapped=0x0) returned 1 [0091.609] ReadFile (in: hFile=0x240, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0091.619] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.619] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.619] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.619] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0091.621] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.621] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0091.622] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.622] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.622] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.623] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.623] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.623] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.623] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.623] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.623] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.623] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.623] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.623] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.623] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.623] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.624] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.624] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.624] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.624] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.624] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.624] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.624] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.624] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.624] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.624] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.624] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.624] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.624] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.624] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.624] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.624] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.624] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.624] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.625] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.625] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.625] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.626] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8acf0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.627] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.627] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x18e77, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x18e78) returned 1 [0091.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.627] CharLowerBuffW (in: lpsz="byte[102008]", cchLength=0xc | out: lpsz="byte[102008]") returned 0xc [0091.627] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.630] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.630] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.630] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.631] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.631] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.631] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.631] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8af90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.631] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.631] CryptEncrypt (in: hKey=0xa7d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c46e88*, pdwDataLen=0x8bef60*=0x18e77, dwBufLen=0x18e78 | out: pbData=0x3c46e88*, pdwDataLen=0x8bef60*=0x18e78) returned 1 [0091.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.635] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.635] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.636] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.636] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.636] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.636] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.636] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.636] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.636] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.636] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.636] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.636] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.636] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.636] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.636] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.636] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.636] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.636] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.636] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.636] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.637] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.648] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.648] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.648] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.650] WriteFile (in: hFile=0x24c, lpBuffer=0x2cb5028*, nNumberOfBytesToWrite=0x18e78, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2cb5028*, lpNumberOfBytesWritten=0x8bf5e4*=0x18e78, lpOverlapped=0x0) returned 1 [0091.653] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.653] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.653] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0091.653] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.653] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0091.653] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.653] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.653] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.653] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.653] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.653] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.653] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.653] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8a798, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0091.654] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0091.654] CryptDestroyKey (hKey=0xa7d068) returned 1 [0091.654] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.654] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.654] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.654] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.654] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.654] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.654] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.654] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.654] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.654] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.655] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.655] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.655] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.655] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.655] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.655] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.655] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.655] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.655] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.655] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.655] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.655] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.655] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.655] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.655] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.655] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.655] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.656] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.656] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.656] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.656] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.656] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.656] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.656] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.656] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.656] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.656] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.656] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.656] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.656] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.656] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.656] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.656] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.656] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.657] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.740] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.740] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.740] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.740] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.740] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.742] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.742] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7abd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0091.743] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0091.743] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0091.743] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.743] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.743] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.743] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.743] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.743] PeekMessageW (in: lpMsg=0x8bf138, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf138) returned 0 [0091.743] FreeLibrary (hLibModule=0x76a10000) returned 1 [0091.743] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.743] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.743] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.743] CloseHandle (hObject=0x240) returned 1 [0091.745] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.745] CloseHandle (hObject=0x24c) returned 1 [0091.754] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.757] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.757] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.757] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.757] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Y1zhfb0f.pps", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Y1zhfb0f.pps", lpFilePart=0x8bedf4*="Y1zhfb0f.pps") returned 0x2c [0091.757] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Y1zhfb0f.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\y1zhfb0f.pps")) returned 0x20 [0091.757] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Y1zhfb0f.pps", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7caa8 [0091.757] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Y1zhfb0f.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\y1zhfb0f.pps")) returned 1 [0091.765] FindNextFileW (in: hFindFile=0xa7caa8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0091.765] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0091.765] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.765] CharUpperBuffW (in: lpsz="UserProfileDir", cchLength=0xe | out: lpsz="USERPROFILEDIR") returned 0xe [0091.765] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x8bf438, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0091.765] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents/Y1zhfb0f.pps", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Y1zhfb0f.pps", lpFilePart=0x8bf650*="Y1zhfb0f.pps") returned 0x2c [0091.765] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Y1zhfb0f.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\y1zhfb0f.pps")) returned 0xffffffff [0091.766] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.766] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.766] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.766] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.766] CharUpperBuffW (in: lpsz="A1600E02A1D", cchLength=0xb | out: lpsz="A1600E02A1D") returned 0xb [0091.766] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.766] CharUpperBuffW (in: lpsz="SSA1600E02A1D", cchLength=0xd | out: lpsz="SSA1600E02A1D") returned 0xd [0091.766] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.766] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.766] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0091.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x2c8a438, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/]+\\z", lpUsedDefaultChar=0x0) returned 9 [0091.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\Public\\Documents", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0091.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\Public\\Documents", cchWideChar=26, lpMultiByteStr=0x2c876d8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\Public\\Documents", lpUsedDefaultChar=0x0) returned 26 [0091.767] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.767] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Documents\\" (normalized: "c:\\users\\public\\documents")) returned 0x11 [0091.767] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0091.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x2c7a978, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", lpUsedDefaultChar=0x0) returned 23 [0091.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x3983ed0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.*", lpUsedDefaultChar=0x0) returned 4 [0091.767] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.767] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.767] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0xa7cce8 [0091.775] FindNextFileW (in: hFindFile=0xa7cce8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0091.775] FindNextFileW (in: hFindFile=0xa7cce8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0091.776] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.776] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.776] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.776] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.776] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.776] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.776] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.776] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.776] FindNextFileW (in: hFindFile=0xa7cce8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0091.776] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.776] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.776] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.776] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.776] FindNextFileW (in: hFindFile=0xa7cce8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0091.776] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.776] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.777] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.777] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.777] FindNextFileW (in: hFindFile=0xa7cce8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0091.777] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.777] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.777] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.777] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.777] FindNextFileW (in: hFindFile=0xa7cce8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0 [0091.777] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.777] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.777] FindClose (in: hFindFile=0xa7cce8 | out: hFindFile=0xa7cce8) returned 1 [0091.778] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.778] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.778] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.778] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.778] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.778] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.778] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.778] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.779] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.779] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.779] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0091.779] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.779] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0091.779] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.779] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.779] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.779] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.779] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.779] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents/desktop.ini", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cb28 [0091.780] FindClose (in: hFindFile=0xa7cb28 | out: hFindFile=0xa7cb28) returned 1 [0091.781] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.781] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.781] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.781] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.781] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.781] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.782] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.782] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.782] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.782] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.782] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.783] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.783] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.783] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0091.783] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.783] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.783] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0091.783] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.783] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0091.783] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.783] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.783] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.783] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.783] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.784] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.784] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0091.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0091.784] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.784] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.784] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.784] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.784] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.784] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.784] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7a958, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0091.785] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0091.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0091.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7a998, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0091.785] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0091.785] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0091.786] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.786] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.786] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0091.786] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.786] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0091.786] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.786] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.786] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.786] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.786] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.786] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.786] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.787] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.787] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.787] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.787] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.787] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.787] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.787] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.787] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.787] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.787] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0091.787] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.787] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0091.787] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.791] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.791] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.791] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.791] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.791] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.791] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.791] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.791] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.791] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.791] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.791] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.791] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.791] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.791] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.792] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.792] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.792] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.792] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.792] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.792] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.792] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.792] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.792] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.792] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.792] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.792] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.792] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.792] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.792] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.792] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.792] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.792] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.792] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.792] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.793] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.793] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.793] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.793] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8bd40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0091.793] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0091.793] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0091.793] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.793] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.793] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.793] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b70, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.794] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0091.794] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983ce0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.794] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.794] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.794] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.794] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.794] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.794] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.794] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0091.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8be18, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0091.794] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0091.795] CryptHashData (hHash=0xa7d068, pbData=0x3983bd0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0091.795] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.795] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.795] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.795] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.795] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.795] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.795] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.795] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.795] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.795] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.795] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.795] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.795] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.795] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0091.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8bd40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0091.796] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0091.796] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d068, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d0a8) returned 1 [0091.796] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.796] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.796] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.796] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.796] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.796] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.796] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.796] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.796] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.796] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.796] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.796] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7a9f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0091.797] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0091.797] CryptDestroyHash (hHash=0xa7d068) returned 1 [0091.797] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.797] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.797] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.797] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.797] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.797] CreateFileW (lpFileName="C:\\Users\\Public\\Documents/desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0091.799] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.799] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0091.799] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.799] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.799] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.799] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Documents/" (normalized: "c:\\users\\public\\documents")) returned 0x11 [0091.799] CreateFileW (lpFileName="C:\\Users\\Public\\Documents/Lock.desktop.ini" (normalized: "c:\\users\\public\\documents\\lock.desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0091.800] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.800] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.800] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.800] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.803] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0091.803] ReadFile (in: hFile=0x24c, lpBuffer=0x2c94010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesRead=0x8bf4f8*=0x116, lpOverlapped=0x0) returned 1 [0091.805] ReadFile (in: hFile=0x24c, lpBuffer=0x2c94010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0091.807] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.807] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.807] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.807] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0091.807] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.807] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0091.807] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.807] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.807] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.808] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.808] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.808] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.808] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.808] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.808] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.808] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.808] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.808] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.808] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.808] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.808] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.808] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.808] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.808] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.808] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.808] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.808] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.809] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.809] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.809] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.809] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.809] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.809] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.809] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.809] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.809] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.809] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.809] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.809] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.809] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.809] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.809] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8bcb0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.809] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.810] CryptEncrypt (in: hKey=0xa7d0a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x116, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x118) returned 1 [0091.810] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.810] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.810] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.815] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.815] CharLowerBuffW (in: lpsz="byte[280]", cchLength=0x9 | out: lpsz="byte[280]") returned 0x9 [0091.815] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.815] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.815] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.815] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.815] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.815] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.815] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.815] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8bdd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.816] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.816] CryptEncrypt (in: hKey=0xa7d0a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c856a8*, pdwDataLen=0x8bef60*=0x116, dwBufLen=0x118 | out: pbData=0x2c856a8*, pdwDataLen=0x8bef60*=0x118) returned 1 [0091.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.816] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.816] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.816] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.816] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.816] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.816] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.816] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.816] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.816] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.817] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.817] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.817] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.817] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.817] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.817] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.817] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.817] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.817] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.817] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.817] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.817] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.817] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.817] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.817] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.817] WriteFile (in: hFile=0x240, lpBuffer=0x2c043b8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2c043b8*, lpNumberOfBytesWritten=0x8bf5e4*=0x118, lpOverlapped=0x0) returned 1 [0091.818] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.818] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.819] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0091.819] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.819] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0091.819] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.819] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.819] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.819] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.819] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.819] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.819] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.819] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8b950, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0091.819] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0091.820] CryptDestroyKey (hKey=0xa7d0a8) returned 1 [0091.820] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.820] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.820] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.820] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.820] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.820] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.820] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.820] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.820] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.820] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.820] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.820] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.820] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.820] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.820] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.820] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.821] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.821] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.821] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.821] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.821] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.821] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.821] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.821] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.821] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.821] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.821] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.821] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.821] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.821] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.821] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.821] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.821] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.822] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.822] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.822] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.822] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.822] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.822] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7aa98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0091.822] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0091.822] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0091.822] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.822] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.823] FreeLibrary (hLibModule=0x76a10000) returned 1 [0091.823] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.823] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.823] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.823] CloseHandle (hObject=0x24c) returned 1 [0091.824] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.824] CloseHandle (hObject=0x240) returned 1 [0091.827] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.828] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.828] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents/desktop.ini", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\Public\\Documents\\desktop.ini", lpFilePart=0x8bedf4*="desktop.ini") returned 0x25 [0091.828] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini")) returned 0x26 [0091.828] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\desktop.ini", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cc28 [0091.828] DeleteFileW (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini")) returned 1 [0091.829] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0091.829] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0091.829] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.830] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents/desktop.ini", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\Public\\Documents\\desktop.ini", lpFilePart=0x8bf650*="desktop.ini") returned 0x25 [0091.830] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini")) returned 0xffffffff [0091.830] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.830] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.830] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.830] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.830] CharUpperBuffW (in: lpsz="A1600E02A1D", cchLength=0xb | out: lpsz="A1600E02A1D") returned 0xb [0091.830] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.830] CharUpperBuffW (in: lpsz="SSA1600E02A1D", cchLength=0xd | out: lpsz="SSA1600E02A1D") returned 0xd [0091.830] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.830] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.830] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0091.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x2c8b968, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/]+\\z", lpUsedDefaultChar=0x0) returned 9 [0091.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\Public\\Pictures", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0091.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\Public\\Pictures", cchWideChar=25, lpMultiByteStr=0x2c87688, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\Public\\Pictures", lpUsedDefaultChar=0x0) returned 25 [0091.831] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.831] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\" (normalized: "c:\\users\\public\\pictures")) returned 0x11 [0091.831] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0091.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x2c7a958, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", lpUsedDefaultChar=0x0) returned 23 [0091.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x39839c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.*", lpUsedDefaultChar=0x0) returned 4 [0091.831] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.831] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.831] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0xa7caa8 [0091.831] FindNextFileW (in: hFindFile=0xa7caa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0091.831] FindNextFileW (in: hFindFile=0xa7caa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0091.831] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.832] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.832] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.837] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.837] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.837] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.837] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.837] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.837] FindNextFileW (in: hFindFile=0xa7caa8, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0 [0091.838] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.838] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.838] FindClose (in: hFindFile=0xa7caa8 | out: hFindFile=0xa7caa8) returned 1 [0091.838] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.838] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.838] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.838] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.838] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.838] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.839] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.839] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0091.839] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.839] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0091.839] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.839] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.839] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.839] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.839] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.839] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures/desktop.ini", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cda8 [0091.840] FindClose (in: hFindFile=0xa7cda8 | out: hFindFile=0xa7cda8) returned 1 [0091.840] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.840] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.840] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.840] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.840] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.840] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.840] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.840] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.840] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.840] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.840] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.840] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.840] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.840] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0091.841] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.841] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.841] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0091.841] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.841] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0091.841] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.841] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.841] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.841] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.841] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.841] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.841] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0091.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0091.841] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.842] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.842] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.842] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.842] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.842] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.842] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7ac38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0091.842] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0091.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0091.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ac38, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0091.843] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0091.843] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0091.843] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.843] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.843] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0091.843] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.843] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0091.843] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.843] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.844] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.844] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.844] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.844] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.844] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.844] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.844] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.844] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.844] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.844] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.844] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.844] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.844] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.844] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.844] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0091.844] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.844] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0091.844] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.844] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.844] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.845] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.845] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.845] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.845] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.845] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.845] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.845] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.845] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.845] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.845] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.845] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.846] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.846] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.846] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.846] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.846] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.846] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.846] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.846] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.846] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.846] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.846] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.846] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.846] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.846] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.846] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.846] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.846] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.846] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.846] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.846] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.847] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.847] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.847] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.847] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8b1a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0091.847] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0091.847] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0091.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.847] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.848] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983b60, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.848] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0091.848] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983c30, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.848] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.848] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.848] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.848] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.848] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.848] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.848] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0091.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8b0e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0091.849] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0091.849] CryptHashData (hHash=0xa7caa8, pbData=0x3983cb0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0091.849] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.849] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.849] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.851] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.851] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.851] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.852] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.852] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.852] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.852] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.852] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.852] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.852] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.852] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0091.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8b3c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0091.852] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0091.853] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7caa8, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7cb28) returned 1 [0091.853] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.853] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.853] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.853] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.853] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.853] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.853] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.853] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.853] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.853] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.853] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.853] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aa38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0091.854] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0091.854] CryptDestroyHash (hHash=0xa7caa8) returned 1 [0091.854] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.854] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.854] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.854] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.854] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.855] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures/desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0091.856] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.856] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0091.856] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.856] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.856] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.857] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures/" (normalized: "c:\\users\\public\\pictures")) returned 0x11 [0091.857] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures/Lock.desktop.ini" (normalized: "c:\\users\\public\\pictures\\lock.desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0091.857] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.857] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.857] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.857] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.860] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0091.860] ReadFile (in: hFile=0x240, lpBuffer=0x2c94010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesRead=0x8bf4f8*=0x17c, lpOverlapped=0x0) returned 1 [0091.862] ReadFile (in: hFile=0x240, lpBuffer=0x2c94010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0091.864] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.864] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.864] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.864] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0091.864] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.864] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0091.865] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.865] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.865] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.865] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.865] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.865] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.865] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.865] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.865] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.865] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.865] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.865] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.865] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.865] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.865] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.865] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.865] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.865] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.866] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.866] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.866] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.866] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.866] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.866] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.866] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.866] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.866] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.866] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.866] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.866] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.866] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.866] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.866] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.866] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.866] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.866] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b0f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.867] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.867] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x17c, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x180) returned 1 [0091.867] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.867] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.867] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.867] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.867] CharLowerBuffW (in: lpsz="byte[384]", cchLength=0x9 | out: lpsz="byte[384]") returned 0x9 [0091.867] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.867] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.867] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.867] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.867] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.868] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.868] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.868] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8b260, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.868] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.868] CryptEncrypt (in: hKey=0xa7cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c85338*, pdwDataLen=0x8bef60*=0x17c, dwBufLen=0x180 | out: pbData=0x2c85338*, pdwDataLen=0x8bef60*=0x180) returned 1 [0091.868] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.868] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.868] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.868] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.869] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.869] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.869] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.869] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.869] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.869] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.869] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.869] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.869] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.869] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.869] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.869] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.869] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.869] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.869] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.869] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.870] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.870] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.870] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.870] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.870] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.870] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.870] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.870] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.870] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.870] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.870] WriteFile (in: hFile=0x24c, lpBuffer=0x2c85028*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2c85028*, lpNumberOfBytesWritten=0x8bf5e4*=0x180, lpOverlapped=0x0) returned 1 [0091.873] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.873] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.874] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0091.874] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.874] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0091.874] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.874] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.874] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.874] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.874] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.874] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.874] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.874] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8ad38, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0091.875] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0091.875] CryptDestroyKey (hKey=0xa7cb28) returned 1 [0091.875] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.877] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.877] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.878] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.878] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.878] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.878] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.879] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.879] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.879] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.879] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.879] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.879] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.879] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.879] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.879] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.879] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.879] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.879] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.879] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.879] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.879] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.880] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.880] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.880] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.880] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.880] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.880] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.880] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.880] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.880] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.880] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.880] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.880] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.880] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.880] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.880] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.880] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.881] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.881] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.881] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.881] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.881] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.881] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.881] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0091.881] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0091.882] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0091.882] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.882] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.882] FreeLibrary (hLibModule=0x76a10000) returned 1 [0091.882] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.882] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.882] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.882] CloseHandle (hObject=0x240) returned 1 [0091.883] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.883] CloseHandle (hObject=0x24c) returned 1 [0091.888] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.888] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.888] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures/desktop.ini", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\Public\\Pictures\\desktop.ini", lpFilePart=0x8bedf4*="desktop.ini") returned 0x24 [0091.888] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini")) returned 0x26 [0091.888] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cca8 [0091.889] DeleteFileW (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini")) returned 1 [0091.890] FindNextFileW (in: hFindFile=0xa7cca8, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0091.890] FindClose (in: hFindFile=0xa7cca8 | out: hFindFile=0xa7cca8) returned 1 [0091.891] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.891] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures/desktop.ini", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\Public\\Pictures\\desktop.ini", lpFilePart=0x8bf650*="desktop.ini") returned 0x24 [0091.891] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini")) returned 0xffffffff [0091.891] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.891] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.891] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.891] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.891] CharUpperBuffW (in: lpsz="A1600E02A1D", cchLength=0xb | out: lpsz="A1600E02A1D") returned 0xb [0091.891] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.892] CharUpperBuffW (in: lpsz="SSA1600E02A1D", cchLength=0xd | out: lpsz="SSA1600E02A1D") returned 0xd [0091.892] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.892] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.892] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0091.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/]+\\z", cchWideChar=9, lpMultiByteStr=0x2c8a960, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/]+\\z", lpUsedDefaultChar=0x0) returned 9 [0091.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\Public\\Videos", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0091.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\Public\\Videos", cchWideChar=23, lpMultiByteStr=0x2c7ac38, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\Public\\Videos", lpUsedDefaultChar=0x0) returned 23 [0091.892] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.892] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos\\" (normalized: "c:\\users\\public\\videos")) returned 0x11 [0091.892] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0091.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", cchWideChar=23, lpMultiByteStr=0x2c7aa38, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[\\\\/:><\\|]|(?s)\\A\\s*\\z", lpUsedDefaultChar=0x0) returned 23 [0091.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="*.*", cchWideChar=4, lpMultiByteStr=0x3983ab0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.*", lpUsedDefaultChar=0x0) returned 4 [0091.893] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.893] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.893] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0xa7cc28 [0091.893] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0091.893] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 1 [0091.893] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.893] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.893] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.893] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.893] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.893] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.893] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.894] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.894] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf210 | out: lpFindFileData=0x8bf210) returned 0 [0091.894] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.894] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.894] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0091.894] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.894] PeekMessageW (in: lpMsg=0x8bf618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf618) returned 0 [0091.894] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.894] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.894] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 1 [0091.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=5, lpString2="Lock.", cchCount2=5) returned 3 [0091.895] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 1 [0091.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=6, lpString2="Fixed.", cchCount2=6) returned 3 [0091.895] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.895] CharUpperBuffW (in: lpsz="A0800602F25", cchLength=0xb | out: lpsz="A0800602F25") returned 0xb [0091.895] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.895] CharUpperBuffW (in: lpsz="SSA0800602F25", cchLength=0xd | out: lpsz="SSA0800602F25") returned 0xd [0091.895] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.895] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.895] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.895] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.895] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.895] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos/desktop.ini", lpFindFileData=0x8bf170 | out: lpFindFileData=0x8bf170) returned 0xa7cca8 [0091.896] FindClose (in: hFindFile=0xa7cca8 | out: hFindFile=0xa7cca8) returned 1 [0091.896] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.896] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.896] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.896] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.896] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.896] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.896] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.896] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.896] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.896] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.896] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.896] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.897] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.897] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x76a10000 [0091.897] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.897] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.897] CharUpperBuffW (in: lpsz="A5100B0033B", cchLength=0xb | out: lpsz="A5100B0033B") returned 0xb [0091.897] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.897] CharUpperBuffW (in: lpsz="SSA5100B0033B", cchLength=0xd | out: lpsz="SSA5100B0033B") returned 0xd [0091.897] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.897] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.897] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.897] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.897] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.897] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.897] CharUpperBuffW (in: lpsz="OSVersion", cchLength=0x9 | out: lpsz="OSVERSION") returned 0x9 [0091.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WIN_8", cchCount1=5, lpString2="WIN_2000", cchCount2=8) returned 3 [0091.898] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.898] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.898] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.899] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.899] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.899] PeekMessageW (in: lpMsg=0x8bf048, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf048) returned 0 [0091.899] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x2c7abb8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0091.899] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContext") returned 0x0 [0091.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0091.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x2c7ab18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0091.900] GetProcAddress (hModule=0x76a10000, lpProcName="CryptAcquireContextA") returned 0x76a30c00 [0091.900] CryptAcquireContextA (in: phProv=0x8befd8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8befd8*=0xa83730) returned 1 [0091.900] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.900] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.900] CharUpperBuffW (in: lpsz="A5C00D01B45", cchLength=0xb | out: lpsz="A5C00D01B45") returned 0xb [0091.901] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.901] CharUpperBuffW (in: lpsz="SSA5C00D01B45", cchLength=0xd | out: lpsz="SSA5C00D01B45") returned 0xd [0091.901] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.901] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.901] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.901] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.901] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.901] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.901] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.901] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.901] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.901] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.901] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.901] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.901] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.901] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.901] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.902] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.902] CharUpperBuffW (in: lpsz="A1400303223", cchLength=0xb | out: lpsz="A1400303223") returned 0xb [0091.902] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.902] CharUpperBuffW (in: lpsz="SSA1400303223", cchLength=0xd | out: lpsz="SSA1400303223") returned 0xd [0091.902] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.902] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.902] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.902] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.902] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.902] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.902] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.902] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.902] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.902] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.902] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.903] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.903] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.903] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.903] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.903] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.903] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.903] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.903] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.903] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.903] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.903] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.903] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.903] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.903] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.903] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.903] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.903] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.904] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.904] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.904] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.904] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.904] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.904] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.904] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.904] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.904] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.904] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.904] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x2c8bc98, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0091.905] GetProcAddress (hModule=0x76a10000, lpProcName="CryptCreateHash") returned 0x76a2f930 [0091.905] CryptCreateHash (in: hProv=0xa83730, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x8bef48 | out: phHash=0x8bef48) returned 1 [0091.905] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.905] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.905] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.905] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983db0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.905] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0091.905] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0091.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="888", cchWideChar=4, lpMultiByteStr=0x3983de0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="888", lpUsedDefaultChar=0x0) returned 4 [0091.906] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.906] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.906] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.906] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.906] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.906] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.906] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0091.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x2c8be00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0091.906] GetProcAddress (hModule=0x76a10000, lpProcName="CryptHashData") returned 0x76a2f950 [0091.906] CryptHashData (hHash=0xa7d068, pbData=0x3983eb0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0091.907] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.908] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.908] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.908] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.908] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.908] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.908] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.908] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.908] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.908] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.908] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.908] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.908] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.908] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0091.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x2c8bd70, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0091.909] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDeriveKey") returned 0x76a45b70 [0091.909] CryptDeriveKey (in: hProv=0xa83730, Algid=0x6601, hBaseData=0xa7d068, dwFlags=0x1, phKey=0x8bef48 | out: phKey=0x8bef48*=0xa7d0e8) returned 1 [0091.909] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.909] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.909] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.909] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.909] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.909] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.909] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.909] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.909] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.909] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.909] PeekMessageW (in: lpMsg=0x8bef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef40) returned 0 [0091.910] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0091.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x2c7aad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0091.910] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyHash") returned 0x76a2fbf0 [0091.910] CryptDestroyHash (hHash=0xa7d068) returned 1 [0091.910] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.910] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.910] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.910] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.910] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.911] CreateFileW (lpFileName="C:\\Users\\Public\\Videos/desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0091.912] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.912] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf2c0 | out: lpNewFilePointer=0x0) returned 1 [0091.912] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.912] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.912] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.912] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos/" (normalized: "c:\\users\\public\\videos")) returned 0x11 [0091.912] CreateFileW (lpFileName="C:\\Users\\Public\\Videos/Lock.desktop.ini" (normalized: "c:\\users\\public\\videos\\lock.desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0091.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.913] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.916] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf4e4 | out: lpNewFilePointer=0x0) returned 1 [0091.916] ReadFile (in: hFile=0x24c, lpBuffer=0x2c94010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesRead=0x8bf4f8*=0x17c, lpOverlapped=0x0) returned 1 [0091.918] ReadFile (in: hFile=0x24c, lpBuffer=0x2c94010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesRead=0x8bf4f8*=0x0, lpOverlapped=0x0) returned 1 [0091.921] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.921] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.921] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.921] CharUpperBuffW (in: lpsz="A5500504D32", cchLength=0xb | out: lpsz="A5500504D32") returned 0xb [0091.921] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.921] CharUpperBuffW (in: lpsz="SSA5500504D32", cchLength=0xd | out: lpsz="SSA5500504D32") returned 0xd [0091.921] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.921] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.922] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.922] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.922] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.922] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.922] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.922] CharUpperBuffW (in: lpsz="A600010211D", cchLength=0xb | out: lpsz="A600010211D") returned 0xb [0091.922] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.923] CharUpperBuffW (in: lpsz="SSA600010211D", cchLength=0xd | out: lpsz="SSA600010211D") returned 0xd [0091.923] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.923] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.923] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.923] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.923] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.923] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.923] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.924] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.924] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.924] CharUpperBuffW (in: lpsz="A6100801D27", cchLength=0xb | out: lpsz="A6100801D27") returned 0xb [0091.924] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.924] CharUpperBuffW (in: lpsz="SSA6100801D27", cchLength=0xd | out: lpsz="SSA6100801D27") returned 0xd [0091.924] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.924] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.924] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.924] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.924] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.924] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.924] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.924] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.924] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.924] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.924] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.924] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.925] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.925] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8be90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.925] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.925] CryptEncrypt (in: hKey=0xa7d0e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8bef60*=0x17c, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8bef60*=0x180) returned 1 [0091.925] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.925] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.925] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.925] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.925] CharLowerBuffW (in: lpsz="byte[384]", cchLength=0x9 | out: lpsz="byte[384]") returned 0x9 [0091.925] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.926] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.926] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.926] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.926] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.926] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.926] PeekMessageW (in: lpMsg=0x8bef58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bef58) returned 0 [0091.926] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0091.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x2c8bde8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0091.926] GetProcAddress (hModule=0x76a10000, lpProcName="CryptEncrypt") returned 0x76a45bd0 [0091.926] CryptEncrypt (in: hKey=0xa7d0e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c85338*, pdwDataLen=0x8bef60*=0x17c, dwBufLen=0x180 | out: pbData=0x2c85338*, pdwDataLen=0x8bef60*=0x180) returned 1 [0091.926] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.927] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.927] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.927] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.927] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.927] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.927] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.927] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.927] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.927] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.927] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.927] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.927] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.927] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.927] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.927] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.927] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.927] PeekMessageW (in: lpMsg=0x8beef8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beef8) returned 0 [0091.928] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.928] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.928] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.928] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.928] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.928] PeekMessageW (in: lpMsg=0x8bed58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed58) returned 0 [0091.928] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.928] PeekMessageW (in: lpMsg=0x8bf158, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf158) returned 0 [0091.928] PeekMessageW (in: lpMsg=0x8bf3b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3b8) returned 0 [0091.928] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.928] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.928] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.928] WriteFile (in: hFile=0x240, lpBuffer=0x2c85028*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x2c85028*, lpNumberOfBytesWritten=0x8bf5e4*=0x180, lpOverlapped=0x0) returned 1 [0091.929] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.929] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.930] CharUpperBuffW (in: lpsz="A2E00403421", cchLength=0xb | out: lpsz="A2E00403421") returned 0xb [0091.930] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.930] CharUpperBuffW (in: lpsz="SSA2E00403421", cchLength=0xd | out: lpsz="SSA2E00403421") returned 0xd [0091.930] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.930] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.930] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.930] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.930] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.930] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.930] PeekMessageW (in: lpMsg=0x8bedb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bedb0) returned 0 [0091.930] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x2c8b938, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0091.931] GetProcAddress (hModule=0x76a10000, lpProcName="CryptDestroyKey") returned 0x76a2fc10 [0091.931] CryptDestroyKey (hKey=0xa7d0e8) returned 1 [0091.931] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.931] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.931] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.931] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.931] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.931] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.931] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.931] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.931] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.931] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.931] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.931] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.931] PeekMessageW (in: lpMsg=0x8beee0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8beee0) returned 0 [0091.931] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.932] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.932] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.932] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.932] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.932] PeekMessageW (in: lpMsg=0x8bed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bed40) returned 0 [0091.932] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.932] PeekMessageW (in: lpMsg=0x8bf140, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf140) returned 0 [0091.932] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.932] PeekMessageW (in: lpMsg=0x8bf3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf3a0) returned 0 [0091.932] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.932] CharUpperBuffW (in: lpsz="A2000200E4C", cchLength=0xb | out: lpsz="A2000200E4C") returned 0xb [0091.932] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.932] CharUpperBuffW (in: lpsz="SSA2000200E4C", cchLength=0xd | out: lpsz="SSA2000200E4C") returned 0xd [0091.932] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.932] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.932] CharUpperBuffW (in: lpsz="A1B00900434", cchLength=0xb | out: lpsz="A1B00900434") returned 0xb [0091.932] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.933] CharUpperBuffW (in: lpsz="SSA1B00900434", cchLength=0xd | out: lpsz="SSA1B00900434") returned 0xd [0091.933] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.933] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.933] PeekMessageW (in: lpMsg=0x8bf248, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf248) returned 0 [0091.933] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.933] CharUpperBuffW (in: lpsz="A6000700A63", cchLength=0xb | out: lpsz="A6000700A63") returned 0xb [0091.933] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.933] CharUpperBuffW (in: lpsz="SSA6000700A63", cchLength=0xd | out: lpsz="SSA6000700A63") returned 0xd [0091.933] PeekMessageW (in: lpMsg=0x8bf0a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf0a8) returned 0 [0091.933] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.933] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.933] CharUpperBuffW (in: lpsz="A6300C02155", cchLength=0xb | out: lpsz="A6300C02155") returned 0xb [0091.933] CharUpperBuffW (in: lpsz="SSA6300C02155", cchLength=0xd | out: lpsz="SSA6300C02155") returned 0xd [0091.933] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0091.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0091.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x2c7ac98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0091.934] GetProcAddress (hModule=0x76a10000, lpProcName="CryptReleaseContext") returned 0x76a30ad0 [0091.934] CryptReleaseContext (hProv=0xa83730, dwFlags=0x0) returned 1 [0091.934] CharUpperBuffW (in: lpsz="A0700A0430B", cchLength=0xb | out: lpsz="A0700A0430B") returned 0xb [0091.934] CharUpperBuffW (in: lpsz="SSA0700A0430B", cchLength=0xd | out: lpsz="SSA0700A0430B") returned 0xd [0091.934] FreeLibrary (hLibModule=0x76a10000) returned 1 [0091.934] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.935] PeekMessageW (in: lpMsg=0x8bf4a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf4a8) returned 0 [0091.935] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.935] CloseHandle (hObject=0x24c) returned 1 [0091.936] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.936] CloseHandle (hObject=0x240) returned 1 [0091.939] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0091.939] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.939] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos/desktop.ini", nBufferLength=0x104, lpBuffer=0x8bee18, lpFilePart=0x8bedf4 | out: lpBuffer="C:\\Users\\Public\\Videos\\desktop.ini", lpFilePart=0x8bedf4*="desktop.ini") returned 0x22 [0091.939] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini")) returned 0x26 [0091.939] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\desktop.ini", lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0xa7cc28 [0091.939] DeleteFileW (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini")) returned 1 [0091.941] FindNextFileW (in: hFindFile=0xa7cc28, lpFindFileData=0x8bf028 | out: lpFindFileData=0x8bf028) returned 0 [0091.941] FindClose (in: hFindFile=0xa7cc28 | out: hFindFile=0xa7cc28) returned 1 [0091.941] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.941] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos/desktop.ini", nBufferLength=0x104, lpBuffer=0x8bf65c, lpFilePart=0x8bf650 | out: lpBuffer="C:\\Users\\Public\\Videos\\desktop.ini", lpFilePart=0x8bf650*="desktop.ini") returned 0x22 [0091.941] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini")) returned 0xffffffff [0091.941] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.941] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.941] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.941] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.941] CharUpperBuffW (in: lpsz="TempDir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0091.941] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0091.942] CreateFileW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0091.943] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.943] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf814 | out: lpNewFilePointer=0x0) returned 1 [0091.943] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.943] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf7f4 | out: lpNewFilePointer=0x0) returned 1 [0091.943] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf808 | out: lpNewFilePointer=0x0) returned 1 [0091.943] ReadFile (in: hFile=0x240, lpBuffer=0x2c94010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8bf81c, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesRead=0x8bf81c*=0x0, lpOverlapped=0x0) returned 1 [0091.944] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.944] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x8bf7f4 | out: lpNewFilePointer=0x0) returned 1 [0091.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0091.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x3983bd0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0091.945] WriteFile (in: hFile=0x240, lpBuffer=0x2c8b5f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x8bf818, lpOverlapped=0x0 | out: lpBuffer=0x2c8b5f0*, lpNumberOfBytesWritten=0x8bf818*=0x0, lpOverlapped=0x0) returned 1 [0091.945] CloseHandle (hObject=0x240) returned 1 [0091.945] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0091.945] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0091.945] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0091.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0091.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x3983bc0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0091.945] SetLastError (dwErrCode=0x0) [0091.945] GetLastError () returned 0x0 [0091.945] SetLastError (dwErrCode=0x0) [0091.945] GetLastError () returned 0x0 [0091.945] SetLastError (dwErrCode=0x0) [0091.945] GetLastError () returned 0x0 [0091.946] SetLastError (dwErrCode=0x0) [0091.946] GetLastError () returned 0x0 [0091.946] SetLastError (dwErrCode=0x0) [0091.946] GetLastError () returned 0x0 [0091.946] SetLastError (dwErrCode=0x0) [0091.946] GetLastError () returned 0x0 [0091.946] SetLastError (dwErrCode=0x0) [0091.946] GetLastError () returned 0x0 [0091.946] SetLastError (dwErrCode=0x0) [0091.946] GetLastError () returned 0x0 [0091.946] SetLastError (dwErrCode=0x0) [0091.946] GetLastError () returned 0x0 [0091.946] SetLastError (dwErrCode=0x0) [0091.946] GetLastError () returned 0x0 [0091.946] SetLastError (dwErrCode=0x0) [0091.946] GetLastError () returned 0x0 [0091.946] SetLastError (dwErrCode=0x0) [0091.946] GetLastError () returned 0x0 [0091.946] SetLastError (dwErrCode=0x0) [0091.946] GetLastError () returned 0x0 [0091.946] SetLastError (dwErrCode=0x0) [0091.946] GetLastError () returned 0x0 [0091.946] SetLastError (dwErrCode=0x0) [0091.946] GetLastError () returned 0x0 [0091.947] SetLastError (dwErrCode=0x0) [0091.947] GetLastError () returned 0x0 [0091.947] SetLastError (dwErrCode=0x0) [0091.947] GetLastError () returned 0x0 [0091.947] SetLastError (dwErrCode=0x0) [0091.947] GetLastError () returned 0x0 [0091.947] SetLastError (dwErrCode=0x0) [0091.947] GetLastError () returned 0x0 [0091.947] SetLastError (dwErrCode=0x0) [0091.947] GetLastError () returned 0x0 [0091.947] SetLastError (dwErrCode=0x0) [0091.947] GetLastError () returned 0x0 [0091.947] SetLastError (dwErrCode=0x0) [0091.947] GetLastError () returned 0x0 [0091.947] SetLastError (dwErrCode=0x0) [0091.947] GetLastError () returned 0x0 [0091.947] SetLastError (dwErrCode=0x0) [0091.947] GetLastError () returned 0x0 [0091.947] SetLastError (dwErrCode=0x0) [0091.947] GetLastError () returned 0x0 [0091.947] SetLastError (dwErrCode=0x0) [0091.947] GetLastError () returned 0x0 [0091.948] SetLastError (dwErrCode=0x0) [0091.948] GetLastError () returned 0x0 [0091.948] SetLastError (dwErrCode=0x0) [0091.948] GetLastError () returned 0x0 [0091.948] SetLastError (dwErrCode=0x0) [0091.948] GetLastError () returned 0x0 [0091.948] SetLastError (dwErrCode=0x0) [0091.948] GetLastError () returned 0x0 [0091.948] SetLastError (dwErrCode=0x0) [0091.948] GetLastError () returned 0x0 [0091.948] SetLastError (dwErrCode=0x0) [0091.948] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TempCHHKSM.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tempchhksm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x8beb5c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x240 [0091.948] GetFileType (hFile=0x240) returned 0x1 [0091.948] ReadFile (in: hFile=0x240, lpBuffer=0x8aec74, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8aeb60, lpOverlapped=0x0 | out: lpBuffer=0x8aec74*, lpNumberOfBytesRead=0x8aeb60*=0x10000, lpOverlapped=0x0) returned 1 [0091.949] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10000 [0091.949] SetFilePointer (in: hFile=0x240, lDistanceToMove=65516, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffec [0091.949] ReadFile (in: hFile=0x240, lpBuffer=0x8aec74, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8aeb60, lpOverlapped=0x0 | out: lpBuffer=0x8aec74*, lpNumberOfBytesRead=0x8aeb60*=0x10000, lpOverlapped=0x0) returned 1 [0091.949] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ffec [0091.949] SetFilePointer (in: hFile=0x240, lDistanceToMove=131032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ffd8 [0091.949] ReadFile (in: hFile=0x240, lpBuffer=0x8aec74, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8aeb60, lpOverlapped=0x0 | out: lpBuffer=0x8aec74*, lpNumberOfBytesRead=0x8aeb60*=0x10000, lpOverlapped=0x0) returned 1 [0091.949] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ffd8 [0091.949] SetFilePointer (in: hFile=0x240, lDistanceToMove=196548, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2ffc4 [0091.949] ReadFile (in: hFile=0x240, lpBuffer=0x8aec74, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8aeb60, lpOverlapped=0x0 | out: lpBuffer=0x8aec74*, lpNumberOfBytesRead=0x8aeb60*=0x10000, lpOverlapped=0x0) returned 1 [0091.950] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ffc4 [0091.950] SetFilePointer (in: hFile=0x240, lDistanceToMove=262064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ffb0 [0091.950] ReadFile (in: hFile=0x240, lpBuffer=0x8aec74, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8aeb60, lpOverlapped=0x0 | out: lpBuffer=0x8aec74*, lpNumberOfBytesRead=0x8aeb60*=0x10000, lpOverlapped=0x0) returned 1 [0091.950] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ffb0 [0091.950] SetFilePointer (in: hFile=0x240, lDistanceToMove=327580, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ff9c [0091.950] ReadFile (in: hFile=0x240, lpBuffer=0x8aec74, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8aeb60, lpOverlapped=0x0 | out: lpBuffer=0x8aec74*, lpNumberOfBytesRead=0x8aeb60*=0x10000, lpOverlapped=0x0) returned 1 [0091.950] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5ff9c [0091.950] SetFilePointer (in: hFile=0x240, lDistanceToMove=393096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5ff88 [0091.951] ReadFile (in: hFile=0x240, lpBuffer=0x8aec74, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8aeb60, lpOverlapped=0x0 | out: lpBuffer=0x8aec74*, lpNumberOfBytesRead=0x8aeb60*=0x10000, lpOverlapped=0x0) returned 1 [0091.951] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ff88 [0091.951] SetFilePointer (in: hFile=0x240, lDistanceToMove=458612, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ff74 [0091.951] ReadFile (in: hFile=0x240, lpBuffer=0x8aec74, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8aeb60, lpOverlapped=0x0 | out: lpBuffer=0x8aec74*, lpNumberOfBytesRead=0x8aeb60*=0x10000, lpOverlapped=0x0) returned 1 [0091.951] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ff74 [0091.951] SetFilePointer (in: hFile=0x240, lDistanceToMove=524128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ff60 [0091.951] ReadFile (in: hFile=0x240, lpBuffer=0x8aec74, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8aeb60, lpOverlapped=0x0 | out: lpBuffer=0x8aec74*, lpNumberOfBytesRead=0x8aeb60*=0x10000, lpOverlapped=0x0) returned 1 [0091.951] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ff60 [0091.951] SetFilePointer (in: hFile=0x240, lDistanceToMove=589644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ff4c [0091.951] ReadFile (in: hFile=0x240, lpBuffer=0x8aec74, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8aeb60, lpOverlapped=0x0 | out: lpBuffer=0x8aec74*, lpNumberOfBytesRead=0x8aeb60*=0x10000, lpOverlapped=0x0) returned 1 [0091.952] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ff4c [0091.952] SetFilePointer (in: hFile=0x240, lDistanceToMove=655160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9ff38 [0091.952] ReadFile (in: hFile=0x240, lpBuffer=0x8aec74, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x8aeb60, lpOverlapped=0x0 | out: lpBuffer=0x8aec74*, lpNumberOfBytesRead=0x8aeb60*=0x10000, lpOverlapped=0x0) returned 1 [0091.952] SetFilePointer (in: hFile=0x240, lDistanceToMove=665108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2614 [0091.952] ReadFile (in: hFile=0x240, lpBuffer=0x2c94010, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8aeb44, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesRead=0x8aeb44*=0x1000, lpOverlapped=0x0) returned 1 [0091.952] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa3614 [0091.952] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\wl.jpg")) returned 0xffffffff [0091.952] FindFirstFileW (in: lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", lpFindFileData=0x8bebe0 | out: lpFindFileData=0x8bebe0) returned 0xffffffff [0091.952] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8adc54 | out: lpSystemTimeAsFileTime=0x8adc54*(dwLowDateTime=0x392d2f9a, dwHighDateTime=0x1d47206)) [0091.953] SetFilePointer (in: hFile=0x240, lDistanceToMove=665128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2628 [0091.953] ReadFile (in: hFile=0x240, lpBuffer=0x2c94010, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8ad718, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesRead=0x8ad718*=0x200, lpOverlapped=0x0) returned 1 [0091.953] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2828 [0091.953] SetFilePointer (in: hFile=0x240, lDistanceToMove=665273, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa26b9 [0091.953] ReadFile (in: hFile=0x240, lpBuffer=0x2c94010, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8ad718, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesRead=0x8ad718*=0x200, lpOverlapped=0x0) returned 1 [0091.953] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa28b9 [0091.953] SetFilePointer (in: hFile=0x240, lDistanceToMove=681921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa67c1 [0091.953] ReadFile (in: hFile=0x240, lpBuffer=0x2c94010, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x8ad718, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesRead=0x8ad718*=0x200, lpOverlapped=0x0) returned 1 [0091.953] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8ada68 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0091.953] GetTempFileNameW (in: lpPathName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\", lpPrefixString="aut", uUnique=0x0, lpTempFileName=0x8ae128 | out: lpTempFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\aut9F83.tmp" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\aut9f83.tmp")) returned 0x9f83 [0091.954] CreateFileW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\aut9F83.tmp" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\aut9f83.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x8adb3c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0091.954] GetFileType (hFile=0x24c) returned 0x1 [0091.954] ReadFile (in: hFile=0x240, lpBuffer=0x8aefbb, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x8adb78, lpOverlapped=0x0 | out: lpBuffer=0x8aefbb*, lpNumberOfBytesRead=0x8adb78*=0xf000, lpOverlapped=0x0) returned 1 [0091.954] ReadFile (in: hFile=0x240, lpBuffer=0x2c94010, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8adb68, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesRead=0x8adb68*=0x1000, lpOverlapped=0x0) returned 1 [0091.957] WriteFile (in: hFile=0x24c, lpBuffer=0x8aee48*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x8ac0dc, lpOverlapped=0x0 | out: lpBuffer=0x8aee48*, lpNumberOfBytesWritten=0x8ac0dc*=0x10000, lpOverlapped=0x0) returned 1 [0091.959] ReadFile (in: hFile=0x240, lpBuffer=0x8aefbb, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x8adb78, lpOverlapped=0x0 | out: lpBuffer=0x8aefbb*, lpNumberOfBytesRead=0x8adb78*=0xf000, lpOverlapped=0x0) returned 1 [0091.959] ReadFile (in: hFile=0x240, lpBuffer=0x2c94010, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8adb68, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesRead=0x8adb68*=0x1000, lpOverlapped=0x0) returned 1 [0091.962] WriteFile (in: hFile=0x24c, lpBuffer=0x8aee48*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x8ac0dc, lpOverlapped=0x0 | out: lpBuffer=0x8aee48*, lpNumberOfBytesWritten=0x8ac0dc*=0x10000, lpOverlapped=0x0) returned 1 [0091.963] ReadFile (in: hFile=0x240, lpBuffer=0x8aefbb, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x8adb78, lpOverlapped=0x0 | out: lpBuffer=0x8aefbb*, lpNumberOfBytesRead=0x8adb78*=0x7000, lpOverlapped=0x0) returned 1 [0091.963] ReadFile (in: hFile=0x240, lpBuffer=0x2c94010, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8adb68, lpOverlapped=0x0 | out: lpBuffer=0x2c94010*, lpNumberOfBytesRead=0x8adb68*=0xea6, lpOverlapped=0x0) returned 1 [0091.964] WriteFile (in: hFile=0x24c, lpBuffer=0x8aee48*, nNumberOfBytesToWrite=0x7000, lpNumberOfBytesWritten=0x8ac0dc, lpOverlapped=0x0 | out: lpBuffer=0x8aee48*, lpNumberOfBytesWritten=0x8ac0dc*=0x7000, lpOverlapped=0x0) returned 1 [0091.964] WriteFile (in: hFile=0x24c, lpBuffer=0x2c95018*, nNumberOfBytesToWrite=0x9da, lpNumberOfBytesWritten=0x8ac0ec, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesWritten=0x8ac0ec*=0x9da, lpOverlapped=0x0) returned 1 [0091.965] CloseHandle (hObject=0x24c) returned 1 [0092.013] CreateFileW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\aut9F83.tmp" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\aut9f83.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x8adb28, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0092.013] GetFileType (hFile=0x24c) returned 0x1 [0092.013] CreateFileW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\wl.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x8adb28, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x250 [0092.014] GetFileType (hFile=0x250) returned 0x1 [0092.014] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8adb38, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8adb38*=0x1000, lpOverlapped=0x0) returned 1 [0092.014] ReadFile (in: hFile=0x24c, lpBuffer=0x2cb7020, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x8adb20, lpOverlapped=0x0 | out: lpBuffer=0x2cb7020*, lpNumberOfBytesRead=0x8adb20*=0xf000, lpOverlapped=0x0) returned 1 [0092.015] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8adb10, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8adb10*=0x1000, lpOverlapped=0x0) returned 1 [0092.018] WriteFile (in: hFile=0x250, lpBuffer=0x2cc6030*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x8ac084, lpOverlapped=0x0 | out: lpBuffer=0x2cc6030*, lpNumberOfBytesWritten=0x8ac084*=0x10000, lpOverlapped=0x0) returned 1 [0092.021] ReadFile (in: hFile=0x24c, lpBuffer=0x2cb7020, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x8adb20, lpOverlapped=0x0 | out: lpBuffer=0x2cb7020*, lpNumberOfBytesRead=0x8adb20*=0xf000, lpOverlapped=0x0) returned 1 [0092.021] ReadFile (in: hFile=0x24c, lpBuffer=0x2c95018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8adb10, lpOverlapped=0x0 | out: lpBuffer=0x2c95018*, lpNumberOfBytesRead=0x8adb10*=0x1000, lpOverlapped=0x0) returned 1 [0092.023] WriteFile (in: hFile=0x250, lpBuffer=0x2cc6030*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x8ac084, lpOverlapped=0x0 | out: lpBuffer=0x2cc6030*, lpNumberOfBytesWritten=0x8ac084*=0x10000, lpOverlapped=0x0) returned 1 [0092.025] ReadFile (in: hFile=0x24c, lpBuffer=0x2cb7020, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x8adb20, lpOverlapped=0x0 | out: lpBuffer=0x2cb7020*, lpNumberOfBytesRead=0x8adb20*=0x69da, lpOverlapped=0x0) returned 1 [0092.025] ReadFile (in: hFile=0x24c, lpBuffer=0x2cbd9fa, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x8adb20, lpOverlapped=0x0 | out: lpBuffer=0x2cbd9fa*, lpNumberOfBytesRead=0x8adb20*=0x0, lpOverlapped=0x0) returned 1 [0092.026] WriteFile (in: hFile=0x250, lpBuffer=0x2cc6030*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x8ac084, lpOverlapped=0x0 | out: lpBuffer=0x2cc6030*, lpNumberOfBytesWritten=0x8ac084*=0x10000, lpOverlapped=0x0) returned 1 [0092.028] WriteFile (in: hFile=0x250, lpBuffer=0x2cc6030*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x8ac09c, lpOverlapped=0x0 | out: lpBuffer=0x2cc6030*, lpNumberOfBytesWritten=0x8ac09c*=0x3000, lpOverlapped=0x0) returned 1 [0092.031] CloseHandle (hObject=0x24c) returned 1 [0092.032] WriteFile (in: hFile=0x250, lpBuffer=0x2cd6038*, nNumberOfBytesToWrite=0x7bc, lpNumberOfBytesWritten=0x8ac0d4, lpOverlapped=0x0 | out: lpBuffer=0x2cd6038*, lpNumberOfBytesWritten=0x8ac0d4*=0x7bc, lpOverlapped=0x0) returned 1 [0092.032] CloseHandle (hObject=0x250) returned 1 [0092.039] DeleteFileW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\aut9F83.tmp" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\aut9f83.tmp")) returned 1 [0092.042] CreateFileW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\wl.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x250 [0092.042] SetFileTime (hFile=0x250, lpCreationTime=0x8adcb0, lpLastAccessTime=0x0, lpLastWriteTime=0x8adcb8) returned 1 [0092.042] CloseHandle (hObject=0x250) returned 1 [0092.042] CloseHandle (hObject=0x240) returned 1 [0092.043] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 1 [0092.043] TranslateMessage (lpMsg=0x8bf968) returned 0 [0092.043] DispatchMessageW (lpMsg=0x8bf968) returned 0x0 [0092.043] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0092.043] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0092.043] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0092.043] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0092.043] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0092.043] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0092.043] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0092.043] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0092.043] timeGetTime () returned 0x29fe0 [0092.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.044] Sleep (dwMilliseconds=0xa) [0092.102] timeGetTime () returned 0x2a01e [0092.102] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.102] Sleep (dwMilliseconds=0xa) [0092.160] timeGetTime () returned 0x2a05c [0092.160] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.160] Sleep (dwMilliseconds=0xa) [0092.226] timeGetTime () returned 0x2a09b [0092.226] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.227] Sleep (dwMilliseconds=0xa) [0092.264] timeGetTime () returned 0x2a0ba [0092.264] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.264] Sleep (dwMilliseconds=0xa) [0092.332] timeGetTime () returned 0x2a108 [0092.332] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.332] Sleep (dwMilliseconds=0xa) [0092.349] timeGetTime () returned 0x2a118 [0092.349] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.349] Sleep (dwMilliseconds=0xa) [0092.363] timeGetTime () returned 0x2a128 [0092.363] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.363] Sleep (dwMilliseconds=0xa) [0092.391] timeGetTime () returned 0x2a147 [0092.391] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.391] Sleep (dwMilliseconds=0xa) [0092.451] timeGetTime () returned 0x2a176 [0092.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.451] Sleep (dwMilliseconds=0xa) [0092.511] timeGetTime () returned 0x2a1b4 [0092.511] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.511] Sleep (dwMilliseconds=0xa) [0092.553] timeGetTime () returned 0x2a1e3 [0092.553] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.553] Sleep (dwMilliseconds=0xa) [0092.591] timeGetTime () returned 0x2a203 [0092.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.591] Sleep (dwMilliseconds=0xa) [0092.614] timeGetTime () returned 0x2a222 [0092.614] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.614] Sleep (dwMilliseconds=0xa) [0092.638] timeGetTime () returned 0x2a231 [0092.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.638] Sleep (dwMilliseconds=0xa) [0092.683] timeGetTime () returned 0x2a262 [0092.683] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.683] Sleep (dwMilliseconds=0xa) [0092.718] timeGetTime () returned 0x2a27f [0092.718] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.718] Sleep (dwMilliseconds=0xa) [0092.748] timeGetTime () returned 0x2a29f [0092.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.748] Sleep (dwMilliseconds=0xa) [0092.814] timeGetTime () returned 0x2a2ed [0092.814] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0092.814] TranslateMessage (lpMsg=0x8bf798) returned 0 [0092.814] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0092.814] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0092.814] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0092.815] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.815] Sleep (dwMilliseconds=0xa) [0092.842] timeGetTime () returned 0x2a2fc [0092.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.842] Sleep (dwMilliseconds=0xa) [0092.870] timeGetTime () returned 0x2a31c [0092.870] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.870] Sleep (dwMilliseconds=0xa) [0092.961] timeGetTime () returned 0x2a379 [0092.961] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.961] Sleep (dwMilliseconds=0xa) [0092.996] timeGetTime () returned 0x2a399 [0092.996] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0092.996] Sleep (dwMilliseconds=0xa) [0093.024] timeGetTime () returned 0x2a3b8 [0093.024] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0093.024] Sleep (dwMilliseconds=0xa) [0093.061] timeGetTime () returned 0x2a3d7 [0093.062] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0093.062] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0093.062] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0093.062] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0093.062] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0093.062] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0093.063] RegCloseKey (hKey=0x240) returned 0x0 [0093.063] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0093.063] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0093.063] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0093.063] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0093.063] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0093.064] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.064] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.065] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.066] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.067] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0093.067] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.068] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.069] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.070] CharUpperBuffW (in: lpsz="A5F0000370B", cchLength=0xb | out: lpsz="A5F0000370B") returned 0xb [0093.070] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf228, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf228) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0093.070] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0093.070] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0093.071] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0093.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0093.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a998, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0093.071] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0093.071] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0093.088] FreeLibrary (hLibModule=0x77150000) returned 1 [0093.088] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0093.088] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0093.088] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0093.088] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0093.088] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0093.088] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0093.088] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0093.088] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0093.088] timeGetTime () returned 0x2a3f6 [0093.088] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0093.088] Sleep (dwMilliseconds=0xa) [0093.144] timeGetTime () returned 0x2a435 [0093.144] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0093.144] Sleep (dwMilliseconds=0xa) [0093.401] timeGetTime () returned 0x2a52f [0093.401] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0093.401] Sleep (dwMilliseconds=0xa) [0093.505] timeGetTime () returned 0x2a59c [0093.505] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0093.505] Sleep (dwMilliseconds=0xa) [0093.605] timeGetTime () returned 0x2a5fa [0093.605] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0093.605] TranslateMessage (lpMsg=0x8bf798) returned 0 [0093.605] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0093.605] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0093.605] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0093.605] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0093.605] Sleep (dwMilliseconds=0xa) [0093.653] timeGetTime () returned 0x2a629 [0093.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0093.654] Sleep (dwMilliseconds=0xa) [0093.692] timeGetTime () returned 0x2a658 [0093.692] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0093.692] Sleep (dwMilliseconds=0xa) [0093.768] timeGetTime () returned 0x2a6a7 [0093.768] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0093.768] Sleep (dwMilliseconds=0xa) [0093.816] timeGetTime () returned 0x2a6d5 [0093.816] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0093.816] Sleep (dwMilliseconds=0xa) [0093.923] timeGetTime () returned 0x2a742 [0093.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0093.923] Sleep (dwMilliseconds=0xa) [0093.960] timeGetTime () returned 0x2a761 [0093.960] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0093.960] Sleep (dwMilliseconds=0xa) [0094.034] timeGetTime () returned 0x2a7af [0094.034] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0094.034] Sleep (dwMilliseconds=0xa) [0094.057] timeGetTime () returned 0x2a7bf [0094.057] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0094.057] Sleep (dwMilliseconds=0xa) [0094.137] timeGetTime () returned 0x2a80d [0094.137] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0094.137] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0094.137] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0094.137] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0094.137] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0094.137] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0094.137] RegCloseKey (hKey=0x240) returned 0x0 [0094.137] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0094.137] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0094.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0094.138] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0094.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0094.138] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0094.138] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0094.138] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0094.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0094.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aad8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0094.138] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0094.138] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0094.269] FreeLibrary (hLibModule=0x77150000) returned 1 [0094.269] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0094.269] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0094.269] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0094.269] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0094.269] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0094.269] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0094.270] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0094.270] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0094.270] timeGetTime () returned 0x2a89a [0094.270] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0094.270] Sleep (dwMilliseconds=0xa) [0094.367] timeGetTime () returned 0x2a8f8 [0094.367] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0094.367] TranslateMessage (lpMsg=0x8bf798) returned 0 [0094.367] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0094.367] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0094.367] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0094.367] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0094.367] Sleep (dwMilliseconds=0xa) [0094.545] timeGetTime () returned 0x2a9a3 [0094.545] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0094.545] Sleep (dwMilliseconds=0xa) [0094.608] timeGetTime () returned 0x2a9e2 [0094.608] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0094.608] Sleep (dwMilliseconds=0xa) [0094.645] timeGetTime () returned 0x2aa11 [0094.645] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0094.645] Sleep (dwMilliseconds=0xa) [0094.700] timeGetTime () returned 0x2aa40 [0094.700] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0094.700] Sleep (dwMilliseconds=0xa) [0094.748] timeGetTime () returned 0x2aa6f [0094.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0094.748] Sleep (dwMilliseconds=0xa) [0094.819] timeGetTime () returned 0x2aabd [0094.819] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0094.819] Sleep (dwMilliseconds=0xa) [0094.864] timeGetTime () returned 0x2aaec [0094.864] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0094.864] Sleep (dwMilliseconds=0xa) [0094.881] timeGetTime () returned 0x2aafb [0094.881] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0094.881] Sleep (dwMilliseconds=0xa) [0094.973] timeGetTime () returned 0x2ab59 [0094.973] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0094.973] Sleep (dwMilliseconds=0xa) [0095.093] timeGetTime () returned 0x2abc6 [0095.093] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.093] Sleep (dwMilliseconds=0xa) [0095.203] timeGetTime () returned 0x2ac34 [0095.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0095.203] TranslateMessage (lpMsg=0x8bf798) returned 0 [0095.203] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0095.203] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0095.203] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0095.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.203] Sleep (dwMilliseconds=0xa) [0095.228] timeGetTime () returned 0x2ac54 [0095.228] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.228] Sleep (dwMilliseconds=0xa) [0095.350] timeGetTime () returned 0x2acd0 [0095.350] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0095.350] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0095.350] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0095.350] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0095.351] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0095.351] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0095.351] RegCloseKey (hKey=0x240) returned 0x0 [0095.351] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0095.351] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0095.351] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0095.351] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0095.351] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0095.351] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0095.351] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0095.351] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0095.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0095.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0095.352] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0095.352] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0095.441] FreeLibrary (hLibModule=0x77150000) returned 1 [0095.441] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0095.441] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0095.441] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0095.441] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0095.441] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0095.441] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0095.441] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0095.441] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0095.442] timeGetTime () returned 0x2ad2e [0095.442] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.442] Sleep (dwMilliseconds=0xa) [0095.504] timeGetTime () returned 0x2ad6d [0095.504] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.504] Sleep (dwMilliseconds=0xa) [0095.550] timeGetTime () returned 0x2ad9b [0095.550] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.550] Sleep (dwMilliseconds=0xa) [0095.597] timeGetTime () returned 0x2adcb [0095.597] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.597] Sleep (dwMilliseconds=0xa) [0095.651] timeGetTime () returned 0x2adf9 [0095.651] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.651] Sleep (dwMilliseconds=0xa) [0095.689] timeGetTime () returned 0x2ae28 [0095.689] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.689] Sleep (dwMilliseconds=0xa) [0095.723] timeGetTime () returned 0x2ae47 [0095.723] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.723] Sleep (dwMilliseconds=0xa) [0095.740] timeGetTime () returned 0x2ae57 [0095.740] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.740] Sleep (dwMilliseconds=0xa) [0095.777] timeGetTime () returned 0x2ae76 [0095.777] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.777] Sleep (dwMilliseconds=0xa) [0095.812] timeGetTime () returned 0x2ae95 [0095.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.812] Sleep (dwMilliseconds=0xa) [0095.856] timeGetTime () returned 0x2aec4 [0095.856] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.856] Sleep (dwMilliseconds=0xa) [0095.915] timeGetTime () returned 0x2af02 [0095.915] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.915] Sleep (dwMilliseconds=0xa) [0095.988] timeGetTime () returned 0x2af51 [0095.988] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0095.988] TranslateMessage (lpMsg=0x8bf798) returned 0 [0095.988] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0095.988] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0095.988] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0095.988] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0095.988] Sleep (dwMilliseconds=0xa) [0096.014] timeGetTime () returned 0x2af60 [0096.014] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.014] Sleep (dwMilliseconds=0xa) [0096.050] timeGetTime () returned 0x2af8f [0096.050] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.050] Sleep (dwMilliseconds=0xa) [0096.105] timeGetTime () returned 0x2afbe [0096.105] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.105] Sleep (dwMilliseconds=0xa) [0096.139] timeGetTime () returned 0x2afdd [0096.139] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.139] Sleep (dwMilliseconds=0xa) [0096.236] timeGetTime () returned 0x2b04b [0096.236] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.236] Sleep (dwMilliseconds=0xa) [0096.373] timeGetTime () returned 0x2b0c8 [0096.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.373] Sleep (dwMilliseconds=0xa) [0096.400] timeGetTime () returned 0x2b0e7 [0096.400] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.400] Sleep (dwMilliseconds=0xa) [0096.428] timeGetTime () returned 0x2b106 [0096.428] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.428] Sleep (dwMilliseconds=0xa) [0096.463] timeGetTime () returned 0x2b125 [0096.463] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0096.463] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0096.463] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0096.463] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0096.463] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0096.463] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0096.463] RegCloseKey (hKey=0x240) returned 0x0 [0096.464] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0096.464] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0096.464] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0096.464] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0096.464] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0096.464] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0096.464] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0096.464] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0096.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0096.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab18, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0096.464] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0096.464] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0096.567] FreeLibrary (hLibModule=0x77150000) returned 1 [0096.567] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0096.567] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0096.567] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0096.567] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0096.568] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0096.568] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0096.568] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0096.568] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0096.568] timeGetTime () returned 0x2b193 [0096.568] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.568] Sleep (dwMilliseconds=0xa) [0096.632] timeGetTime () returned 0x2b1d1 [0096.632] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.632] Sleep (dwMilliseconds=0xa) [0096.694] timeGetTime () returned 0x2b210 [0096.694] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.694] Sleep (dwMilliseconds=0xa) [0096.739] timeGetTime () returned 0x2b23f [0096.739] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0096.739] TranslateMessage (lpMsg=0x8bf798) returned 0 [0096.739] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0096.739] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0096.739] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0096.740] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.740] Sleep (dwMilliseconds=0xa) [0096.805] timeGetTime () returned 0x2b27d [0096.805] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.805] Sleep (dwMilliseconds=0xa) [0096.864] timeGetTime () returned 0x2b2bc [0096.864] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.864] Sleep (dwMilliseconds=0xa) [0096.937] timeGetTime () returned 0x2b2fa [0096.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.937] Sleep (dwMilliseconds=0xa) [0096.983] timeGetTime () returned 0x2b329 [0096.983] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0096.983] Sleep (dwMilliseconds=0xa) [0097.016] timeGetTime () returned 0x2b348 [0097.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.016] Sleep (dwMilliseconds=0xa) [0097.083] timeGetTime () returned 0x2b396 [0097.083] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.083] Sleep (dwMilliseconds=0xa) [0097.114] timeGetTime () returned 0x2b3b6 [0097.114] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.114] Sleep (dwMilliseconds=0xa) [0097.137] timeGetTime () returned 0x2b3c5 [0097.137] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.137] Sleep (dwMilliseconds=0xa) [0097.180] timeGetTime () returned 0x2b3f6 [0097.180] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.180] Sleep (dwMilliseconds=0xa) [0097.217] timeGetTime () returned 0x2b413 [0097.217] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.217] Sleep (dwMilliseconds=0xa) [0097.236] timeGetTime () returned 0x2b433 [0097.236] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.236] Sleep (dwMilliseconds=0xa) [0097.268] timeGetTime () returned 0x2b452 [0097.268] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.268] Sleep (dwMilliseconds=0xa) [0097.421] timeGetTime () returned 0x2b4de [0097.421] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.421] Sleep (dwMilliseconds=0xa) [0097.537] timeGetTime () returned 0x2b55b [0097.537] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0097.538] TranslateMessage (lpMsg=0x8bf798) returned 0 [0097.538] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0097.538] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0097.538] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0097.538] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.538] Sleep (dwMilliseconds=0xa) [0097.584] timeGetTime () returned 0x2b58a [0097.584] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0097.584] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0097.584] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0097.584] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0097.584] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0097.584] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0097.584] RegCloseKey (hKey=0x240) returned 0x0 [0097.584] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0097.584] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0097.584] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0097.585] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0097.585] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0097.585] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0097.585] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0097.585] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac98, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0097.585] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0097.585] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0097.688] FreeLibrary (hLibModule=0x77150000) returned 1 [0097.688] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0097.688] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0097.689] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0097.689] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0097.689] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0097.689] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0097.689] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0097.689] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0097.689] timeGetTime () returned 0x2b5f8 [0097.689] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.689] Sleep (dwMilliseconds=0xa) [0097.746] timeGetTime () returned 0x2b627 [0097.746] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.746] Sleep (dwMilliseconds=0xa) [0097.791] timeGetTime () returned 0x2b655 [0097.791] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.791] Sleep (dwMilliseconds=0xa) [0097.883] timeGetTime () returned 0x2b6b6 [0097.883] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.883] Sleep (dwMilliseconds=0xa) [0097.926] timeGetTime () returned 0x2b6e2 [0097.926] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.926] Sleep (dwMilliseconds=0xa) [0097.971] timeGetTime () returned 0x2b711 [0097.971] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0097.971] Sleep (dwMilliseconds=0xa) [0098.027] timeGetTime () returned 0x2b740 [0098.027] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.027] Sleep (dwMilliseconds=0xa) [0098.081] timeGetTime () returned 0x2b77e [0098.081] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.081] Sleep (dwMilliseconds=0xa) [0098.114] timeGetTime () returned 0x2b79e [0098.114] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.114] Sleep (dwMilliseconds=0xa) [0098.156] timeGetTime () returned 0x2b7bd [0098.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.156] Sleep (dwMilliseconds=0xa) [0098.212] timeGetTime () returned 0x2b7fc [0098.212] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.212] Sleep (dwMilliseconds=0xa) [0098.261] timeGetTime () returned 0x2b82a [0098.261] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.261] Sleep (dwMilliseconds=0xa) [0098.288] timeGetTime () returned 0x2b84a [0098.288] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0098.288] TranslateMessage (lpMsg=0x8bf798) returned 0 [0098.289] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0098.289] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0098.289] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0098.289] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.289] Sleep (dwMilliseconds=0xa) [0098.332] timeGetTime () returned 0x2b87a [0098.332] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.332] Sleep (dwMilliseconds=0xa) [0098.350] timeGetTime () returned 0x2b888 [0098.350] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.350] Sleep (dwMilliseconds=0xa) [0098.626] timeGetTime () returned 0x2b9a1 [0098.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.626] Sleep (dwMilliseconds=0xa) [0098.657] timeGetTime () returned 0x2b9c0 [0098.657] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.657] Sleep (dwMilliseconds=0xa) [0098.677] timeGetTime () returned 0x2b9d0 [0098.677] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.677] Sleep (dwMilliseconds=0xa) [0098.737] timeGetTime () returned 0x2ba0f [0098.737] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0098.737] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0098.737] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0098.737] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0098.737] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0098.737] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0098.737] RegCloseKey (hKey=0x240) returned 0x0 [0098.737] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0098.737] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0098.737] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0098.737] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0098.737] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0098.738] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0098.738] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0098.738] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0098.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0098.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9f8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0098.738] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0098.738] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0098.845] FreeLibrary (hLibModule=0x77150000) returned 1 [0098.845] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0098.845] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0098.845] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0098.845] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0098.845] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0098.845] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0098.845] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0098.845] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0098.845] timeGetTime () returned 0x2ba7c [0098.845] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.845] Sleep (dwMilliseconds=0xa) [0098.894] timeGetTime () returned 0x2baab [0098.894] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.894] Sleep (dwMilliseconds=0xa) [0098.940] timeGetTime () returned 0x2bada [0098.940] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.940] Sleep (dwMilliseconds=0xa) [0098.990] timeGetTime () returned 0x2bb09 [0098.990] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0098.990] Sleep (dwMilliseconds=0xa) [0099.034] timeGetTime () returned 0x2bb37 [0099.034] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.034] Sleep (dwMilliseconds=0xa) [0099.081] timeGetTime () returned 0x2bb66 [0099.081] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0099.081] TranslateMessage (lpMsg=0x8bf798) returned 0 [0099.081] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0099.081] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0099.081] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0099.082] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.082] Sleep (dwMilliseconds=0xa) [0099.142] timeGetTime () returned 0x2bba5 [0099.142] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.142] Sleep (dwMilliseconds=0xa) [0099.189] timeGetTime () returned 0x2bbd4 [0099.189] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.189] Sleep (dwMilliseconds=0xa) [0099.220] timeGetTime () returned 0x2bbf3 [0099.220] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.220] Sleep (dwMilliseconds=0xa) [0099.245] timeGetTime () returned 0x2bc03 [0099.245] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.245] Sleep (dwMilliseconds=0xa) [0099.268] timeGetTime () returned 0x2bc22 [0099.269] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.269] Sleep (dwMilliseconds=0xa) [0099.305] timeGetTime () returned 0x2bc41 [0099.305] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.305] Sleep (dwMilliseconds=0xa) [0099.331] timeGetTime () returned 0x2bc60 [0099.331] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.331] Sleep (dwMilliseconds=0xa) [0099.368] timeGetTime () returned 0x2bc80 [0099.368] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.368] Sleep (dwMilliseconds=0xa) [0099.394] timeGetTime () returned 0x2bc9f [0099.394] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.394] Sleep (dwMilliseconds=0xa) [0099.438] timeGetTime () returned 0x2bcce [0099.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.438] Sleep (dwMilliseconds=0xa) [0099.550] timeGetTime () returned 0x2bd3b [0099.550] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.551] Sleep (dwMilliseconds=0xa) [0099.617] timeGetTime () returned 0x2bd7a [0099.617] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.617] Sleep (dwMilliseconds=0xa) [0099.703] timeGetTime () returned 0x2bdc8 [0099.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.703] Sleep (dwMilliseconds=0xa) [0099.731] timeGetTime () returned 0x2bde7 [0099.731] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.731] Sleep (dwMilliseconds=0xa) [0099.785] timeGetTime () returned 0x2be25 [0099.785] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.785] Sleep (dwMilliseconds=0xa) [0099.877] timeGetTime () returned 0x2be83 [0099.877] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 1 [0099.877] TranslateMessage (lpMsg=0x8bf968) returned 0 [0099.877] DispatchMessageW (lpMsg=0x8bf968) returned 0x0 [0099.877] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0099.877] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0099.877] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0099.877] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0099.877] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0099.877] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0099.878] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0099.878] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0099.878] RegCloseKey (hKey=0x240) returned 0x0 [0099.878] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0099.878] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0099.878] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0099.878] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0099.878] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0099.878] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0099.878] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0099.878] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0099.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0099.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0099.879] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0099.879] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0099.970] FreeLibrary (hLibModule=0x77150000) returned 1 [0099.970] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0099.970] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0099.970] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0099.970] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0099.970] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0099.970] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0099.970] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0099.970] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0099.970] timeGetTime () returned 0x2bee1 [0099.971] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0099.971] Sleep (dwMilliseconds=0xa) [0100.064] timeGetTime () returned 0x2bf3f [0100.064] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.064] Sleep (dwMilliseconds=0xa) [0100.153] timeGetTime () returned 0x2bf8f [0100.153] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.153] Sleep (dwMilliseconds=0xa) [0100.210] timeGetTime () returned 0x2bfcc [0100.210] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.210] Sleep (dwMilliseconds=0xa) [0100.281] timeGetTime () returned 0x2c00a [0100.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.281] Sleep (dwMilliseconds=0xa) [0100.351] timeGetTime () returned 0x2c058 [0100.351] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.351] Sleep (dwMilliseconds=0xa) [0100.399] timeGetTime () returned 0x2c087 [0100.399] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.399] Sleep (dwMilliseconds=0xa) [0100.476] timeGetTime () returned 0x2c0d5 [0100.476] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.476] Sleep (dwMilliseconds=0xa) [0100.582] timeGetTime () returned 0x2c142 [0100.582] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.582] Sleep (dwMilliseconds=0xa) [0100.626] timeGetTime () returned 0x2c171 [0100.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0100.626] TranslateMessage (lpMsg=0x8bf798) returned 0 [0100.626] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0100.626] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0100.626] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0100.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.626] Sleep (dwMilliseconds=0xa) [0100.678] timeGetTime () returned 0x2c1a0 [0100.678] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.678] Sleep (dwMilliseconds=0xa) [0100.748] timeGetTime () returned 0x2c1df [0100.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.748] Sleep (dwMilliseconds=0xa) [0100.803] timeGetTime () returned 0x2c21d [0100.803] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.803] Sleep (dwMilliseconds=0xa) [0100.898] timeGetTime () returned 0x2c27b [0100.898] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.898] Sleep (dwMilliseconds=0xa) [0100.932] timeGetTime () returned 0x2c29a [0100.932] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.932] Sleep (dwMilliseconds=0xa) [0100.958] timeGetTime () returned 0x2c2b9 [0100.958] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0100.958] Sleep (dwMilliseconds=0xa) [0101.000] timeGetTime () returned 0x2c2d9 [0101.000] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0101.000] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0101.000] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0101.000] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0101.000] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0101.000] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0101.002] RegCloseKey (hKey=0x240) returned 0x0 [0101.002] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0101.002] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0101.002] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0101.002] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0101.002] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0101.002] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0101.003] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0101.003] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0101.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0101.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0101.003] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0101.003] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0101.095] FreeLibrary (hLibModule=0x77150000) returned 1 [0101.095] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0101.095] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0101.095] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0101.095] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0101.095] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0101.096] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0101.096] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0101.096] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0101.096] timeGetTime () returned 0x2c346 [0101.096] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.096] Sleep (dwMilliseconds=0xa) [0101.145] timeGetTime () returned 0x2c375 [0101.145] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.145] Sleep (dwMilliseconds=0xa) [0101.228] timeGetTime () returned 0x2c3c3 [0101.228] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.228] Sleep (dwMilliseconds=0xa) [0101.274] timeGetTime () returned 0x2c3f2 [0101.274] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.274] Sleep (dwMilliseconds=0xa) [0101.316] timeGetTime () returned 0x2c421 [0101.316] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.316] Sleep (dwMilliseconds=0xa) [0101.371] timeGetTime () returned 0x2c450 [0101.371] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.371] Sleep (dwMilliseconds=0xa) [0101.411] timeGetTime () returned 0x2c47e [0101.411] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0101.411] TranslateMessage (lpMsg=0x8bf798) returned 0 [0101.411] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0101.411] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0101.411] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0101.411] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.411] Sleep (dwMilliseconds=0xa) [0101.456] timeGetTime () returned 0x2c4ad [0101.456] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.456] Sleep (dwMilliseconds=0xa) [0101.538] timeGetTime () returned 0x2c4fb [0101.538] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.538] Sleep (dwMilliseconds=0xa) [0101.683] timeGetTime () returned 0x2c588 [0101.683] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.683] Sleep (dwMilliseconds=0xa) [0101.714] timeGetTime () returned 0x2c5a7 [0101.714] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.714] Sleep (dwMilliseconds=0xa) [0101.769] timeGetTime () returned 0x2c5e6 [0101.769] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.769] Sleep (dwMilliseconds=0xa) [0101.787] timeGetTime () returned 0x2c5f5 [0101.787] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.787] Sleep (dwMilliseconds=0xa) [0101.836] timeGetTime () returned 0x2c624 [0101.836] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.836] Sleep (dwMilliseconds=0xa) [0101.879] timeGetTime () returned 0x2c653 [0101.879] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.879] Sleep (dwMilliseconds=0xa) [0101.910] timeGetTime () returned 0x2c672 [0101.910] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.910] Sleep (dwMilliseconds=0xa) [0101.949] timeGetTime () returned 0x2c693 [0101.949] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0101.949] Sleep (dwMilliseconds=0xa) [0102.001] timeGetTime () returned 0x2c6d0 [0102.001] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.001] Sleep (dwMilliseconds=0xa) [0102.019] timeGetTime () returned 0x2c6e0 [0102.019] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.019] Sleep (dwMilliseconds=0xa) [0102.041] timeGetTime () returned 0x2c6f1 [0102.041] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.041] Sleep (dwMilliseconds=0xa) [0102.095] timeGetTime () returned 0x2c72e [0102.096] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0102.096] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0102.096] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0102.096] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0102.096] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0102.096] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0102.096] RegCloseKey (hKey=0x240) returned 0x0 [0102.096] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0102.096] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0102.096] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0102.097] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0102.097] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0102.097] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0102.097] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0102.097] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0102.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0102.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aab8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0102.097] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0102.097] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0102.189] FreeLibrary (hLibModule=0x77150000) returned 1 [0102.189] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0102.189] TranslateMessage (lpMsg=0x8bf708) returned 0 [0102.189] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0102.189] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0102.189] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0102.189] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0102.189] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0102.189] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0102.189] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0102.189] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0102.189] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0102.190] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0102.190] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0102.190] timeGetTime () returned 0x2c78c [0102.190] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.190] Sleep (dwMilliseconds=0xa) [0102.265] timeGetTime () returned 0x2c7ca [0102.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.265] Sleep (dwMilliseconds=0xa) [0102.308] timeGetTime () returned 0x2c7f9 [0102.308] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.308] Sleep (dwMilliseconds=0xa) [0102.361] timeGetTime () returned 0x2c838 [0102.361] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.361] Sleep (dwMilliseconds=0xa) [0102.409] timeGetTime () returned 0x2c866 [0102.409] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.409] Sleep (dwMilliseconds=0xa) [0102.456] timeGetTime () returned 0x2c895 [0102.456] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.456] Sleep (dwMilliseconds=0xa) [0102.565] timeGetTime () returned 0x2c903 [0102.565] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.565] Sleep (dwMilliseconds=0xa) [0102.596] timeGetTime () returned 0x2c922 [0102.596] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.596] Sleep (dwMilliseconds=0xa) [0102.651] timeGetTime () returned 0x2c951 [0102.651] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.651] Sleep (dwMilliseconds=0xa) [0102.802] timeGetTime () returned 0x2c9ed [0102.802] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.802] Sleep (dwMilliseconds=0xa) [0102.848] timeGetTime () returned 0x2ca1c [0102.848] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.848] Sleep (dwMilliseconds=0xa) [0102.898] timeGetTime () returned 0x2ca4b [0102.898] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.898] Sleep (dwMilliseconds=0xa) [0102.926] timeGetTime () returned 0x2ca6a [0102.926] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.926] Sleep (dwMilliseconds=0xa) [0102.940] timeGetTime () returned 0x2ca7a [0102.940] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0102.940] TranslateMessage (lpMsg=0x8bf798) returned 0 [0102.940] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0102.940] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0102.940] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0102.940] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.941] Sleep (dwMilliseconds=0xa) [0102.973] timeGetTime () returned 0x2ca99 [0102.973] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0102.973] Sleep (dwMilliseconds=0xa) [0103.015] timeGetTime () returned 0x2cabb [0103.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.015] Sleep (dwMilliseconds=0xa) [0103.088] timeGetTime () returned 0x2cb06 [0103.088] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.088] Sleep (dwMilliseconds=0xa) [0103.135] timeGetTime () returned 0x2cb35 [0103.135] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.135] Sleep (dwMilliseconds=0xa) [0103.168] timeGetTime () returned 0x2cb54 [0103.168] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.168] Sleep (dwMilliseconds=0xa) [0103.189] timeGetTime () returned 0x2cb74 [0103.189] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0103.189] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0103.189] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0103.189] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0103.190] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0103.190] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0103.190] RegCloseKey (hKey=0x240) returned 0x0 [0103.190] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0103.190] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0103.190] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0103.190] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0103.190] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0103.190] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0103.190] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0103.190] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0103.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0103.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab18, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0103.191] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0103.191] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0103.332] FreeLibrary (hLibModule=0x77150000) returned 1 [0103.332] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0103.332] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0103.332] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0103.332] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0103.332] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0103.332] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0103.332] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0103.332] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0103.332] timeGetTime () returned 0x2cc03 [0103.332] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.333] Sleep (dwMilliseconds=0xa) [0103.390] timeGetTime () returned 0x2cc30 [0103.391] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.391] Sleep (dwMilliseconds=0xa) [0103.471] timeGetTime () returned 0x2cc8d [0103.471] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.471] Sleep (dwMilliseconds=0xa) [0103.521] timeGetTime () returned 0x2ccbc [0103.521] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.521] Sleep (dwMilliseconds=0xa) [0103.569] timeGetTime () returned 0x2cceb [0103.569] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.569] Sleep (dwMilliseconds=0xa) [0103.659] timeGetTime () returned 0x2cd48 [0103.659] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.659] Sleep (dwMilliseconds=0xa) [0103.696] timeGetTime () returned 0x2cd68 [0103.696] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0103.697] TranslateMessage (lpMsg=0x8bf798) returned 0 [0103.697] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0103.697] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0103.697] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0103.697] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.697] Sleep (dwMilliseconds=0xa) [0103.740] timeGetTime () returned 0x2cd97 [0103.740] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.740] Sleep (dwMilliseconds=0xa) [0103.773] timeGetTime () returned 0x2cdb6 [0103.773] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.773] Sleep (dwMilliseconds=0xa) [0103.940] timeGetTime () returned 0x2ce62 [0103.940] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.940] Sleep (dwMilliseconds=0xa) [0103.979] timeGetTime () returned 0x2ce81 [0103.979] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0103.979] Sleep (dwMilliseconds=0xa) [0104.032] timeGetTime () returned 0x2ceb0 [0104.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0104.032] Sleep (dwMilliseconds=0xa) [0104.069] timeGetTime () returned 0x2cedf [0104.069] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0104.069] Sleep (dwMilliseconds=0xa) [0104.114] timeGetTime () returned 0x2cf0e [0104.115] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0104.115] Sleep (dwMilliseconds=0xa) [0104.137] timeGetTime () returned 0x2cf1d [0104.137] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0104.137] Sleep (dwMilliseconds=0xa) [0104.208] timeGetTime () returned 0x2cf6b [0104.208] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0104.208] Sleep (dwMilliseconds=0xa) [0104.258] timeGetTime () returned 0x2cf9a [0104.258] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0104.258] Sleep (dwMilliseconds=0xa) [0104.312] timeGetTime () returned 0x2cfc9 [0104.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0104.312] Sleep (dwMilliseconds=0xa) [0104.332] timeGetTime () returned 0x2cfe8 [0104.333] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0104.333] Sleep (dwMilliseconds=0xa) [0104.366] timeGetTime () returned 0x2d008 [0104.367] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0104.367] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0104.367] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0104.367] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0104.367] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0104.367] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0104.367] RegCloseKey (hKey=0x240) returned 0x0 [0104.367] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0104.367] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0104.367] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0104.367] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0104.367] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0104.367] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0104.367] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0104.367] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0104.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0104.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab18, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0104.368] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0104.368] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0104.598] FreeLibrary (hLibModule=0x77150000) returned 1 [0104.598] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0104.598] TranslateMessage (lpMsg=0x8bf708) returned 0 [0104.598] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0104.598] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0104.598] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0104.598] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0104.598] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0104.598] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0104.598] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0104.599] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0104.599] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0104.599] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0104.599] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0104.599] timeGetTime () returned 0x2d0f2 [0104.599] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0104.599] Sleep (dwMilliseconds=0xa) [0104.677] timeGetTime () returned 0x2d140 [0104.677] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0104.677] Sleep (dwMilliseconds=0xa) [0104.756] timeGetTime () returned 0x2d18e [0104.756] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0104.756] Sleep (dwMilliseconds=0xa) [0104.846] timeGetTime () returned 0x2d1ec [0104.846] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0104.846] Sleep (dwMilliseconds=0xa) [0105.076] timeGetTime () returned 0x2d2c7 [0105.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0105.076] Sleep (dwMilliseconds=0xa) [0105.161] timeGetTime () returned 0x2d324 [0105.161] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0105.161] Sleep (dwMilliseconds=0xa) [0105.312] timeGetTime () returned 0x2d3b1 [0105.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0105.312] Sleep (dwMilliseconds=0xa) [0105.416] timeGetTime () returned 0x2d41e [0105.416] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0105.416] TranslateMessage (lpMsg=0x8bf798) returned 0 [0105.416] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0105.416] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0105.416] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0105.417] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0105.417] Sleep (dwMilliseconds=0xa) [0105.504] timeGetTime () returned 0x2d47c [0105.504] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0105.505] Sleep (dwMilliseconds=0xa) [0105.559] timeGetTime () returned 0x2d4ab [0105.559] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0105.559] Sleep (dwMilliseconds=0xa) [0105.595] timeGetTime () returned 0x2d4da [0105.595] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0105.595] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0105.595] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0105.595] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0105.596] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0105.596] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0105.596] RegCloseKey (hKey=0x240) returned 0x0 [0105.596] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0105.596] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0105.596] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0105.596] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0105.596] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0105.596] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0105.596] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0105.596] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0105.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0105.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a958, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0105.597] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0105.597] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0105.704] FreeLibrary (hLibModule=0x77150000) returned 1 [0105.704] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0105.704] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0105.704] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0105.704] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0105.704] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0105.704] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0105.705] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0105.705] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0105.705] timeGetTime () returned 0x2d547 [0105.705] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0105.705] Sleep (dwMilliseconds=0xa) [0105.779] timeGetTime () returned 0x2d586 [0105.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0105.779] Sleep (dwMilliseconds=0xa) [0105.815] timeGetTime () returned 0x2d5b5 [0105.815] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0105.815] Sleep (dwMilliseconds=0xa) [0105.865] timeGetTime () returned 0x2d5e4 [0105.865] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0105.865] Sleep (dwMilliseconds=0xa) [0105.917] timeGetTime () returned 0x2d612 [0105.917] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0105.917] Sleep (dwMilliseconds=0xa) [0106.020] timeGetTime () returned 0x2d680 [0106.020] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.020] Sleep (dwMilliseconds=0xa) [0106.135] timeGetTime () returned 0x2d6ed [0106.135] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.135] Sleep (dwMilliseconds=0xa) [0106.190] timeGetTime () returned 0x2d72c [0106.190] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0106.200] TranslateMessage (lpMsg=0x8bf798) returned 0 [0106.200] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0106.200] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0106.200] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0106.200] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.201] Sleep (dwMilliseconds=0xa) [0106.232] timeGetTime () returned 0x2d74b [0106.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.232] Sleep (dwMilliseconds=0xa) [0106.257] timeGetTime () returned 0x2d76a [0106.257] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.257] Sleep (dwMilliseconds=0xa) [0106.283] timeGetTime () returned 0x2d789 [0106.283] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.283] Sleep (dwMilliseconds=0xa) [0106.344] timeGetTime () returned 0x2d7b8 [0106.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.344] Sleep (dwMilliseconds=0xa) [0106.373] timeGetTime () returned 0x2d7d8 [0106.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.373] Sleep (dwMilliseconds=0xa) [0106.394] timeGetTime () returned 0x2d7f7 [0106.394] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.394] Sleep (dwMilliseconds=0xa) [0106.457] timeGetTime () returned 0x2d835 [0106.457] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.457] Sleep (dwMilliseconds=0xa) [0106.510] timeGetTime () returned 0x2d864 [0106.510] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.510] Sleep (dwMilliseconds=0xa) [0106.558] timeGetTime () returned 0x2d893 [0106.558] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.558] Sleep (dwMilliseconds=0xa) [0106.611] timeGetTime () returned 0x2d8d2 [0106.611] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.611] Sleep (dwMilliseconds=0xa) [0106.637] timeGetTime () returned 0x2d8e1 [0106.637] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.637] Sleep (dwMilliseconds=0xa) [0106.685] timeGetTime () returned 0x2d910 [0106.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.685] Sleep (dwMilliseconds=0xa) [0106.741] timeGetTime () returned 0x2d94f [0106.741] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0106.741] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0106.741] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0106.741] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0106.741] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0106.741] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0106.742] RegCloseKey (hKey=0x240) returned 0x0 [0106.742] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0106.742] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0106.742] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0106.742] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0106.742] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0106.742] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0106.742] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0106.742] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0106.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0106.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a998, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0106.743] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0106.743] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0106.829] FreeLibrary (hLibModule=0x77150000) returned 1 [0106.830] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0106.830] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0106.830] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0106.830] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0106.830] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0106.830] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0106.830] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0106.830] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0106.830] timeGetTime () returned 0x2d9ac [0106.830] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.830] Sleep (dwMilliseconds=0xa) [0106.939] timeGetTime () returned 0x2da1a [0106.939] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0106.939] TranslateMessage (lpMsg=0x8bf798) returned 0 [0106.939] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0106.939] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0106.939] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0106.939] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0106.939] Sleep (dwMilliseconds=0xa) [0107.090] timeGetTime () returned 0x2daae [0107.090] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0107.090] Sleep (dwMilliseconds=0xa) [0107.333] timeGetTime () returned 0x2dba0 [0107.333] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0107.333] Sleep (dwMilliseconds=0xa) [0107.417] timeGetTime () returned 0x2dbee [0107.417] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0107.417] Sleep (dwMilliseconds=0xa) [0107.563] timeGetTime () returned 0x2dc7b [0107.563] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0107.569] Sleep (dwMilliseconds=0xa) [0107.640] timeGetTime () returned 0x2dcc9 [0107.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0107.640] Sleep (dwMilliseconds=0xa) [0107.660] timeGetTime () returned 0x2dce8 [0107.660] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0107.660] Sleep (dwMilliseconds=0xa) [0107.680] timeGetTime () returned 0x2dcf8 [0107.680] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0107.680] Sleep (dwMilliseconds=0xa) [0107.706] timeGetTime () returned 0x2dd17 [0107.706] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0107.706] TranslateMessage (lpMsg=0x8bf798) returned 0 [0107.706] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0107.706] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0107.706] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0107.707] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0107.707] Sleep (dwMilliseconds=0xa) [0107.760] timeGetTime () returned 0x2dd46 [0107.760] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0107.760] Sleep (dwMilliseconds=0xa) [0107.801] timeGetTime () returned 0x2dd75 [0107.801] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0107.801] Sleep (dwMilliseconds=0xa) [0107.847] timeGetTime () returned 0x2dda4 [0107.847] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0107.847] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0107.847] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0107.847] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0107.847] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0107.847] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0107.848] RegCloseKey (hKey=0x240) returned 0x0 [0107.848] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0107.848] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0107.848] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0107.848] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0107.848] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0107.848] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0107.848] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0107.848] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0107.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0107.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0107.849] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0107.849] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0107.939] FreeLibrary (hLibModule=0x77150000) returned 1 [0107.939] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0107.939] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0107.939] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0107.939] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0107.939] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0107.939] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0107.939] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0107.939] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0107.939] timeGetTime () returned 0x2de02 [0107.939] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0107.939] Sleep (dwMilliseconds=0xa) [0107.998] timeGetTime () returned 0x2de31 [0107.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0107.998] Sleep (dwMilliseconds=0xa) [0108.099] timeGetTime () returned 0x2de9e [0108.099] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0108.099] Sleep (dwMilliseconds=0xa) [0108.188] timeGetTime () returned 0x2defc [0108.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0108.188] Sleep (dwMilliseconds=0xa) [0108.248] timeGetTime () returned 0x2df2b [0108.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0108.248] Sleep (dwMilliseconds=0xa) [0108.377] timeGetTime () returned 0x2dfb7 [0108.377] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0108.377] Sleep (dwMilliseconds=0xa) [0108.478] timeGetTime () returned 0x2e015 [0108.478] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0108.478] TranslateMessage (lpMsg=0x8bf798) returned 0 [0108.478] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0108.478] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0108.478] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0108.478] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0108.478] Sleep (dwMilliseconds=0xa) [0108.527] timeGetTime () returned 0x2e044 [0108.527] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0108.527] Sleep (dwMilliseconds=0xa) [0108.635] timeGetTime () returned 0x2e0b1 [0108.635] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0108.636] Sleep (dwMilliseconds=0xa) [0108.684] timeGetTime () returned 0x2e0e0 [0108.684] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0108.684] Sleep (dwMilliseconds=0xa) [0108.724] timeGetTime () returned 0x2e110 [0108.724] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0108.724] Sleep (dwMilliseconds=0xa) [0108.774] timeGetTime () returned 0x2e13e [0108.774] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0108.774] Sleep (dwMilliseconds=0xa) [0108.812] timeGetTime () returned 0x2e15d [0108.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0108.812] Sleep (dwMilliseconds=0xa) [0108.843] timeGetTime () returned 0x2e17c [0108.843] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0108.843] Sleep (dwMilliseconds=0xa) [0108.927] timeGetTime () returned 0x2e1da [0108.927] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0108.927] Sleep (dwMilliseconds=0xa) [0108.981] timeGetTime () returned 0x2e209 [0108.981] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0108.981] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0108.981] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0108.981] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0108.981] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0108.982] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0108.982] RegCloseKey (hKey=0x240) returned 0x0 [0108.982] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0108.982] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0108.982] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0108.982] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0108.982] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0108.982] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0108.982] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0108.982] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0108.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0108.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0108.983] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0108.983] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0109.094] FreeLibrary (hLibModule=0x77150000) returned 1 [0109.095] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0109.095] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0109.095] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0109.095] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0109.095] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0109.095] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0109.095] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0109.095] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0109.095] timeGetTime () returned 0x2e286 [0109.095] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.095] Sleep (dwMilliseconds=0xa) [0109.181] timeGetTime () returned 0x2e2d4 [0109.181] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.181] Sleep (dwMilliseconds=0xa) [0109.273] timeGetTime () returned 0x2e332 [0109.273] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0109.273] TranslateMessage (lpMsg=0x8bf798) returned 0 [0109.273] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0109.273] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0109.273] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0109.273] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.273] Sleep (dwMilliseconds=0xa) [0109.417] timeGetTime () returned 0x2e3be [0109.417] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.417] Sleep (dwMilliseconds=0xa) [0109.535] timeGetTime () returned 0x2e43b [0109.535] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.535] Sleep (dwMilliseconds=0xa) [0109.583] timeGetTime () returned 0x2e46a [0109.583] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.583] Sleep (dwMilliseconds=0xa) [0109.643] timeGetTime () returned 0x2e4a9 [0109.643] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.643] Sleep (dwMilliseconds=0xa) [0109.687] timeGetTime () returned 0x2e4c8 [0109.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.687] Sleep (dwMilliseconds=0xa) [0109.710] timeGetTime () returned 0x2e4e7 [0109.710] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.710] Sleep (dwMilliseconds=0xa) [0109.759] timeGetTime () returned 0x2e516 [0109.759] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.759] Sleep (dwMilliseconds=0xa) [0109.786] timeGetTime () returned 0x2e535 [0109.786] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.786] Sleep (dwMilliseconds=0xa) [0109.820] timeGetTime () returned 0x2e555 [0109.820] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.820] Sleep (dwMilliseconds=0xa) [0109.862] timeGetTime () returned 0x2e584 [0109.862] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.862] Sleep (dwMilliseconds=0xa) [0109.913] timeGetTime () returned 0x2e5b2 [0109.913] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.913] Sleep (dwMilliseconds=0xa) [0109.985] timeGetTime () returned 0x2e5f1 [0109.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0109.985] Sleep (dwMilliseconds=0xa) [0110.001] timeGetTime () returned 0x2e610 [0110.001] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0110.001] Sleep (dwMilliseconds=0xa) [0110.036] timeGetTime () returned 0x2e62f [0110.036] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0110.036] TranslateMessage (lpMsg=0x8bf798) returned 0 [0110.036] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0110.036] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0110.037] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0110.037] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0110.037] Sleep (dwMilliseconds=0xa) [0110.082] timeGetTime () returned 0x2e65e [0110.082] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0110.082] Sleep (dwMilliseconds=0xa) [0110.316] timeGetTime () returned 0x2e745 [0110.317] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0110.317] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0110.317] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0110.317] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0110.317] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0110.317] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0110.317] RegCloseKey (hKey=0x240) returned 0x0 [0110.317] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0110.317] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0110.317] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0110.317] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0110.317] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0110.317] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0110.318] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0110.318] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0110.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0110.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acf8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0110.318] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0110.318] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0110.641] FreeLibrary (hLibModule=0x77150000) returned 1 [0110.642] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0110.642] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0110.642] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0110.642] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0110.642] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0110.642] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0110.642] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0110.642] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0110.642] timeGetTime () returned 0x2e88e [0110.642] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0110.642] Sleep (dwMilliseconds=0xa) [0110.795] timeGetTime () returned 0x2e92a [0110.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0110.795] TranslateMessage (lpMsg=0x8bf798) returned 0 [0110.795] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0110.795] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0110.795] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0110.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0110.795] Sleep (dwMilliseconds=0xa) [0110.892] timeGetTime () returned 0x2e988 [0110.892] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0110.892] Sleep (dwMilliseconds=0xa) [0110.981] timeGetTime () returned 0x2e9d6 [0110.981] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0110.981] Sleep (dwMilliseconds=0xa) [0111.034] timeGetTime () returned 0x2ea14 [0111.034] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.034] Sleep (dwMilliseconds=0xa) [0111.087] timeGetTime () returned 0x2ea43 [0111.087] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.087] Sleep (dwMilliseconds=0xa) [0111.188] timeGetTime () returned 0x2eab0 [0111.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.188] Sleep (dwMilliseconds=0xa) [0111.252] timeGetTime () returned 0x2eaef [0111.252] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.252] Sleep (dwMilliseconds=0xa) [0111.272] timeGetTime () returned 0x2eaff [0111.272] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.272] Sleep (dwMilliseconds=0xa) [0111.313] timeGetTime () returned 0x2eb2d [0111.313] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.313] Sleep (dwMilliseconds=0xa) [0111.341] timeGetTime () returned 0x2eb3d [0111.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.341] Sleep (dwMilliseconds=0xa) [0111.441] timeGetTime () returned 0x2ebaa [0111.441] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.441] Sleep (dwMilliseconds=0xa) [0111.477] timeGetTime () returned 0x2ebca [0111.477] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.477] Sleep (dwMilliseconds=0xa) [0111.533] timeGetTime () returned 0x2ec08 [0111.533] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.533] Sleep (dwMilliseconds=0xa) [0111.555] timeGetTime () returned 0x2ec18 [0111.555] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0111.568] TranslateMessage (lpMsg=0x8bf798) returned 0 [0111.568] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0111.568] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0111.569] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0111.569] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.569] Sleep (dwMilliseconds=0xa) [0111.602] timeGetTime () returned 0x2ec47 [0111.602] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.602] Sleep (dwMilliseconds=0xa) [0111.636] timeGetTime () returned 0x2ec66 [0111.636] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.636] Sleep (dwMilliseconds=0xa) [0111.681] timeGetTime () returned 0x2ec96 [0111.681] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0111.682] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0111.682] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0111.682] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0111.682] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0111.682] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0111.682] RegCloseKey (hKey=0x240) returned 0x0 [0111.682] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0111.682] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0111.682] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0111.682] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0111.682] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0111.683] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0111.683] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0111.683] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0111.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0111.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a978, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0111.683] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0111.683] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0111.779] FreeLibrary (hLibModule=0x77150000) returned 1 [0111.779] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0111.779] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0111.779] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0111.779] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0111.779] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0111.779] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0111.779] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0111.780] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0111.780] timeGetTime () returned 0x2ed02 [0111.780] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.780] Sleep (dwMilliseconds=0xa) [0111.873] timeGetTime () returned 0x2ed60 [0111.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.873] Sleep (dwMilliseconds=0xa) [0111.944] timeGetTime () returned 0x2ed9e [0111.944] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0111.944] Sleep (dwMilliseconds=0xa) [0112.007] timeGetTime () returned 0x2eddd [0112.007] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.007] Sleep (dwMilliseconds=0xa) [0112.084] timeGetTime () returned 0x2ee2b [0112.084] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.084] Sleep (dwMilliseconds=0xa) [0112.183] timeGetTime () returned 0x2ee89 [0112.183] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.183] Sleep (dwMilliseconds=0xa) [0112.356] timeGetTime () returned 0x2ef35 [0112.356] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0112.356] TranslateMessage (lpMsg=0x8bf798) returned 0 [0112.356] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0112.356] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0112.442] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0112.442] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.442] Sleep (dwMilliseconds=0xa) [0112.469] timeGetTime () returned 0x2efb2 [0112.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.469] Sleep (dwMilliseconds=0xa) [0112.567] timeGetTime () returned 0x2f00f [0112.567] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.567] Sleep (dwMilliseconds=0xa) [0112.612] timeGetTime () returned 0x2f03e [0112.612] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.612] Sleep (dwMilliseconds=0xa) [0112.655] timeGetTime () returned 0x2f06d [0112.655] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.655] Sleep (dwMilliseconds=0xa) [0112.670] timeGetTime () returned 0x2f07d [0112.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.670] Sleep (dwMilliseconds=0xa) [0112.686] timeGetTime () returned 0x2f08c [0112.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.686] Sleep (dwMilliseconds=0xa) [0112.704] timeGetTime () returned 0x2f09c [0112.704] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.704] Sleep (dwMilliseconds=0xa) [0112.725] timeGetTime () returned 0x2f0ac [0112.725] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.725] Sleep (dwMilliseconds=0xa) [0112.755] timeGetTime () returned 0x2f0cb [0112.755] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.755] Sleep (dwMilliseconds=0xa) [0112.799] timeGetTime () returned 0x2f0fa [0112.799] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0112.799] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0112.799] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0112.799] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0112.799] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0112.800] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0112.800] RegCloseKey (hKey=0x240) returned 0x0 [0112.800] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0112.800] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0112.800] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0112.800] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0112.800] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0112.800] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0112.800] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0112.800] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0112.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0112.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0112.801] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0112.801] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0112.907] FreeLibrary (hLibModule=0x77150000) returned 1 [0112.907] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0112.907] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0112.907] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0112.907] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0112.907] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0112.907] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0112.907] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0112.908] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0112.908] timeGetTime () returned 0x2f167 [0112.908] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.908] Sleep (dwMilliseconds=0xa) [0112.999] timeGetTime () returned 0x2f1c5 [0112.999] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0112.999] Sleep (dwMilliseconds=0xa) [0113.046] timeGetTime () returned 0x2f1f4 [0113.046] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.046] Sleep (dwMilliseconds=0xa) [0113.094] timeGetTime () returned 0x2f223 [0113.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.094] Sleep (dwMilliseconds=0xa) [0113.145] timeGetTime () returned 0x2f252 [0113.145] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.145] Sleep (dwMilliseconds=0xa) [0113.204] timeGetTime () returned 0x2f290 [0113.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0113.204] TranslateMessage (lpMsg=0x8bf798) returned 0 [0113.204] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0113.204] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0113.204] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0113.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.204] Sleep (dwMilliseconds=0xa) [0113.251] timeGetTime () returned 0x2f2bf [0113.251] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.251] Sleep (dwMilliseconds=0xa) [0113.275] timeGetTime () returned 0x2f2cf [0113.275] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.275] Sleep (dwMilliseconds=0xa) [0113.298] timeGetTime () returned 0x2f2ee [0113.298] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.298] Sleep (dwMilliseconds=0xa) [0113.318] timeGetTime () returned 0x2f2fd [0113.318] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.318] Sleep (dwMilliseconds=0xa) [0113.345] timeGetTime () returned 0x2f31d [0113.345] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.345] Sleep (dwMilliseconds=0xa) [0113.440] timeGetTime () returned 0x2f37a [0113.440] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.440] Sleep (dwMilliseconds=0xa) [0113.477] timeGetTime () returned 0x2f39a [0113.477] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.477] Sleep (dwMilliseconds=0xa) [0113.515] timeGetTime () returned 0x2f3c9 [0113.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.516] Sleep (dwMilliseconds=0xa) [0113.550] timeGetTime () returned 0x2f3e8 [0113.550] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.550] Sleep (dwMilliseconds=0xa) [0113.589] timeGetTime () returned 0x2f407 [0113.589] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.589] Sleep (dwMilliseconds=0xa) [0113.641] timeGetTime () returned 0x2f446 [0113.642] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.642] Sleep (dwMilliseconds=0xa) [0113.658] timeGetTime () returned 0x2f455 [0113.658] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.658] Sleep (dwMilliseconds=0xa) [0113.682] timeGetTime () returned 0x2f465 [0113.682] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.682] Sleep (dwMilliseconds=0xa) [0113.706] timeGetTime () returned 0x2f484 [0113.706] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.706] Sleep (dwMilliseconds=0xa) [0113.718] timeGetTime () returned 0x2f494 [0113.718] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.718] Sleep (dwMilliseconds=0xa) [0113.736] timeGetTime () returned 0x2f4a3 [0113.736] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.736] Sleep (dwMilliseconds=0xa) [0113.757] timeGetTime () returned 0x2f4b3 [0113.757] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.757] Sleep (dwMilliseconds=0xa) [0113.785] timeGetTime () returned 0x2f4d2 [0113.785] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.785] Sleep (dwMilliseconds=0xa) [0113.842] timeGetTime () returned 0x2f511 [0113.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.842] Sleep (dwMilliseconds=0xa) [0113.883] timeGetTime () returned 0x2f530 [0113.883] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0113.883] Sleep (dwMilliseconds=0xa) [0113.917] timeGetTime () returned 0x2f54f [0113.917] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0113.917] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0113.917] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0113.917] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0113.918] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0113.918] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0113.918] RegCloseKey (hKey=0x240) returned 0x0 [0113.918] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0113.918] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0113.918] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0113.918] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0113.918] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0113.918] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0113.918] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0113.918] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0113.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0113.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab18, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0113.919] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0113.922] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0113.998] FreeLibrary (hLibModule=0x77150000) returned 1 [0113.998] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0113.998] TranslateMessage (lpMsg=0x8bf708) returned 0 [0113.998] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0113.998] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0113.999] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0113.999] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0113.999] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0113.999] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0113.999] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0113.999] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0113.999] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0113.999] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0113.999] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0113.999] timeGetTime () returned 0x2f5ad [0114.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.000] Sleep (dwMilliseconds=0xa) [0114.096] timeGetTime () returned 0x2f60b [0114.096] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.096] Sleep (dwMilliseconds=0xa) [0114.149] timeGetTime () returned 0x2f63a [0114.149] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.149] Sleep (dwMilliseconds=0xa) [0114.190] timeGetTime () returned 0x2f669 [0114.190] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.190] Sleep (dwMilliseconds=0xa) [0114.235] timeGetTime () returned 0x2f698 [0114.235] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.235] Sleep (dwMilliseconds=0xa) [0114.285] timeGetTime () returned 0x2f6c6 [0114.285] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.285] Sleep (dwMilliseconds=0xa) [0114.331] timeGetTime () returned 0x2f6f5 [0114.331] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.331] Sleep (dwMilliseconds=0xa) [0114.438] timeGetTime () returned 0x2f762 [0114.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.438] Sleep (dwMilliseconds=0xa) [0114.526] timeGetTime () returned 0x2f7b1 [0114.526] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.526] Sleep (dwMilliseconds=0xa) [0114.546] timeGetTime () returned 0x2f7d0 [0114.546] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.546] Sleep (dwMilliseconds=0xa) [0114.574] timeGetTime () returned 0x2f7df [0114.574] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.574] Sleep (dwMilliseconds=0xa) [0114.608] timeGetTime () returned 0x2f80e [0114.608] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.608] Sleep (dwMilliseconds=0xa) [0114.643] timeGetTime () returned 0x2f82e [0114.643] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.643] Sleep (dwMilliseconds=0xa) [0114.675] timeGetTime () returned 0x2f84d [0114.675] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.675] Sleep (dwMilliseconds=0xa) [0114.732] timeGetTime () returned 0x2f88b [0114.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.732] Sleep (dwMilliseconds=0xa) [0114.760] timeGetTime () returned 0x2f89b [0114.760] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0114.761] TranslateMessage (lpMsg=0x8bf798) returned 0 [0114.761] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0114.761] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0114.761] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0114.761] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.761] Sleep (dwMilliseconds=0xa) [0114.815] timeGetTime () returned 0x2f8d9 [0114.815] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.815] Sleep (dwMilliseconds=0xa) [0114.841] timeGetTime () returned 0x2f8f9 [0114.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.842] Sleep (dwMilliseconds=0xa) [0114.871] timeGetTime () returned 0x2f908 [0114.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.872] Sleep (dwMilliseconds=0xa) [0114.889] timeGetTime () returned 0x2f928 [0114.889] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.889] Sleep (dwMilliseconds=0xa) [0114.922] timeGetTime () returned 0x2f947 [0114.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.922] Sleep (dwMilliseconds=0xa) [0114.942] timeGetTime () returned 0x2f958 [0114.942] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0114.942] Sleep (dwMilliseconds=0xa) [0114.999] timeGetTime () returned 0x2f995 [0114.999] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0114.999] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0114.999] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0115.000] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0115.000] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0115.000] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0115.000] RegCloseKey (hKey=0x240) returned 0x0 [0115.000] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0115.000] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0115.000] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0115.000] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0115.000] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0115.000] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0115.000] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0115.000] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0115.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0115.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aab8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0115.001] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0115.001] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0115.108] FreeLibrary (hLibModule=0x77150000) returned 1 [0115.108] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0115.108] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0115.108] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0115.109] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0115.109] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0115.109] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0115.109] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0115.109] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0115.109] timeGetTime () returned 0x2fa02 [0115.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0115.109] Sleep (dwMilliseconds=0xa) [0115.261] timeGetTime () returned 0x2fa8f [0115.261] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0115.262] Sleep (dwMilliseconds=0xa) [0115.523] timeGetTime () returned 0x2fb99 [0115.524] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0115.524] TranslateMessage (lpMsg=0x8bf798) returned 0 [0115.524] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0115.524] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0115.524] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0115.524] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0115.524] Sleep (dwMilliseconds=0xa) [0115.661] timeGetTime () returned 0x2fc25 [0115.661] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0115.661] Sleep (dwMilliseconds=0xa) [0115.707] timeGetTime () returned 0x2fc54 [0115.707] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0115.707] Sleep (dwMilliseconds=0xa) [0115.778] timeGetTime () returned 0x2fc93 [0115.778] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0115.778] Sleep (dwMilliseconds=0xa) [0115.824] timeGetTime () returned 0x2fcc1 [0115.824] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0115.824] Sleep (dwMilliseconds=0xa) [0115.889] timeGetTime () returned 0x2fd10 [0115.889] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0115.889] Sleep (dwMilliseconds=0xa) [0115.937] timeGetTime () returned 0x2fd3e [0115.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0115.937] Sleep (dwMilliseconds=0xa) [0115.967] timeGetTime () returned 0x2fd5e [0115.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0115.967] Sleep (dwMilliseconds=0xa) [0115.983] timeGetTime () returned 0x2fd6d [0115.983] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0115.983] Sleep (dwMilliseconds=0xa) [0115.998] timeGetTime () returned 0x2fd7d [0115.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0115.998] Sleep (dwMilliseconds=0xa) [0116.014] timeGetTime () returned 0x2fd8d [0116.014] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.014] Sleep (dwMilliseconds=0xa) [0116.030] timeGetTime () returned 0x2fd9c [0116.030] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.030] Sleep (dwMilliseconds=0xa) [0116.045] timeGetTime () returned 0x2fdac [0116.046] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.046] Sleep (dwMilliseconds=0xa) [0116.060] timeGetTime () returned 0x2fdbb [0116.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.060] Sleep (dwMilliseconds=0xa) [0116.076] timeGetTime () returned 0x2fdcb [0116.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.076] Sleep (dwMilliseconds=0xa) [0116.091] timeGetTime () returned 0x2fddb [0116.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.091] Sleep (dwMilliseconds=0xa) [0116.108] timeGetTime () returned 0x2fdea [0116.108] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0116.108] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0116.108] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0116.108] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0116.108] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0116.108] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0116.108] RegCloseKey (hKey=0x240) returned 0x0 [0116.108] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0116.108] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0116.108] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0116.108] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0116.108] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0116.109] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0116.109] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0116.109] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0116.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0116.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aab8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0116.109] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0116.109] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0116.216] FreeLibrary (hLibModule=0x77150000) returned 1 [0116.217] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0116.217] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0116.217] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0116.217] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0116.217] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0116.217] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0116.217] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0116.217] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0116.217] timeGetTime () returned 0x2fe58 [0116.217] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.217] Sleep (dwMilliseconds=0xa) [0116.280] timeGetTime () returned 0x2fe96 [0116.280] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0116.280] TranslateMessage (lpMsg=0x8bf798) returned 0 [0116.280] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0116.280] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0116.280] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0116.280] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.280] Sleep (dwMilliseconds=0xa) [0116.488] timeGetTime () returned 0x2ff61 [0116.488] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.488] Sleep (dwMilliseconds=0xa) [0116.581] timeGetTime () returned 0x2ffbf [0116.581] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.581] Sleep (dwMilliseconds=0xa) [0116.642] timeGetTime () returned 0x2fffe [0116.642] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.642] Sleep (dwMilliseconds=0xa) [0116.687] timeGetTime () returned 0x3002c [0116.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.687] Sleep (dwMilliseconds=0xa) [0116.723] timeGetTime () returned 0x3004c [0116.723] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.723] Sleep (dwMilliseconds=0xa) [0116.790] timeGetTime () returned 0x3008b [0116.790] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.790] Sleep (dwMilliseconds=0xa) [0116.819] timeGetTime () returned 0x300a9 [0116.819] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.819] Sleep (dwMilliseconds=0xa) [0116.875] timeGetTime () returned 0x300e8 [0116.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.875] Sleep (dwMilliseconds=0xa) [0116.894] timeGetTime () returned 0x300f8 [0116.894] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.894] Sleep (dwMilliseconds=0xa) [0116.933] timeGetTime () returned 0x30117 [0116.933] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.933] Sleep (dwMilliseconds=0xa) [0116.960] timeGetTime () returned 0x30136 [0116.960] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.960] Sleep (dwMilliseconds=0xa) [0116.985] timeGetTime () returned 0x30155 [0116.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0116.985] Sleep (dwMilliseconds=0xa) [0117.024] timeGetTime () returned 0x30175 [0117.024] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.024] Sleep (dwMilliseconds=0xa) [0117.045] timeGetTime () returned 0x30194 [0117.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0117.045] TranslateMessage (lpMsg=0x8bf798) returned 0 [0117.045] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0117.045] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0117.045] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0117.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.045] Sleep (dwMilliseconds=0xa) [0117.061] timeGetTime () returned 0x301a3 [0117.061] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.061] Sleep (dwMilliseconds=0xa) [0117.107] timeGetTime () returned 0x301d2 [0117.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.107] Sleep (dwMilliseconds=0xa) [0117.122] timeGetTime () returned 0x301e2 [0117.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.123] Sleep (dwMilliseconds=0xa) [0117.138] timeGetTime () returned 0x301f2 [0117.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.138] Sleep (dwMilliseconds=0xa) [0117.155] timeGetTime () returned 0x30201 [0117.155] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.155] Sleep (dwMilliseconds=0xa) [0117.170] timeGetTime () returned 0x30211 [0117.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.170] Sleep (dwMilliseconds=0xa) [0117.188] timeGetTime () returned 0x30220 [0117.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.188] Sleep (dwMilliseconds=0xa) [0117.202] timeGetTime () returned 0x30230 [0117.202] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.202] Sleep (dwMilliseconds=0xa) [0117.217] timeGetTime () returned 0x30240 [0117.217] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0117.217] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0117.217] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0117.217] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0117.217] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0117.217] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0117.217] RegCloseKey (hKey=0x240) returned 0x0 [0117.217] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0117.217] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0117.217] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0117.217] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0117.217] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0117.217] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0117.218] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0117.218] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0117.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0117.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0117.218] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0117.218] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0117.326] FreeLibrary (hLibModule=0x77150000) returned 1 [0117.326] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0117.326] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0117.326] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0117.326] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0117.326] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0117.326] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0117.326] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0117.326] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0117.326] timeGetTime () returned 0x302ad [0117.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.326] Sleep (dwMilliseconds=0xa) [0117.438] timeGetTime () returned 0x3031a [0117.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.438] Sleep (dwMilliseconds=0xa) [0117.483] timeGetTime () returned 0x30349 [0117.483] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.483] Sleep (dwMilliseconds=0xa) [0117.530] timeGetTime () returned 0x30378 [0117.530] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.530] Sleep (dwMilliseconds=0xa) [0117.576] timeGetTime () returned 0x303a7 [0117.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.576] Sleep (dwMilliseconds=0xa) [0117.622] timeGetTime () returned 0x303d6 [0117.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.622] Sleep (dwMilliseconds=0xa) [0117.658] timeGetTime () returned 0x303f5 [0117.658] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.658] Sleep (dwMilliseconds=0xa) [0117.669] timeGetTime () returned 0x30405 [0117.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.669] Sleep (dwMilliseconds=0xa) [0117.686] timeGetTime () returned 0x30414 [0117.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.686] Sleep (dwMilliseconds=0xa) [0117.701] timeGetTime () returned 0x30424 [0117.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.701] Sleep (dwMilliseconds=0xa) [0117.726] timeGetTime () returned 0x30434 [0117.726] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.726] Sleep (dwMilliseconds=0xa) [0117.758] timeGetTime () returned 0x30453 [0117.758] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.758] Sleep (dwMilliseconds=0xa) [0117.779] timeGetTime () returned 0x30472 [0117.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.779] Sleep (dwMilliseconds=0xa) [0117.795] timeGetTime () returned 0x30482 [0117.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0117.795] TranslateMessage (lpMsg=0x8bf798) returned 0 [0117.795] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0117.795] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0117.795] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0117.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.795] Sleep (dwMilliseconds=0xa) [0117.810] timeGetTime () returned 0x30491 [0117.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.810] Sleep (dwMilliseconds=0xa) [0117.828] timeGetTime () returned 0x304a1 [0117.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.828] Sleep (dwMilliseconds=0xa) [0117.842] timeGetTime () returned 0x304b1 [0117.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.842] Sleep (dwMilliseconds=0xa) [0117.857] timeGetTime () returned 0x304c0 [0117.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.857] Sleep (dwMilliseconds=0xa) [0117.873] timeGetTime () returned 0x304d0 [0117.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.873] Sleep (dwMilliseconds=0xa) [0117.888] timeGetTime () returned 0x304e0 [0117.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.888] Sleep (dwMilliseconds=0xa) [0117.904] timeGetTime () returned 0x304ef [0117.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.904] Sleep (dwMilliseconds=0xa) [0117.919] timeGetTime () returned 0x304ff [0117.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.919] Sleep (dwMilliseconds=0xa) [0117.935] timeGetTime () returned 0x3050e [0117.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.935] Sleep (dwMilliseconds=0xa) [0117.951] timeGetTime () returned 0x3051e [0117.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.951] Sleep (dwMilliseconds=0xa) [0117.967] timeGetTime () returned 0x3052e [0117.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.967] Sleep (dwMilliseconds=0xa) [0117.982] timeGetTime () returned 0x3053d [0117.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.982] Sleep (dwMilliseconds=0xa) [0117.998] timeGetTime () returned 0x3054d [0117.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0117.998] Sleep (dwMilliseconds=0xa) [0118.013] timeGetTime () returned 0x3055d [0118.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.013] Sleep (dwMilliseconds=0xa) [0118.029] timeGetTime () returned 0x3056c [0118.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.029] Sleep (dwMilliseconds=0xa) [0118.045] timeGetTime () returned 0x3057c [0118.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.045] Sleep (dwMilliseconds=0xa) [0118.060] timeGetTime () returned 0x3058b [0118.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.060] Sleep (dwMilliseconds=0xa) [0118.076] timeGetTime () returned 0x3059b [0118.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.076] Sleep (dwMilliseconds=0xa) [0118.091] timeGetTime () returned 0x305ab [0118.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.091] Sleep (dwMilliseconds=0xa) [0118.107] timeGetTime () returned 0x305ba [0118.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.107] Sleep (dwMilliseconds=0xa) [0118.122] timeGetTime () returned 0x305ca [0118.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.122] Sleep (dwMilliseconds=0xa) [0118.138] timeGetTime () returned 0x305da [0118.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.138] Sleep (dwMilliseconds=0xa) [0118.154] timeGetTime () returned 0x305e9 [0118.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.154] Sleep (dwMilliseconds=0xa) [0118.170] timeGetTime () returned 0x305f9 [0118.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.170] Sleep (dwMilliseconds=0xa) [0118.185] timeGetTime () returned 0x30608 [0118.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.185] Sleep (dwMilliseconds=0xa) [0118.200] timeGetTime () returned 0x30618 [0118.200] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.200] Sleep (dwMilliseconds=0xa) [0118.217] timeGetTime () returned 0x30628 [0118.217] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.217] Sleep (dwMilliseconds=0xa) [0118.232] timeGetTime () returned 0x30637 [0118.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.232] Sleep (dwMilliseconds=0xa) [0118.248] timeGetTime () returned 0x30647 [0118.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.248] Sleep (dwMilliseconds=0xa) [0118.263] timeGetTime () returned 0x30657 [0118.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.263] Sleep (dwMilliseconds=0xa) [0118.280] timeGetTime () returned 0x30666 [0118.280] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.280] Sleep (dwMilliseconds=0xa) [0118.294] timeGetTime () returned 0x30676 [0118.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.294] Sleep (dwMilliseconds=0xa) [0118.310] timeGetTime () returned 0x30685 [0118.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.310] Sleep (dwMilliseconds=0xa) [0118.325] timeGetTime () returned 0x30695 [0118.326] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0118.326] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0118.326] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0118.326] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0118.326] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0118.326] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0118.326] RegCloseKey (hKey=0x240) returned 0x0 [0118.326] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0118.326] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0118.326] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0118.326] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0118.326] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0118.326] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0118.326] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0118.326] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0118.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0118.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0118.327] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0118.327] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0118.483] FreeLibrary (hLibModule=0x77150000) returned 1 [0118.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0118.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0118.483] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0118.483] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0118.483] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0118.483] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0118.483] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0118.483] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0118.483] timeGetTime () returned 0x30731 [0118.483] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.483] Sleep (dwMilliseconds=0xa) [0118.530] timeGetTime () returned 0x30760 [0118.530] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.530] Sleep (dwMilliseconds=0xa) [0118.576] timeGetTime () returned 0x3078f [0118.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0118.576] TranslateMessage (lpMsg=0x8bf798) returned 0 [0118.576] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0118.576] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0118.576] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0118.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.576] Sleep (dwMilliseconds=0xa) [0118.627] timeGetTime () returned 0x307be [0118.627] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.627] Sleep (dwMilliseconds=0xa) [0118.670] timeGetTime () returned 0x307ed [0118.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.670] Sleep (dwMilliseconds=0xa) [0118.717] timeGetTime () returned 0x3081c [0118.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.717] Sleep (dwMilliseconds=0xa) [0118.757] timeGetTime () returned 0x3083b [0118.757] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.758] Sleep (dwMilliseconds=0xa) [0118.779] timeGetTime () returned 0x3085a [0118.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.779] Sleep (dwMilliseconds=0xa) [0118.795] timeGetTime () returned 0x3086a [0118.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.795] Sleep (dwMilliseconds=0xa) [0118.820] timeGetTime () returned 0x30879 [0118.820] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.820] Sleep (dwMilliseconds=0xa) [0118.851] timeGetTime () returned 0x30899 [0118.851] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.851] Sleep (dwMilliseconds=0xa) [0118.872] timeGetTime () returned 0x308b8 [0118.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.872] Sleep (dwMilliseconds=0xa) [0118.888] timeGetTime () returned 0x308c8 [0118.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.888] Sleep (dwMilliseconds=0xa) [0118.923] timeGetTime () returned 0x308e7 [0118.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.923] Sleep (dwMilliseconds=0xa) [0118.935] timeGetTime () returned 0x308f6 [0118.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.935] Sleep (dwMilliseconds=0xa) [0118.951] timeGetTime () returned 0x30906 [0118.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.951] Sleep (dwMilliseconds=0xa) [0118.966] timeGetTime () returned 0x30916 [0118.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.966] Sleep (dwMilliseconds=0xa) [0118.982] timeGetTime () returned 0x30925 [0118.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.982] Sleep (dwMilliseconds=0xa) [0118.997] timeGetTime () returned 0x30935 [0118.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0118.997] Sleep (dwMilliseconds=0xa) [0119.013] timeGetTime () returned 0x30945 [0119.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.013] Sleep (dwMilliseconds=0xa) [0119.029] timeGetTime () returned 0x30954 [0119.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.029] Sleep (dwMilliseconds=0xa) [0119.044] timeGetTime () returned 0x30964 [0119.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.044] Sleep (dwMilliseconds=0xa) [0119.060] timeGetTime () returned 0x30973 [0119.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.060] Sleep (dwMilliseconds=0xa) [0119.076] timeGetTime () returned 0x30983 [0119.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.076] Sleep (dwMilliseconds=0xa) [0119.092] timeGetTime () returned 0x30993 [0119.092] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.092] Sleep (dwMilliseconds=0xa) [0119.109] timeGetTime () returned 0x309a2 [0119.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.109] Sleep (dwMilliseconds=0xa) [0119.122] timeGetTime () returned 0x309b2 [0119.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.122] Sleep (dwMilliseconds=0xa) [0119.138] timeGetTime () returned 0x309c2 [0119.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.138] Sleep (dwMilliseconds=0xa) [0119.154] timeGetTime () returned 0x309d1 [0119.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.154] Sleep (dwMilliseconds=0xa) [0119.169] timeGetTime () returned 0x309e1 [0119.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.169] Sleep (dwMilliseconds=0xa) [0119.185] timeGetTime () returned 0x309f0 [0119.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.185] Sleep (dwMilliseconds=0xa) [0119.200] timeGetTime () returned 0x30a00 [0119.200] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.200] Sleep (dwMilliseconds=0xa) [0119.216] timeGetTime () returned 0x30a10 [0119.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.216] Sleep (dwMilliseconds=0xa) [0119.232] timeGetTime () returned 0x30a1f [0119.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.232] Sleep (dwMilliseconds=0xa) [0119.247] timeGetTime () returned 0x30a2f [0119.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.248] Sleep (dwMilliseconds=0xa) [0119.263] timeGetTime () returned 0x30a3f [0119.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.263] Sleep (dwMilliseconds=0xa) [0119.279] timeGetTime () returned 0x30a4e [0119.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.279] Sleep (dwMilliseconds=0xa) [0119.295] timeGetTime () returned 0x30a5e [0119.295] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.295] Sleep (dwMilliseconds=0xa) [0119.310] timeGetTime () returned 0x30a6d [0119.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.310] Sleep (dwMilliseconds=0xa) [0119.326] timeGetTime () returned 0x30a7e [0119.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0119.326] TranslateMessage (lpMsg=0x8bf798) returned 0 [0119.326] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0119.326] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0119.326] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0119.327] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.327] Sleep (dwMilliseconds=0xa) [0119.341] timeGetTime () returned 0x30a8d [0119.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.341] Sleep (dwMilliseconds=0xa) [0119.357] timeGetTime () returned 0x30a9c [0119.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.357] Sleep (dwMilliseconds=0xa) [0119.431] timeGetTime () returned 0x30adb [0119.431] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.431] Sleep (dwMilliseconds=0xa) [0119.451] timeGetTime () returned 0x30afa [0119.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.451] Sleep (dwMilliseconds=0xa) [0119.466] timeGetTime () returned 0x30b0a [0119.467] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.467] Sleep (dwMilliseconds=0xa) [0119.482] timeGetTime () returned 0x30b19 [0119.482] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0119.482] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0119.482] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0119.482] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0119.482] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0119.483] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0119.483] RegCloseKey (hKey=0x240) returned 0x0 [0119.483] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0119.483] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0119.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0119.483] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0119.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0119.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0119.483] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0119.483] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0119.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0119.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0119.484] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0119.484] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0119.576] FreeLibrary (hLibModule=0x77150000) returned 1 [0119.576] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0119.576] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0119.576] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0119.576] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0119.576] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0119.576] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0119.577] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0119.577] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0119.577] timeGetTime () returned 0x30b77 [0119.577] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.577] Sleep (dwMilliseconds=0xa) [0119.628] timeGetTime () returned 0x30ba6 [0119.628] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.628] Sleep (dwMilliseconds=0xa) [0119.685] timeGetTime () returned 0x30be4 [0119.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.686] Sleep (dwMilliseconds=0xa) [0119.755] timeGetTime () returned 0x30c23 [0119.755] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.755] Sleep (dwMilliseconds=0xa) [0119.799] timeGetTime () returned 0x30c52 [0119.799] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.799] Sleep (dwMilliseconds=0xa) [0119.843] timeGetTime () returned 0x30c81 [0119.843] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.843] Sleep (dwMilliseconds=0xa) [0119.889] timeGetTime () returned 0x30cb0 [0119.889] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.889] Sleep (dwMilliseconds=0xa) [0119.924] timeGetTime () returned 0x30ccf [0119.924] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.924] Sleep (dwMilliseconds=0xa) [0119.935] timeGetTime () returned 0x30cde [0119.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.935] Sleep (dwMilliseconds=0xa) [0119.961] timeGetTime () returned 0x30cee [0119.961] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.961] Sleep (dwMilliseconds=0xa) [0119.992] timeGetTime () returned 0x30d0d [0119.992] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0119.992] Sleep (dwMilliseconds=0xa) [0120.014] timeGetTime () returned 0x30d2d [0120.014] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.014] Sleep (dwMilliseconds=0xa) [0120.029] timeGetTime () returned 0x30d3c [0120.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.029] Sleep (dwMilliseconds=0xa) [0120.044] timeGetTime () returned 0x30d4c [0120.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.044] Sleep (dwMilliseconds=0xa) [0120.060] timeGetTime () returned 0x30d5b [0120.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.060] Sleep (dwMilliseconds=0xa) [0120.077] timeGetTime () returned 0x30d6b [0120.077] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0120.077] TranslateMessage (lpMsg=0x8bf798) returned 0 [0120.077] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0120.077] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0120.077] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0120.077] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.077] Sleep (dwMilliseconds=0xa) [0120.091] timeGetTime () returned 0x30d7b [0120.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.091] Sleep (dwMilliseconds=0xa) [0120.107] timeGetTime () returned 0x30d8a [0120.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.107] Sleep (dwMilliseconds=0xa) [0120.123] timeGetTime () returned 0x30d9a [0120.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.123] Sleep (dwMilliseconds=0xa) [0120.139] timeGetTime () returned 0x30daa [0120.139] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.139] Sleep (dwMilliseconds=0xa) [0120.154] timeGetTime () returned 0x30db9 [0120.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.154] Sleep (dwMilliseconds=0xa) [0120.169] timeGetTime () returned 0x30dc9 [0120.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.169] Sleep (dwMilliseconds=0xa) [0120.185] timeGetTime () returned 0x30dd9 [0120.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.185] Sleep (dwMilliseconds=0xa) [0120.203] timeGetTime () returned 0x30de8 [0120.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.203] Sleep (dwMilliseconds=0xa) [0120.344] timeGetTime () returned 0x30e75 [0120.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.344] Sleep (dwMilliseconds=0xa) [0120.357] timeGetTime () returned 0x30e84 [0120.358] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.358] Sleep (dwMilliseconds=0xa) [0120.423] timeGetTime () returned 0x30ec3 [0120.423] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.423] Sleep (dwMilliseconds=0xa) [0120.435] timeGetTime () returned 0x30ed2 [0120.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.435] Sleep (dwMilliseconds=0xa) [0120.453] timeGetTime () returned 0x30ee2 [0120.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.453] Sleep (dwMilliseconds=0xa) [0120.466] timeGetTime () returned 0x30ef2 [0120.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.466] Sleep (dwMilliseconds=0xa) [0120.483] timeGetTime () returned 0x30f01 [0120.483] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.483] Sleep (dwMilliseconds=0xa) [0120.506] timeGetTime () returned 0x30f11 [0120.506] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.506] Sleep (dwMilliseconds=0xa) [0120.530] timeGetTime () returned 0x30f30 [0120.530] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.530] Sleep (dwMilliseconds=0xa) [0120.545] timeGetTime () returned 0x30f40 [0120.545] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.545] Sleep (dwMilliseconds=0xa) [0120.560] timeGetTime () returned 0x30f4f [0120.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.560] Sleep (dwMilliseconds=0xa) [0120.577] timeGetTime () returned 0x30f5f [0120.577] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0120.577] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0120.577] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0120.577] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0120.577] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0120.577] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0120.577] RegCloseKey (hKey=0x240) returned 0x0 [0120.577] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0120.577] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0120.577] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0120.577] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0120.578] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0120.578] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0120.578] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0120.578] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0120.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0120.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0120.578] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0120.578] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0120.670] FreeLibrary (hLibModule=0x77150000) returned 1 [0120.670] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0120.670] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0120.670] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0120.670] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0120.670] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0120.670] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0120.670] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0120.670] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0120.670] timeGetTime () returned 0x30fbd [0120.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.670] Sleep (dwMilliseconds=0xa) [0120.733] timeGetTime () returned 0x30ffb [0120.733] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.733] Sleep (dwMilliseconds=0xa) [0120.783] timeGetTime () returned 0x3102a [0120.783] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.783] Sleep (dwMilliseconds=0xa) [0120.829] timeGetTime () returned 0x31059 [0120.829] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0120.829] TranslateMessage (lpMsg=0x8bf798) returned 0 [0120.829] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0120.829] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0120.829] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0120.829] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.829] Sleep (dwMilliseconds=0xa) [0120.877] timeGetTime () returned 0x31088 [0120.877] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.877] Sleep (dwMilliseconds=0xa) [0120.949] timeGetTime () returned 0x310c6 [0120.949] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.949] Sleep (dwMilliseconds=0xa) [0120.983] timeGetTime () returned 0x310f5 [0120.983] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0120.983] Sleep (dwMilliseconds=0xa) [0121.089] timeGetTime () returned 0x31153 [0121.089] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.089] Sleep (dwMilliseconds=0xa) [0121.111] timeGetTime () returned 0x31172 [0121.111] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.111] Sleep (dwMilliseconds=0xa) [0121.123] timeGetTime () returned 0x31182 [0121.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.123] Sleep (dwMilliseconds=0xa) [0121.139] timeGetTime () returned 0x31192 [0121.139] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.139] Sleep (dwMilliseconds=0xa) [0121.154] timeGetTime () returned 0x311a1 [0121.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.154] Sleep (dwMilliseconds=0xa) [0121.169] timeGetTime () returned 0x311b1 [0121.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.169] Sleep (dwMilliseconds=0xa) [0121.185] timeGetTime () returned 0x311c0 [0121.186] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.186] Sleep (dwMilliseconds=0xa) [0121.201] timeGetTime () returned 0x311d0 [0121.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.201] Sleep (dwMilliseconds=0xa) [0121.216] timeGetTime () returned 0x311e0 [0121.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.216] Sleep (dwMilliseconds=0xa) [0121.328] timeGetTime () returned 0x3124d [0121.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.328] Sleep (dwMilliseconds=0xa) [0121.341] timeGetTime () returned 0x3125d [0121.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.341] Sleep (dwMilliseconds=0xa) [0121.359] timeGetTime () returned 0x3126e [0121.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.359] Sleep (dwMilliseconds=0xa) [0121.403] timeGetTime () returned 0x3128c [0121.403] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.406] Sleep (dwMilliseconds=0xa) [0121.419] timeGetTime () returned 0x312ab [0121.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.419] Sleep (dwMilliseconds=0xa) [0121.435] timeGetTime () returned 0x312ba [0121.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.435] Sleep (dwMilliseconds=0xa) [0121.451] timeGetTime () returned 0x312ca [0121.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.451] Sleep (dwMilliseconds=0xa) [0121.466] timeGetTime () returned 0x312da [0121.467] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.467] Sleep (dwMilliseconds=0xa) [0121.482] timeGetTime () returned 0x312e9 [0121.482] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.482] Sleep (dwMilliseconds=0xa) [0121.507] timeGetTime () returned 0x312f9 [0121.507] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.507] Sleep (dwMilliseconds=0xa) [0121.530] timeGetTime () returned 0x31318 [0121.530] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.530] Sleep (dwMilliseconds=0xa) [0121.545] timeGetTime () returned 0x31328 [0121.545] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.545] Sleep (dwMilliseconds=0xa) [0121.560] timeGetTime () returned 0x31337 [0121.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.560] Sleep (dwMilliseconds=0xa) [0121.576] timeGetTime () returned 0x31347 [0121.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0121.576] TranslateMessage (lpMsg=0x8bf798) returned 0 [0121.576] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0121.576] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0121.576] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0121.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.576] Sleep (dwMilliseconds=0xa) [0121.591] timeGetTime () returned 0x31357 [0121.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.592] Sleep (dwMilliseconds=0xa) [0121.607] timeGetTime () returned 0x31366 [0121.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.607] Sleep (dwMilliseconds=0xa) [0121.623] timeGetTime () returned 0x31376 [0121.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.623] Sleep (dwMilliseconds=0xa) [0121.638] timeGetTime () returned 0x31386 [0121.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.638] Sleep (dwMilliseconds=0xa) [0121.654] timeGetTime () returned 0x31395 [0121.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.654] Sleep (dwMilliseconds=0xa) [0121.669] timeGetTime () returned 0x313a5 [0121.670] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0121.670] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0121.670] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0121.670] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0121.670] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0121.670] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0121.670] RegCloseKey (hKey=0x240) returned 0x0 [0121.670] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0121.670] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0121.671] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0121.671] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0121.671] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0121.671] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0121.671] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0121.671] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0121.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0121.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0121.671] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0121.672] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0121.764] FreeLibrary (hLibModule=0x77150000) returned 1 [0121.764] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0121.764] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0121.764] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0121.764] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0121.764] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0121.764] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0121.764] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0121.764] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0121.764] timeGetTime () returned 0x31403 [0121.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.765] Sleep (dwMilliseconds=0xa) [0121.810] timeGetTime () returned 0x31431 [0121.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.810] Sleep (dwMilliseconds=0xa) [0121.857] timeGetTime () returned 0x31460 [0121.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.857] Sleep (dwMilliseconds=0xa) [0121.904] timeGetTime () returned 0x3148f [0121.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.904] Sleep (dwMilliseconds=0xa) [0121.938] timeGetTime () returned 0x314ae [0121.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.938] Sleep (dwMilliseconds=0xa) [0121.982] timeGetTime () returned 0x314dd [0121.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0121.982] Sleep (dwMilliseconds=0xa) [0122.029] timeGetTime () returned 0x3150c [0122.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.029] Sleep (dwMilliseconds=0xa) [0122.044] timeGetTime () returned 0x3151c [0122.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.045] Sleep (dwMilliseconds=0xa) [0122.060] timeGetTime () returned 0x3152b [0122.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.060] Sleep (dwMilliseconds=0xa) [0122.085] timeGetTime () returned 0x3153b [0122.085] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.085] Sleep (dwMilliseconds=0xa) [0122.138] timeGetTime () returned 0x3157a [0122.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.138] Sleep (dwMilliseconds=0xa) [0122.154] timeGetTime () returned 0x31589 [0122.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.154] Sleep (dwMilliseconds=0xa) [0122.169] timeGetTime () returned 0x31599 [0122.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.170] Sleep (dwMilliseconds=0xa) [0122.185] timeGetTime () returned 0x315a8 [0122.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.185] Sleep (dwMilliseconds=0xa) [0122.203] timeGetTime () returned 0x315b8 [0122.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.203] Sleep (dwMilliseconds=0xa) [0122.216] timeGetTime () returned 0x315c8 [0122.217] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.217] Sleep (dwMilliseconds=0xa) [0122.232] timeGetTime () returned 0x315d7 [0122.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.232] Sleep (dwMilliseconds=0xa) [0122.327] timeGetTime () returned 0x31635 [0122.327] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0122.327] TranslateMessage (lpMsg=0x8bf798) returned 0 [0122.327] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0122.327] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0122.327] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0122.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.328] Sleep (dwMilliseconds=0xa) [0122.341] timeGetTime () returned 0x31645 [0122.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.341] Sleep (dwMilliseconds=0xa) [0122.357] timeGetTime () returned 0x31654 [0122.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.357] Sleep (dwMilliseconds=0xa) [0122.398] timeGetTime () returned 0x31674 [0122.398] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.398] Sleep (dwMilliseconds=0xa) [0122.419] timeGetTime () returned 0x31693 [0122.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.419] Sleep (dwMilliseconds=0xa) [0122.435] timeGetTime () returned 0x316a2 [0122.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.435] Sleep (dwMilliseconds=0xa) [0122.452] timeGetTime () returned 0x316b2 [0122.452] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.452] Sleep (dwMilliseconds=0xa) [0122.466] timeGetTime () returned 0x316c2 [0122.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.466] Sleep (dwMilliseconds=0xa) [0122.482] timeGetTime () returned 0x316d1 [0122.482] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.482] Sleep (dwMilliseconds=0xa) [0122.508] timeGetTime () returned 0x316ea [0122.508] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.508] Sleep (dwMilliseconds=0xa) [0122.530] timeGetTime () returned 0x31700 [0122.530] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.531] Sleep (dwMilliseconds=0xa) [0122.545] timeGetTime () returned 0x31710 [0122.545] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.545] Sleep (dwMilliseconds=0xa) [0122.560] timeGetTime () returned 0x3171f [0122.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.560] Sleep (dwMilliseconds=0xa) [0122.576] timeGetTime () returned 0x3172f [0122.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.576] Sleep (dwMilliseconds=0xa) [0122.591] timeGetTime () returned 0x3173f [0122.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.591] Sleep (dwMilliseconds=0xa) [0122.613] timeGetTime () returned 0x3174e [0122.613] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.613] Sleep (dwMilliseconds=0xa) [0122.638] timeGetTime () returned 0x3176e [0122.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.638] Sleep (dwMilliseconds=0xa) [0122.654] timeGetTime () returned 0x3177d [0122.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.654] Sleep (dwMilliseconds=0xa) [0122.670] timeGetTime () returned 0x3178d [0122.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.670] Sleep (dwMilliseconds=0xa) [0122.686] timeGetTime () returned 0x3179c [0122.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.686] Sleep (dwMilliseconds=0xa) [0122.701] timeGetTime () returned 0x317ac [0122.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.701] Sleep (dwMilliseconds=0xa) [0122.716] timeGetTime () returned 0x317bc [0122.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.716] Sleep (dwMilliseconds=0xa) [0122.732] timeGetTime () returned 0x317cb [0122.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.732] Sleep (dwMilliseconds=0xa) [0122.748] timeGetTime () returned 0x317db [0122.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.748] Sleep (dwMilliseconds=0xa) [0122.763] timeGetTime () returned 0x317eb [0122.763] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0122.763] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0122.763] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0122.763] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0122.763] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0122.763] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0122.764] RegCloseKey (hKey=0x240) returned 0x0 [0122.764] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0122.764] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0122.764] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0122.764] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0122.764] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0122.764] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0122.764] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0122.764] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0122.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0122.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0122.765] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0122.765] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0122.873] FreeLibrary (hLibModule=0x77150000) returned 1 [0122.873] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0122.873] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0122.873] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0122.873] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0122.873] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0122.873] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0122.873] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0122.873] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0122.874] timeGetTime () returned 0x31858 [0122.874] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.874] Sleep (dwMilliseconds=0xa) [0122.919] timeGetTime () returned 0x31887 [0122.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.919] Sleep (dwMilliseconds=0xa) [0122.966] timeGetTime () returned 0x318b6 [0122.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0122.966] Sleep (dwMilliseconds=0xa) [0123.013] timeGetTime () returned 0x318e5 [0123.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.013] Sleep (dwMilliseconds=0xa) [0123.060] timeGetTime () returned 0x31913 [0123.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.060] Sleep (dwMilliseconds=0xa) [0123.103] timeGetTime () returned 0x31933 [0123.103] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0123.103] TranslateMessage (lpMsg=0x8bf798) returned 0 [0123.103] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0123.103] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0123.103] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0123.103] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.103] Sleep (dwMilliseconds=0xa) [0123.123] timeGetTime () returned 0x31952 [0123.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.123] Sleep (dwMilliseconds=0xa) [0123.138] timeGetTime () returned 0x31962 [0123.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.138] Sleep (dwMilliseconds=0xa) [0123.163] timeGetTime () returned 0x31971 [0123.163] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.163] Sleep (dwMilliseconds=0xa) [0123.185] timeGetTime () returned 0x31990 [0123.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.185] Sleep (dwMilliseconds=0xa) [0123.201] timeGetTime () returned 0x319a0 [0123.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.201] Sleep (dwMilliseconds=0xa) [0123.216] timeGetTime () returned 0x319b0 [0123.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.216] Sleep (dwMilliseconds=0xa) [0123.232] timeGetTime () returned 0x319bf [0123.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.232] Sleep (dwMilliseconds=0xa) [0123.248] timeGetTime () returned 0x319cf [0123.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.248] Sleep (dwMilliseconds=0xa) [0123.263] timeGetTime () returned 0x319df [0123.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.263] Sleep (dwMilliseconds=0xa) [0123.279] timeGetTime () returned 0x319ef [0123.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.279] Sleep (dwMilliseconds=0xa) [0123.294] timeGetTime () returned 0x319fe [0123.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.294] Sleep (dwMilliseconds=0xa) [0123.311] timeGetTime () returned 0x31a0d [0123.311] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.311] Sleep (dwMilliseconds=0xa) [0123.326] timeGetTime () returned 0x31a1d [0123.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.326] Sleep (dwMilliseconds=0xa) [0123.341] timeGetTime () returned 0x31a2d [0123.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.341] Sleep (dwMilliseconds=0xa) [0123.357] timeGetTime () returned 0x31a3c [0123.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.357] Sleep (dwMilliseconds=0xa) [0123.373] timeGetTime () returned 0x31a4c [0123.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.373] Sleep (dwMilliseconds=0xa) [0123.549] timeGetTime () returned 0x31af8 [0123.549] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.550] Sleep (dwMilliseconds=0xa) [0123.562] timeGetTime () returned 0x31b07 [0123.562] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.562] Sleep (dwMilliseconds=0xa) [0123.576] timeGetTime () returned 0x31b17 [0123.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.576] Sleep (dwMilliseconds=0xa) [0123.591] timeGetTime () returned 0x31b27 [0123.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.592] Sleep (dwMilliseconds=0xa) [0123.607] timeGetTime () returned 0x31b36 [0123.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.607] Sleep (dwMilliseconds=0xa) [0123.623] timeGetTime () returned 0x31b46 [0123.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.623] Sleep (dwMilliseconds=0xa) [0123.638] timeGetTime () returned 0x31b56 [0123.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.638] Sleep (dwMilliseconds=0xa) [0123.654] timeGetTime () returned 0x31b65 [0123.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.654] Sleep (dwMilliseconds=0xa) [0123.670] timeGetTime () returned 0x31b75 [0123.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.670] Sleep (dwMilliseconds=0xa) [0123.685] timeGetTime () returned 0x31b84 [0123.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.685] Sleep (dwMilliseconds=0xa) [0123.701] timeGetTime () returned 0x31b94 [0123.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.701] Sleep (dwMilliseconds=0xa) [0123.716] timeGetTime () returned 0x31ba4 [0123.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.716] Sleep (dwMilliseconds=0xa) [0123.732] timeGetTime () returned 0x31bb3 [0123.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.732] Sleep (dwMilliseconds=0xa) [0123.747] timeGetTime () returned 0x31bc3 [0123.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.748] Sleep (dwMilliseconds=0xa) [0123.763] timeGetTime () returned 0x31bd3 [0123.764] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.764] Sleep (dwMilliseconds=0xa) [0123.779] timeGetTime () returned 0x31be2 [0123.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.779] Sleep (dwMilliseconds=0xa) [0123.795] timeGetTime () returned 0x31bf2 [0123.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.795] Sleep (dwMilliseconds=0xa) [0123.810] timeGetTime () returned 0x31c01 [0123.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.811] Sleep (dwMilliseconds=0xa) [0123.826] timeGetTime () returned 0x31c11 [0123.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.826] Sleep (dwMilliseconds=0xa) [0123.841] timeGetTime () returned 0x31c21 [0123.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0123.841] TranslateMessage (lpMsg=0x8bf798) returned 0 [0123.841] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0123.841] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0123.841] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0123.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.842] Sleep (dwMilliseconds=0xa) [0123.857] timeGetTime () returned 0x31c30 [0123.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.857] Sleep (dwMilliseconds=0xa) [0123.873] timeGetTime () returned 0x31c40 [0123.873] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0123.873] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0123.873] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0123.873] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0123.873] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0123.873] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0123.873] RegCloseKey (hKey=0x240) returned 0x0 [0123.874] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0123.874] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0123.874] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0123.874] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0123.874] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0123.874] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0123.874] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0123.874] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0123.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0123.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0123.875] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0123.875] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0123.969] FreeLibrary (hLibModule=0x77150000) returned 1 [0123.969] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0123.969] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0123.969] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0123.969] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0123.969] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0123.969] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0123.970] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0123.970] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0123.970] timeGetTime () returned 0x31c9e [0123.970] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0123.970] Sleep (dwMilliseconds=0xa) [0124.013] timeGetTime () returned 0x31ccd [0124.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.014] Sleep (dwMilliseconds=0xa) [0124.060] timeGetTime () returned 0x31cfb [0124.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.060] Sleep (dwMilliseconds=0xa) [0124.107] timeGetTime () returned 0x31d2a [0124.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.107] Sleep (dwMilliseconds=0xa) [0124.157] timeGetTime () returned 0x31d59 [0124.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.157] Sleep (dwMilliseconds=0xa) [0124.201] timeGetTime () returned 0x31d88 [0124.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.201] Sleep (dwMilliseconds=0xa) [0124.248] timeGetTime () returned 0x31db7 [0124.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.248] Sleep (dwMilliseconds=0xa) [0124.283] timeGetTime () returned 0x31dd6 [0124.283] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.283] Sleep (dwMilliseconds=0xa) [0124.294] timeGetTime () returned 0x31de6 [0124.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.294] Sleep (dwMilliseconds=0xa) [0124.311] timeGetTime () returned 0x31df5 [0124.311] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.311] Sleep (dwMilliseconds=0xa) [0124.327] timeGetTime () returned 0x31e05 [0124.327] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.327] Sleep (dwMilliseconds=0xa) [0124.371] timeGetTime () returned 0x31e24 [0124.371] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.371] Sleep (dwMilliseconds=0xa) [0124.543] timeGetTime () returned 0x31ed0 [0124.543] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.543] Sleep (dwMilliseconds=0xa) [0124.560] timeGetTime () returned 0x31eef [0124.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.560] Sleep (dwMilliseconds=0xa) [0124.576] timeGetTime () returned 0x31eff [0124.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.576] Sleep (dwMilliseconds=0xa) [0124.592] timeGetTime () returned 0x31f0f [0124.592] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0124.592] TranslateMessage (lpMsg=0x8bf798) returned 0 [0124.592] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0124.592] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0124.592] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0124.592] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.592] Sleep (dwMilliseconds=0xa) [0124.607] timeGetTime () returned 0x31f1e [0124.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.607] Sleep (dwMilliseconds=0xa) [0124.622] timeGetTime () returned 0x31f2e [0124.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.623] Sleep (dwMilliseconds=0xa) [0124.638] timeGetTime () returned 0x31f3e [0124.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.638] Sleep (dwMilliseconds=0xa) [0124.654] timeGetTime () returned 0x31f4d [0124.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.654] Sleep (dwMilliseconds=0xa) [0124.669] timeGetTime () returned 0x31f5d [0124.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.670] Sleep (dwMilliseconds=0xa) [0124.685] timeGetTime () returned 0x31f6c [0124.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.685] Sleep (dwMilliseconds=0xa) [0124.701] timeGetTime () returned 0x31f7c [0124.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.701] Sleep (dwMilliseconds=0xa) [0124.716] timeGetTime () returned 0x31f8c [0124.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.716] Sleep (dwMilliseconds=0xa) [0124.732] timeGetTime () returned 0x31f9b [0124.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.732] Sleep (dwMilliseconds=0xa) [0124.747] timeGetTime () returned 0x31fab [0124.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.747] Sleep (dwMilliseconds=0xa) [0124.763] timeGetTime () returned 0x31fbb [0124.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.763] Sleep (dwMilliseconds=0xa) [0124.779] timeGetTime () returned 0x31fca [0124.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.779] Sleep (dwMilliseconds=0xa) [0124.794] timeGetTime () returned 0x31fda [0124.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.794] Sleep (dwMilliseconds=0xa) [0124.810] timeGetTime () returned 0x31fe9 [0124.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.810] Sleep (dwMilliseconds=0xa) [0124.826] timeGetTime () returned 0x31ff9 [0124.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.826] Sleep (dwMilliseconds=0xa) [0124.842] timeGetTime () returned 0x32009 [0124.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.842] Sleep (dwMilliseconds=0xa) [0124.857] timeGetTime () returned 0x32018 [0124.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.857] Sleep (dwMilliseconds=0xa) [0124.873] timeGetTime () returned 0x32028 [0124.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.873] Sleep (dwMilliseconds=0xa) [0124.888] timeGetTime () returned 0x32038 [0124.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.888] Sleep (dwMilliseconds=0xa) [0124.904] timeGetTime () returned 0x32047 [0124.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.904] Sleep (dwMilliseconds=0xa) [0124.920] timeGetTime () returned 0x32057 [0124.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.920] Sleep (dwMilliseconds=0xa) [0124.935] timeGetTime () returned 0x32066 [0124.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.935] Sleep (dwMilliseconds=0xa) [0124.951] timeGetTime () returned 0x32076 [0124.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0124.951] Sleep (dwMilliseconds=0xa) [0124.967] timeGetTime () returned 0x32086 [0124.967] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0124.967] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0124.967] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0124.967] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0124.967] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0124.967] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0124.967] RegCloseKey (hKey=0x240) returned 0x0 [0124.968] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0124.968] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0124.968] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0124.968] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0124.968] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0124.968] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0124.968] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0124.968] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0124.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0124.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0124.969] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0124.969] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0125.060] FreeLibrary (hLibModule=0x77150000) returned 1 [0125.060] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0125.060] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0125.060] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0125.061] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0125.061] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0125.061] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0125.061] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0125.061] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0125.061] timeGetTime () returned 0x320e3 [0125.061] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.061] Sleep (dwMilliseconds=0xa) [0125.107] timeGetTime () returned 0x32112 [0125.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.107] Sleep (dwMilliseconds=0xa) [0125.154] timeGetTime () returned 0x32141 [0125.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.154] Sleep (dwMilliseconds=0xa) [0125.221] timeGetTime () returned 0x32180 [0125.221] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.221] Sleep (dwMilliseconds=0xa) [0125.595] timeGetTime () returned 0x322f7 [0125.595] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0125.595] TranslateMessage (lpMsg=0x8bf798) returned 0 [0125.595] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0125.595] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0125.595] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0125.595] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.595] Sleep (dwMilliseconds=0xa) [0125.658] timeGetTime () returned 0x32335 [0125.658] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.658] Sleep (dwMilliseconds=0xa) [0125.712] timeGetTime () returned 0x32365 [0125.713] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.713] Sleep (dwMilliseconds=0xa) [0125.757] timeGetTime () returned 0x32393 [0125.757] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.757] Sleep (dwMilliseconds=0xa) [0125.791] timeGetTime () returned 0x323b3 [0125.791] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.792] Sleep (dwMilliseconds=0xa) [0125.854] timeGetTime () returned 0x323f1 [0125.854] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.854] Sleep (dwMilliseconds=0xa) [0125.876] timeGetTime () returned 0x32410 [0125.876] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.876] Sleep (dwMilliseconds=0xa) [0125.904] timeGetTime () returned 0x3242f [0125.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.904] Sleep (dwMilliseconds=0xa) [0125.923] timeGetTime () returned 0x3243f [0125.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.923] Sleep (dwMilliseconds=0xa) [0125.939] timeGetTime () returned 0x3244f [0125.940] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.940] Sleep (dwMilliseconds=0xa) [0125.960] timeGetTime () returned 0x3245e [0125.960] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.960] Sleep (dwMilliseconds=0xa) [0125.982] timeGetTime () returned 0x3247d [0125.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.982] Sleep (dwMilliseconds=0xa) [0125.997] timeGetTime () returned 0x3248d [0125.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0125.998] Sleep (dwMilliseconds=0xa) [0126.014] timeGetTime () returned 0x3249d [0126.014] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.014] Sleep (dwMilliseconds=0xa) [0126.029] timeGetTime () returned 0x324ad [0126.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.029] Sleep (dwMilliseconds=0xa) [0126.045] timeGetTime () returned 0x324bc [0126.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.045] Sleep (dwMilliseconds=0xa) [0126.060] timeGetTime () returned 0x324cb [0126.061] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0126.061] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0126.061] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0126.061] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0126.061] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0126.061] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0126.061] RegCloseKey (hKey=0x240) returned 0x0 [0126.061] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0126.061] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0126.061] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0126.061] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0126.062] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0126.062] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0126.062] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0126.062] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0126.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0126.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a978, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0126.062] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0126.063] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0126.156] FreeLibrary (hLibModule=0x77150000) returned 1 [0126.156] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0126.156] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0126.156] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0126.156] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0126.156] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0126.156] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0126.156] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0126.156] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0126.156] timeGetTime () returned 0x32529 [0126.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.156] Sleep (dwMilliseconds=0xa) [0126.201] timeGetTime () returned 0x32558 [0126.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.201] Sleep (dwMilliseconds=0xa) [0126.248] timeGetTime () returned 0x32587 [0126.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.248] Sleep (dwMilliseconds=0xa) [0126.294] timeGetTime () returned 0x325b6 [0126.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.294] Sleep (dwMilliseconds=0xa) [0126.328] timeGetTime () returned 0x325d5 [0126.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.328] Sleep (dwMilliseconds=0xa) [0126.373] timeGetTime () returned 0x32604 [0126.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0126.373] TranslateMessage (lpMsg=0x8bf798) returned 0 [0126.373] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0126.373] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0126.373] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0126.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.373] Sleep (dwMilliseconds=0xa) [0126.582] timeGetTime () returned 0x326cf [0126.583] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.583] Sleep (dwMilliseconds=0xa) [0126.619] timeGetTime () returned 0x326ee [0126.619] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.619] Sleep (dwMilliseconds=0xa) [0126.651] timeGetTime () returned 0x3270e [0126.651] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.651] Sleep (dwMilliseconds=0xa) [0126.672] timeGetTime () returned 0x3272f [0126.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.672] Sleep (dwMilliseconds=0xa) [0126.685] timeGetTime () returned 0x3273c [0126.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.685] Sleep (dwMilliseconds=0xa) [0126.701] timeGetTime () returned 0x3274c [0126.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.701] Sleep (dwMilliseconds=0xa) [0126.716] timeGetTime () returned 0x3275c [0126.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.716] Sleep (dwMilliseconds=0xa) [0126.732] timeGetTime () returned 0x3276b [0126.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.732] Sleep (dwMilliseconds=0xa) [0126.748] timeGetTime () returned 0x3277b [0126.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.748] Sleep (dwMilliseconds=0xa) [0126.763] timeGetTime () returned 0x3278b [0126.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.763] Sleep (dwMilliseconds=0xa) [0126.779] timeGetTime () returned 0x3279a [0126.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.779] Sleep (dwMilliseconds=0xa) [0126.796] timeGetTime () returned 0x327ac [0126.796] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.796] Sleep (dwMilliseconds=0xa) [0126.810] timeGetTime () returned 0x327b9 [0126.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.810] Sleep (dwMilliseconds=0xa) [0126.826] timeGetTime () returned 0x327c9 [0126.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.826] Sleep (dwMilliseconds=0xa) [0126.842] timeGetTime () returned 0x327d9 [0126.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.842] Sleep (dwMilliseconds=0xa) [0126.857] timeGetTime () returned 0x327e8 [0126.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.857] Sleep (dwMilliseconds=0xa) [0126.873] timeGetTime () returned 0x327f8 [0126.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.873] Sleep (dwMilliseconds=0xa) [0126.888] timeGetTime () returned 0x32808 [0126.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.888] Sleep (dwMilliseconds=0xa) [0126.905] timeGetTime () returned 0x32819 [0126.905] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.905] Sleep (dwMilliseconds=0xa) [0126.920] timeGetTime () returned 0x32827 [0126.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.920] Sleep (dwMilliseconds=0xa) [0126.935] timeGetTime () returned 0x32836 [0126.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.935] Sleep (dwMilliseconds=0xa) [0126.951] timeGetTime () returned 0x32846 [0126.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.951] Sleep (dwMilliseconds=0xa) [0126.967] timeGetTime () returned 0x32856 [0126.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.967] Sleep (dwMilliseconds=0xa) [0126.982] timeGetTime () returned 0x32865 [0126.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.982] Sleep (dwMilliseconds=0xa) [0126.999] timeGetTime () returned 0x32876 [0126.999] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0126.999] Sleep (dwMilliseconds=0xa) [0127.014] timeGetTime () returned 0x32885 [0127.014] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.014] Sleep (dwMilliseconds=0xa) [0127.030] timeGetTime () returned 0x32895 [0127.030] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.030] Sleep (dwMilliseconds=0xa) [0127.114] timeGetTime () returned 0x328e6 [0127.114] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.114] Sleep (dwMilliseconds=0xa) [0127.138] timeGetTime () returned 0x32902 [0127.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0127.138] TranslateMessage (lpMsg=0x8bf798) returned 0 [0127.138] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0127.138] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0127.138] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0127.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.138] Sleep (dwMilliseconds=0xa) [0127.154] timeGetTime () returned 0x32911 [0127.154] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0127.154] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0127.154] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0127.154] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0127.154] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0127.154] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0127.155] RegCloseKey (hKey=0x240) returned 0x0 [0127.155] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0127.155] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0127.155] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0127.155] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0127.155] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0127.155] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0127.155] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0127.155] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0127.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0127.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aab8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0127.156] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0127.156] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0127.342] FreeLibrary (hLibModule=0x77150000) returned 1 [0127.343] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0127.343] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0127.343] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0127.343] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0127.343] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0127.343] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0127.343] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0127.343] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0127.343] timeGetTime () returned 0x329cd [0127.343] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.343] Sleep (dwMilliseconds=0xa) [0127.389] timeGetTime () returned 0x329fc [0127.389] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.389] Sleep (dwMilliseconds=0xa) [0127.544] timeGetTime () returned 0x32a98 [0127.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.544] Sleep (dwMilliseconds=0xa) [0127.592] timeGetTime () returned 0x32ac7 [0127.592] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.592] Sleep (dwMilliseconds=0xa) [0127.638] timeGetTime () returned 0x32af6 [0127.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.638] Sleep (dwMilliseconds=0xa) [0127.685] timeGetTime () returned 0x32b24 [0127.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.685] Sleep (dwMilliseconds=0xa) [0127.753] timeGetTime () returned 0x32b63 [0127.753] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.753] Sleep (dwMilliseconds=0xa) [0127.779] timeGetTime () returned 0x32b82 [0127.780] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.780] Sleep (dwMilliseconds=0xa) [0127.805] timeGetTime () returned 0x32b92 [0127.805] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.806] Sleep (dwMilliseconds=0xa) [0127.826] timeGetTime () returned 0x32bb1 [0127.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.826] Sleep (dwMilliseconds=0xa) [0127.841] timeGetTime () returned 0x32bc1 [0127.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.841] Sleep (dwMilliseconds=0xa) [0127.857] timeGetTime () returned 0x32bd0 [0127.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.857] Sleep (dwMilliseconds=0xa) [0127.873] timeGetTime () returned 0x32be0 [0127.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.873] Sleep (dwMilliseconds=0xa) [0127.888] timeGetTime () returned 0x32bf0 [0127.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0127.888] TranslateMessage (lpMsg=0x8bf798) returned 0 [0127.888] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0127.888] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0127.888] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0127.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.888] Sleep (dwMilliseconds=0xa) [0127.904] timeGetTime () returned 0x32bff [0127.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.904] Sleep (dwMilliseconds=0xa) [0127.919] timeGetTime () returned 0x32c0f [0127.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.919] Sleep (dwMilliseconds=0xa) [0127.935] timeGetTime () returned 0x32c1e [0127.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.935] Sleep (dwMilliseconds=0xa) [0127.951] timeGetTime () returned 0x32c2e [0127.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.951] Sleep (dwMilliseconds=0xa) [0127.966] timeGetTime () returned 0x32c3e [0127.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.966] Sleep (dwMilliseconds=0xa) [0127.983] timeGetTime () returned 0x32c4d [0127.983] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.983] Sleep (dwMilliseconds=0xa) [0127.998] timeGetTime () returned 0x32c5d [0127.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0127.998] Sleep (dwMilliseconds=0xa) [0128.013] timeGetTime () returned 0x32c6d [0128.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.013] Sleep (dwMilliseconds=0xa) [0128.029] timeGetTime () returned 0x32c7c [0128.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.029] Sleep (dwMilliseconds=0xa) [0128.045] timeGetTime () returned 0x32c8c [0128.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.045] Sleep (dwMilliseconds=0xa) [0128.060] timeGetTime () returned 0x32c9b [0128.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.060] Sleep (dwMilliseconds=0xa) [0128.076] timeGetTime () returned 0x32cab [0128.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.076] Sleep (dwMilliseconds=0xa) [0128.091] timeGetTime () returned 0x32cbb [0128.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.091] Sleep (dwMilliseconds=0xa) [0128.107] timeGetTime () returned 0x32cca [0128.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.107] Sleep (dwMilliseconds=0xa) [0128.123] timeGetTime () returned 0x32cda [0128.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.123] Sleep (dwMilliseconds=0xa) [0128.138] timeGetTime () returned 0x32cea [0128.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.138] Sleep (dwMilliseconds=0xa) [0128.154] timeGetTime () returned 0x32cf9 [0128.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.154] Sleep (dwMilliseconds=0xa) [0128.169] timeGetTime () returned 0x32d09 [0128.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.169] Sleep (dwMilliseconds=0xa) [0128.185] timeGetTime () returned 0x32d18 [0128.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.185] Sleep (dwMilliseconds=0xa) [0128.201] timeGetTime () returned 0x32d28 [0128.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.201] Sleep (dwMilliseconds=0xa) [0128.216] timeGetTime () returned 0x32d38 [0128.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.216] Sleep (dwMilliseconds=0xa) [0128.232] timeGetTime () returned 0x32d47 [0128.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.232] Sleep (dwMilliseconds=0xa) [0128.248] timeGetTime () returned 0x32d57 [0128.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.248] Sleep (dwMilliseconds=0xa) [0128.263] timeGetTime () returned 0x32d67 [0128.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.263] Sleep (dwMilliseconds=0xa) [0128.279] timeGetTime () returned 0x32d76 [0128.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.279] Sleep (dwMilliseconds=0xa) [0128.296] timeGetTime () returned 0x32d86 [0128.296] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.296] Sleep (dwMilliseconds=0xa) [0128.312] timeGetTime () returned 0x32d95 [0128.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.312] Sleep (dwMilliseconds=0xa) [0128.326] timeGetTime () returned 0x32da5 [0128.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.326] Sleep (dwMilliseconds=0xa) [0128.341] timeGetTime () returned 0x32db5 [0128.341] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0128.341] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0128.341] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0128.341] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0128.341] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0128.342] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0128.342] RegCloseKey (hKey=0x240) returned 0x0 [0128.342] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0128.342] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0128.342] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0128.342] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0128.342] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0128.342] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0128.342] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0128.342] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0128.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0128.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0128.343] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0128.343] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0128.702] FreeLibrary (hLibModule=0x77150000) returned 1 [0128.702] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0128.702] TranslateMessage (lpMsg=0x8bf708) returned 0 [0128.702] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0128.702] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0128.703] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0128.703] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0128.703] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0128.703] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0128.703] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0128.703] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0128.703] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0128.703] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0128.703] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0128.703] timeGetTime () returned 0x32f1c [0128.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.703] Sleep (dwMilliseconds=0xa) [0128.747] timeGetTime () returned 0x32f4b [0128.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.748] Sleep (dwMilliseconds=0xa) [0128.794] timeGetTime () returned 0x32f7a [0128.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.795] Sleep (dwMilliseconds=0xa) [0128.841] timeGetTime () returned 0x32fa9 [0128.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.841] Sleep (dwMilliseconds=0xa) [0128.876] timeGetTime () returned 0x32fc8 [0128.876] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.876] Sleep (dwMilliseconds=0xa) [0128.919] timeGetTime () returned 0x32ff7 [0128.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.920] Sleep (dwMilliseconds=0xa) [0128.967] timeGetTime () returned 0x33026 [0128.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.967] Sleep (dwMilliseconds=0xa) [0128.982] timeGetTime () returned 0x33035 [0128.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.982] Sleep (dwMilliseconds=0xa) [0128.998] timeGetTime () returned 0x33045 [0128.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0128.998] Sleep (dwMilliseconds=0xa) [0129.023] timeGetTime () returned 0x33055 [0129.023] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.023] Sleep (dwMilliseconds=0xa) [0129.044] timeGetTime () returned 0x33074 [0129.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.044] Sleep (dwMilliseconds=0xa) [0129.061] timeGetTime () returned 0x33084 [0129.061] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.061] Sleep (dwMilliseconds=0xa) [0129.076] timeGetTime () returned 0x33093 [0129.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.076] Sleep (dwMilliseconds=0xa) [0129.091] timeGetTime () returned 0x330a3 [0129.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.091] Sleep (dwMilliseconds=0xa) [0129.107] timeGetTime () returned 0x330b2 [0129.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.107] Sleep (dwMilliseconds=0xa) [0129.123] timeGetTime () returned 0x330c2 [0129.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.123] Sleep (dwMilliseconds=0xa) [0129.138] timeGetTime () returned 0x330d2 [0129.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.138] Sleep (dwMilliseconds=0xa) [0129.154] timeGetTime () returned 0x330e1 [0129.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.154] Sleep (dwMilliseconds=0xa) [0129.169] timeGetTime () returned 0x330f1 [0129.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.169] Sleep (dwMilliseconds=0xa) [0129.186] timeGetTime () returned 0x33100 [0129.186] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.186] Sleep (dwMilliseconds=0xa) [0129.202] timeGetTime () returned 0x33110 [0129.202] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.202] Sleep (dwMilliseconds=0xa) [0129.216] timeGetTime () returned 0x33120 [0129.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.216] Sleep (dwMilliseconds=0xa) [0129.232] timeGetTime () returned 0x3312f [0129.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.232] Sleep (dwMilliseconds=0xa) [0129.262] timeGetTime () returned 0x3313f [0129.262] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.262] Sleep (dwMilliseconds=0xa) [0129.279] timeGetTime () returned 0x3315e [0129.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.279] Sleep (dwMilliseconds=0xa) [0129.294] timeGetTime () returned 0x3316e [0129.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.294] Sleep (dwMilliseconds=0xa) [0129.310] timeGetTime () returned 0x3317d [0129.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.310] Sleep (dwMilliseconds=0xa) [0129.326] timeGetTime () returned 0x3318d [0129.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.326] Sleep (dwMilliseconds=0xa) [0129.341] timeGetTime () returned 0x3319d [0129.342] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.342] Sleep (dwMilliseconds=0xa) [0129.357] timeGetTime () returned 0x331ac [0129.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.357] Sleep (dwMilliseconds=0xa) [0129.373] timeGetTime () returned 0x331bc [0129.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.373] Sleep (dwMilliseconds=0xa) [0129.388] timeGetTime () returned 0x331cc [0129.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.388] Sleep (dwMilliseconds=0xa) [0129.404] timeGetTime () returned 0x331db [0129.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.404] Sleep (dwMilliseconds=0xa) [0129.613] timeGetTime () returned 0x332a6 [0129.613] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0129.614] TranslateMessage (lpMsg=0x8bf798) returned 0 [0129.614] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0129.614] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0129.614] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0129.614] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.614] Sleep (dwMilliseconds=0xa) [0129.641] timeGetTime () returned 0x332c6 [0129.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.641] Sleep (dwMilliseconds=0xa) [0129.654] timeGetTime () returned 0x332d5 [0129.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.654] Sleep (dwMilliseconds=0xa) [0129.671] timeGetTime () returned 0x332e5 [0129.671] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.671] Sleep (dwMilliseconds=0xa) [0129.685] timeGetTime () returned 0x332f4 [0129.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.685] Sleep (dwMilliseconds=0xa) [0129.701] timeGetTime () returned 0x33304 [0129.701] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0129.701] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0129.701] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0129.702] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0129.702] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0129.702] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0129.702] RegCloseKey (hKey=0x240) returned 0x0 [0129.702] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0129.702] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0129.702] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0129.702] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0129.702] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0129.702] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0129.702] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0129.702] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0129.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0129.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab18, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0129.703] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0129.703] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0129.795] FreeLibrary (hLibModule=0x77150000) returned 1 [0129.795] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0129.795] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0129.795] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0129.795] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0129.795] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0129.795] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0129.795] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0129.795] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0129.795] timeGetTime () returned 0x33362 [0129.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.795] Sleep (dwMilliseconds=0xa) [0129.841] timeGetTime () returned 0x33391 [0129.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.841] Sleep (dwMilliseconds=0xa) [0129.888] timeGetTime () returned 0x333c0 [0129.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.888] Sleep (dwMilliseconds=0xa) [0129.937] timeGetTime () returned 0x333ee [0129.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.937] Sleep (dwMilliseconds=0xa) [0129.982] timeGetTime () returned 0x3341d [0129.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0129.982] Sleep (dwMilliseconds=0xa) [0130.029] timeGetTime () returned 0x3344c [0130.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.029] Sleep (dwMilliseconds=0xa) [0130.051] timeGetTime () returned 0x3345c [0130.051] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.051] Sleep (dwMilliseconds=0xa) [0130.076] timeGetTime () returned 0x3347b [0130.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.076] Sleep (dwMilliseconds=0xa) [0130.103] timeGetTime () returned 0x3348b [0130.103] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.103] Sleep (dwMilliseconds=0xa) [0130.125] timeGetTime () returned 0x334ac [0130.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.125] Sleep (dwMilliseconds=0xa) [0130.138] timeGetTime () returned 0x334ba [0130.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.138] Sleep (dwMilliseconds=0xa) [0130.154] timeGetTime () returned 0x334c9 [0130.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.154] Sleep (dwMilliseconds=0xa) [0130.170] timeGetTime () returned 0x334d9 [0130.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.170] Sleep (dwMilliseconds=0xa) [0130.185] timeGetTime () returned 0x334e8 [0130.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.185] Sleep (dwMilliseconds=0xa) [0130.201] timeGetTime () returned 0x334f8 [0130.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.201] Sleep (dwMilliseconds=0xa) [0130.216] timeGetTime () returned 0x33508 [0130.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.216] Sleep (dwMilliseconds=0xa) [0130.232] timeGetTime () returned 0x33517 [0130.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.232] Sleep (dwMilliseconds=0xa) [0130.247] timeGetTime () returned 0x33527 [0130.247] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.247] Sleep (dwMilliseconds=0xa) [0130.264] timeGetTime () returned 0x33537 [0130.264] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.264] Sleep (dwMilliseconds=0xa) [0130.281] timeGetTime () returned 0x33548 [0130.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.281] Sleep (dwMilliseconds=0xa) [0130.320] timeGetTime () returned 0x33565 [0130.320] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.320] Sleep (dwMilliseconds=0xa) [0130.359] timeGetTime () returned 0x33594 [0130.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0130.359] TranslateMessage (lpMsg=0x8bf798) returned 0 [0130.359] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0130.359] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0130.359] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0130.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.359] Sleep (dwMilliseconds=0xa) [0130.379] timeGetTime () returned 0x335a4 [0130.379] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.379] Sleep (dwMilliseconds=0xa) [0130.409] timeGetTime () returned 0x335c3 [0130.409] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.409] Sleep (dwMilliseconds=0xa) [0130.629] timeGetTime () returned 0x3369e [0130.629] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.629] Sleep (dwMilliseconds=0xa) [0130.655] timeGetTime () returned 0x336bd [0130.655] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.655] Sleep (dwMilliseconds=0xa) [0130.669] timeGetTime () returned 0x336cd [0130.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.669] Sleep (dwMilliseconds=0xa) [0130.686] timeGetTime () returned 0x336dd [0130.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.686] Sleep (dwMilliseconds=0xa) [0130.701] timeGetTime () returned 0x336ec [0130.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.701] Sleep (dwMilliseconds=0xa) [0130.716] timeGetTime () returned 0x336fc [0130.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.716] Sleep (dwMilliseconds=0xa) [0130.733] timeGetTime () returned 0x3370b [0130.733] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.733] Sleep (dwMilliseconds=0xa) [0130.748] timeGetTime () returned 0x3371b [0130.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.748] Sleep (dwMilliseconds=0xa) [0130.763] timeGetTime () returned 0x3372b [0130.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.763] Sleep (dwMilliseconds=0xa) [0130.804] timeGetTime () returned 0x3374a [0130.804] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0130.804] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0130.804] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0130.804] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0130.805] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0130.805] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0130.805] RegCloseKey (hKey=0x240) returned 0x0 [0130.805] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0130.805] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0130.805] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0130.805] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0130.805] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0130.805] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0130.805] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0130.805] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0130.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0130.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aab8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0130.806] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0130.806] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0130.904] FreeLibrary (hLibModule=0x77150000) returned 1 [0130.904] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0130.904] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0130.904] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0130.904] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0130.904] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0130.904] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0130.904] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0130.905] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0130.905] timeGetTime () returned 0x337b7 [0130.905] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.905] Sleep (dwMilliseconds=0xa) [0130.951] timeGetTime () returned 0x337e6 [0130.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.951] Sleep (dwMilliseconds=0xa) [0130.997] timeGetTime () returned 0x33815 [0130.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0130.998] Sleep (dwMilliseconds=0xa) [0131.044] timeGetTime () returned 0x33844 [0131.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.044] Sleep (dwMilliseconds=0xa) [0131.092] timeGetTime () returned 0x33873 [0131.092] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.092] Sleep (dwMilliseconds=0xa) [0131.125] timeGetTime () returned 0x33892 [0131.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0131.125] TranslateMessage (lpMsg=0x8bf798) returned 0 [0131.125] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0131.125] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0131.125] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0131.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.125] Sleep (dwMilliseconds=0xa) [0131.138] timeGetTime () returned 0x338a2 [0131.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.138] Sleep (dwMilliseconds=0xa) [0131.164] timeGetTime () returned 0x338b1 [0131.164] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.164] Sleep (dwMilliseconds=0xa) [0131.185] timeGetTime () returned 0x338d0 [0131.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.185] Sleep (dwMilliseconds=0xa) [0131.201] timeGetTime () returned 0x338e0 [0131.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.201] Sleep (dwMilliseconds=0xa) [0131.217] timeGetTime () returned 0x338f0 [0131.217] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.217] Sleep (dwMilliseconds=0xa) [0131.245] timeGetTime () returned 0x338ff [0131.245] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.245] Sleep (dwMilliseconds=0xa) [0131.263] timeGetTime () returned 0x3391f [0131.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.263] Sleep (dwMilliseconds=0xa) [0131.280] timeGetTime () returned 0x3392e [0131.280] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.280] Sleep (dwMilliseconds=0xa) [0131.294] timeGetTime () returned 0x3393e [0131.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.294] Sleep (dwMilliseconds=0xa) [0131.310] timeGetTime () returned 0x3394d [0131.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.310] Sleep (dwMilliseconds=0xa) [0131.325] timeGetTime () returned 0x3395d [0131.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.326] Sleep (dwMilliseconds=0xa) [0131.341] timeGetTime () returned 0x3396d [0131.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.341] Sleep (dwMilliseconds=0xa) [0131.357] timeGetTime () returned 0x3397c [0131.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.357] Sleep (dwMilliseconds=0xa) [0131.373] timeGetTime () returned 0x3398c [0131.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.373] Sleep (dwMilliseconds=0xa) [0131.388] timeGetTime () returned 0x3399c [0131.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.388] Sleep (dwMilliseconds=0xa) [0131.407] timeGetTime () returned 0x339ad [0131.407] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.407] Sleep (dwMilliseconds=0xa) [0131.536] timeGetTime () returned 0x33a28 [0131.536] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.536] Sleep (dwMilliseconds=0xa) [0131.560] timeGetTime () returned 0x33a47 [0131.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.560] Sleep (dwMilliseconds=0xa) [0131.576] timeGetTime () returned 0x33a57 [0131.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.576] Sleep (dwMilliseconds=0xa) [0131.591] timeGetTime () returned 0x33a67 [0131.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.591] Sleep (dwMilliseconds=0xa) [0131.607] timeGetTime () returned 0x33a76 [0131.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.607] Sleep (dwMilliseconds=0xa) [0131.624] timeGetTime () returned 0x33a86 [0131.624] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.624] Sleep (dwMilliseconds=0xa) [0131.638] timeGetTime () returned 0x33a96 [0131.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.638] Sleep (dwMilliseconds=0xa) [0131.654] timeGetTime () returned 0x33aa5 [0131.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.654] Sleep (dwMilliseconds=0xa) [0131.669] timeGetTime () returned 0x33ab5 [0131.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.669] Sleep (dwMilliseconds=0xa) [0131.685] timeGetTime () returned 0x33ac4 [0131.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.685] Sleep (dwMilliseconds=0xa) [0131.701] timeGetTime () returned 0x33ad4 [0131.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.701] Sleep (dwMilliseconds=0xa) [0131.717] timeGetTime () returned 0x33ae4 [0131.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.717] Sleep (dwMilliseconds=0xa) [0131.756] timeGetTime () returned 0x33b05 [0131.757] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.757] Sleep (dwMilliseconds=0xa) [0131.780] timeGetTime () returned 0x33b22 [0131.780] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.780] Sleep (dwMilliseconds=0xa) [0131.794] timeGetTime () returned 0x33b32 [0131.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.795] Sleep (dwMilliseconds=0xa) [0131.810] timeGetTime () returned 0x33b41 [0131.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.810] Sleep (dwMilliseconds=0xa) [0131.826] timeGetTime () returned 0x33b51 [0131.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.826] Sleep (dwMilliseconds=0xa) [0131.842] timeGetTime () returned 0x33b61 [0131.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.842] Sleep (dwMilliseconds=0xa) [0131.857] timeGetTime () returned 0x33b70 [0131.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.857] Sleep (dwMilliseconds=0xa) [0131.872] timeGetTime () returned 0x33b80 [0131.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0131.873] TranslateMessage (lpMsg=0x8bf798) returned 0 [0131.873] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0131.873] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0131.873] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0131.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.873] Sleep (dwMilliseconds=0xa) [0131.888] timeGetTime () returned 0x33b90 [0131.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.888] Sleep (dwMilliseconds=0xa) [0131.904] timeGetTime () returned 0x33b9f [0131.904] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0131.904] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0131.904] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0131.904] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0131.904] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0131.904] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0131.905] RegCloseKey (hKey=0x240) returned 0x0 [0131.905] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0131.905] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0131.905] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0131.905] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0131.905] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0131.905] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0131.905] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0131.905] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0131.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0131.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0131.906] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0131.906] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0131.998] FreeLibrary (hLibModule=0x77150000) returned 1 [0131.998] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0131.998] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0131.998] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0131.998] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0131.998] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0131.998] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0131.998] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0131.998] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0131.998] timeGetTime () returned 0x33bfd [0131.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0131.999] Sleep (dwMilliseconds=0xa) [0132.045] timeGetTime () returned 0x33c2c [0132.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.045] Sleep (dwMilliseconds=0xa) [0132.091] timeGetTime () returned 0x33c5b [0132.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.091] Sleep (dwMilliseconds=0xa) [0132.140] timeGetTime () returned 0x33c8a [0132.140] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.140] Sleep (dwMilliseconds=0xa) [0132.273] timeGetTime () returned 0x33d07 [0132.273] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.273] Sleep (dwMilliseconds=0xa) [0132.311] timeGetTime () returned 0x33d35 [0132.311] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.311] Sleep (dwMilliseconds=0xa) [0132.373] timeGetTime () returned 0x33d74 [0132.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.373] Sleep (dwMilliseconds=0xa) [0132.399] timeGetTime () returned 0x33d84 [0132.399] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.399] Sleep (dwMilliseconds=0xa) [0132.429] timeGetTime () returned 0x33da3 [0132.429] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.429] Sleep (dwMilliseconds=0xa) [0132.522] timeGetTime () returned 0x33e01 [0132.522] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.522] Sleep (dwMilliseconds=0xa) [0132.544] timeGetTime () returned 0x33e20 [0132.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.544] Sleep (dwMilliseconds=0xa) [0132.560] timeGetTime () returned 0x33e2f [0132.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.560] Sleep (dwMilliseconds=0xa) [0132.578] timeGetTime () returned 0x33e3f [0132.578] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.578] Sleep (dwMilliseconds=0xa) [0132.591] timeGetTime () returned 0x33e4f [0132.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.591] Sleep (dwMilliseconds=0xa) [0132.607] timeGetTime () returned 0x33e5e [0132.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.607] Sleep (dwMilliseconds=0xa) [0132.623] timeGetTime () returned 0x33e6f [0132.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0132.624] TranslateMessage (lpMsg=0x8bf798) returned 0 [0132.624] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0132.624] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0132.624] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0132.624] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.624] Sleep (dwMilliseconds=0xa) [0132.639] timeGetTime () returned 0x33e7e [0132.639] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.639] Sleep (dwMilliseconds=0xa) [0132.654] timeGetTime () returned 0x33e8d [0132.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.654] Sleep (dwMilliseconds=0xa) [0132.669] timeGetTime () returned 0x33e9d [0132.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.669] Sleep (dwMilliseconds=0xa) [0132.685] timeGetTime () returned 0x33eac [0132.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.685] Sleep (dwMilliseconds=0xa) [0132.701] timeGetTime () returned 0x33ebc [0132.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.701] Sleep (dwMilliseconds=0xa) [0132.716] timeGetTime () returned 0x33ecc [0132.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.717] Sleep (dwMilliseconds=0xa) [0132.732] timeGetTime () returned 0x33edb [0132.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.732] Sleep (dwMilliseconds=0xa) [0132.748] timeGetTime () returned 0x33eeb [0132.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.748] Sleep (dwMilliseconds=0xa) [0132.763] timeGetTime () returned 0x33efb [0132.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.763] Sleep (dwMilliseconds=0xa) [0132.779] timeGetTime () returned 0x33f0a [0132.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.779] Sleep (dwMilliseconds=0xa) [0132.794] timeGetTime () returned 0x33f1a [0132.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.794] Sleep (dwMilliseconds=0xa) [0132.810] timeGetTime () returned 0x33f29 [0132.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.810] Sleep (dwMilliseconds=0xa) [0132.826] timeGetTime () returned 0x33f39 [0132.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.826] Sleep (dwMilliseconds=0xa) [0132.841] timeGetTime () returned 0x33f49 [0132.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.841] Sleep (dwMilliseconds=0xa) [0132.857] timeGetTime () returned 0x33f58 [0132.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.857] Sleep (dwMilliseconds=0xa) [0132.873] timeGetTime () returned 0x33f68 [0132.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.873] Sleep (dwMilliseconds=0xa) [0132.888] timeGetTime () returned 0x33f78 [0132.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.888] Sleep (dwMilliseconds=0xa) [0132.904] timeGetTime () returned 0x33f87 [0132.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.904] Sleep (dwMilliseconds=0xa) [0132.919] timeGetTime () returned 0x33f97 [0132.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.919] Sleep (dwMilliseconds=0xa) [0132.936] timeGetTime () returned 0x33fa6 [0132.936] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.936] Sleep (dwMilliseconds=0xa) [0132.952] timeGetTime () returned 0x33fb6 [0132.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.953] Sleep (dwMilliseconds=0xa) [0132.967] timeGetTime () returned 0x33fc6 [0132.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.967] Sleep (dwMilliseconds=0xa) [0132.982] timeGetTime () returned 0x33fd5 [0132.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0132.982] Sleep (dwMilliseconds=0xa) [0132.997] timeGetTime () returned 0x33fe5 [0132.998] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0132.998] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0132.998] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0132.998] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0132.998] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0132.998] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0132.998] RegCloseKey (hKey=0x240) returned 0x0 [0132.998] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0132.998] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0132.998] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0132.998] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0132.998] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0132.998] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0132.998] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0132.999] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0132.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0132.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0132.999] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0132.999] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0133.091] FreeLibrary (hLibModule=0x77150000) returned 1 [0133.091] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0133.091] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0133.091] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0133.091] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0133.091] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0133.092] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0133.092] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0133.092] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0133.092] timeGetTime () returned 0x34043 [0133.092] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.092] Sleep (dwMilliseconds=0xa) [0133.138] timeGetTime () returned 0x34072 [0133.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.138] Sleep (dwMilliseconds=0xa) [0133.185] timeGetTime () returned 0x340a0 [0133.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.185] Sleep (dwMilliseconds=0xa) [0133.218] timeGetTime () returned 0x340c0 [0133.218] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.218] Sleep (dwMilliseconds=0xa) [0133.263] timeGetTime () returned 0x340ef [0133.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.264] Sleep (dwMilliseconds=0xa) [0133.310] timeGetTime () returned 0x3411d [0133.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.310] Sleep (dwMilliseconds=0xa) [0133.326] timeGetTime () returned 0x3412d [0133.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.326] Sleep (dwMilliseconds=0xa) [0133.350] timeGetTime () returned 0x3413d [0133.350] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.350] Sleep (dwMilliseconds=0xa) [0133.374] timeGetTime () returned 0x3415c [0133.374] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0133.374] TranslateMessage (lpMsg=0x8bf798) returned 0 [0133.374] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0133.374] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0133.374] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0133.374] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.374] Sleep (dwMilliseconds=0xa) [0133.395] timeGetTime () returned 0x3416c [0133.395] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.395] DefWindowProcW (hWnd=0x3021a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0133.395] Sleep (dwMilliseconds=0xa) [0133.419] timeGetTime () returned 0x3418b [0133.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.665] Sleep (dwMilliseconds=0xa) [0133.685] timeGetTime () returned 0x34294 [0133.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.685] Sleep (dwMilliseconds=0xa) [0133.701] timeGetTime () returned 0x342a4 [0133.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.701] Sleep (dwMilliseconds=0xa) [0133.716] timeGetTime () returned 0x342b4 [0133.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.716] Sleep (dwMilliseconds=0xa) [0133.732] timeGetTime () returned 0x342c3 [0133.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.732] Sleep (dwMilliseconds=0xa) [0133.749] timeGetTime () returned 0x342d4 [0133.749] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.749] Sleep (dwMilliseconds=0xa) [0133.763] timeGetTime () returned 0x342e3 [0133.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.763] Sleep (dwMilliseconds=0xa) [0133.779] timeGetTime () returned 0x342f2 [0133.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.779] Sleep (dwMilliseconds=0xa) [0133.794] timeGetTime () returned 0x34302 [0133.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.794] Sleep (dwMilliseconds=0xa) [0133.810] timeGetTime () returned 0x34311 [0133.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.810] Sleep (dwMilliseconds=0xa) [0133.826] timeGetTime () returned 0x34321 [0133.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.826] Sleep (dwMilliseconds=0xa) [0133.841] timeGetTime () returned 0x34331 [0133.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.841] Sleep (dwMilliseconds=0xa) [0133.857] timeGetTime () returned 0x34340 [0133.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.857] Sleep (dwMilliseconds=0xa) [0133.873] timeGetTime () returned 0x34350 [0133.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.873] Sleep (dwMilliseconds=0xa) [0133.888] timeGetTime () returned 0x34360 [0133.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.888] Sleep (dwMilliseconds=0xa) [0133.904] timeGetTime () returned 0x3436f [0133.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.904] Sleep (dwMilliseconds=0xa) [0133.919] timeGetTime () returned 0x3437f [0133.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.920] Sleep (dwMilliseconds=0xa) [0133.935] timeGetTime () returned 0x3438e [0133.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.935] Sleep (dwMilliseconds=0xa) [0133.951] timeGetTime () returned 0x3439e [0133.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.951] Sleep (dwMilliseconds=0xa) [0133.966] timeGetTime () returned 0x343ae [0133.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.966] Sleep (dwMilliseconds=0xa) [0133.982] timeGetTime () returned 0x343bd [0133.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.982] Sleep (dwMilliseconds=0xa) [0133.997] timeGetTime () returned 0x343cd [0133.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0133.998] Sleep (dwMilliseconds=0xa) [0134.014] timeGetTime () returned 0x343dd [0134.014] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.014] Sleep (dwMilliseconds=0xa) [0134.029] timeGetTime () returned 0x343ec [0134.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.029] Sleep (dwMilliseconds=0xa) [0134.044] timeGetTime () returned 0x343fc [0134.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.045] Sleep (dwMilliseconds=0xa) [0134.060] timeGetTime () returned 0x3440b [0134.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.060] Sleep (dwMilliseconds=0xa) [0134.076] timeGetTime () returned 0x3441b [0134.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.076] Sleep (dwMilliseconds=0xa) [0134.092] timeGetTime () returned 0x3442b [0134.092] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0134.092] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0134.092] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0134.092] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0134.092] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0134.092] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0134.092] RegCloseKey (hKey=0x240) returned 0x0 [0134.092] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0134.092] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0134.092] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0134.093] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0134.093] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0134.093] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0134.093] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0134.093] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0134.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0134.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0134.093] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0134.093] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0134.187] FreeLibrary (hLibModule=0x77150000) returned 1 [0134.187] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0134.188] TranslateMessage (lpMsg=0x8bf708) returned 0 [0134.188] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0134.188] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0134.188] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0134.188] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0134.188] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0134.188] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0134.188] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0134.188] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0134.188] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0134.188] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0134.189] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0134.189] timeGetTime () returned 0x34488 [0134.189] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.189] Sleep (dwMilliseconds=0xa) [0134.232] timeGetTime () returned 0x344b7 [0134.233] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.233] Sleep (dwMilliseconds=0xa) [0134.279] timeGetTime () returned 0x344e6 [0134.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.279] Sleep (dwMilliseconds=0xa) [0134.329] timeGetTime () returned 0x34515 [0134.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.329] Sleep (dwMilliseconds=0xa) [0134.372] timeGetTime () returned 0x34544 [0134.372] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.372] Sleep (dwMilliseconds=0xa) [0134.417] timeGetTime () returned 0x34563 [0134.417] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.417] Sleep (dwMilliseconds=0xa) [0134.641] timeGetTime () returned 0x3464e [0134.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.641] Sleep (dwMilliseconds=0xa) [0134.654] timeGetTime () returned 0x3465d [0134.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.654] Sleep (dwMilliseconds=0xa) [0134.677] timeGetTime () returned 0x3466d [0134.677] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.677] Sleep (dwMilliseconds=0xa) [0134.711] timeGetTime () returned 0x3468c [0134.711] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.711] Sleep (dwMilliseconds=0xa) [0134.732] timeGetTime () returned 0x346ab [0134.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.732] Sleep (dwMilliseconds=0xa) [0134.748] timeGetTime () returned 0x346bb [0134.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.748] Sleep (dwMilliseconds=0xa) [0134.763] timeGetTime () returned 0x346cb [0134.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.763] Sleep (dwMilliseconds=0xa) [0134.779] timeGetTime () returned 0x346da [0134.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.779] Sleep (dwMilliseconds=0xa) [0134.794] timeGetTime () returned 0x346ea [0134.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.794] Sleep (dwMilliseconds=0xa) [0134.810] timeGetTime () returned 0x346f9 [0134.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.810] Sleep (dwMilliseconds=0xa) [0134.826] timeGetTime () returned 0x34709 [0134.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.826] Sleep (dwMilliseconds=0xa) [0134.841] timeGetTime () returned 0x34719 [0134.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.841] Sleep (dwMilliseconds=0xa) [0134.857] timeGetTime () returned 0x34728 [0134.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.857] Sleep (dwMilliseconds=0xa) [0134.874] timeGetTime () returned 0x3473a [0134.874] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.874] Sleep (dwMilliseconds=0xa) [0134.888] timeGetTime () returned 0x34748 [0134.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.888] Sleep (dwMilliseconds=0xa) [0134.904] timeGetTime () returned 0x34757 [0134.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.904] Sleep (dwMilliseconds=0xa) [0134.920] timeGetTime () returned 0x34768 [0134.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.921] Sleep (dwMilliseconds=0xa) [0134.935] timeGetTime () returned 0x34776 [0134.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0134.935] TranslateMessage (lpMsg=0x8bf798) returned 0 [0134.935] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0134.935] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0134.935] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0134.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.935] Sleep (dwMilliseconds=0xa) [0134.951] timeGetTime () returned 0x34786 [0134.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.951] Sleep (dwMilliseconds=0xa) [0134.968] timeGetTime () returned 0x34796 [0134.968] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.968] Sleep (dwMilliseconds=0xa) [0134.982] timeGetTime () returned 0x347a5 [0134.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.982] Sleep (dwMilliseconds=0xa) [0134.997] timeGetTime () returned 0x347b5 [0134.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0134.997] Sleep (dwMilliseconds=0xa) [0135.013] timeGetTime () returned 0x347c5 [0135.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.013] Sleep (dwMilliseconds=0xa) [0135.029] timeGetTime () returned 0x347d4 [0135.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.029] Sleep (dwMilliseconds=0xa) [0135.044] timeGetTime () returned 0x347e4 [0135.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.044] Sleep (dwMilliseconds=0xa) [0135.060] timeGetTime () returned 0x347f3 [0135.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.060] Sleep (dwMilliseconds=0xa) [0135.076] timeGetTime () returned 0x34803 [0135.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.076] Sleep (dwMilliseconds=0xa) [0135.091] timeGetTime () returned 0x34813 [0135.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.091] Sleep (dwMilliseconds=0xa) [0135.107] timeGetTime () returned 0x34822 [0135.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.107] Sleep (dwMilliseconds=0xa) [0135.122] timeGetTime () returned 0x34832 [0135.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.122] Sleep (dwMilliseconds=0xa) [0135.138] timeGetTime () returned 0x34842 [0135.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.138] Sleep (dwMilliseconds=0xa) [0135.154] timeGetTime () returned 0x34851 [0135.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.154] Sleep (dwMilliseconds=0xa) [0135.171] timeGetTime () returned 0x34862 [0135.171] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.171] Sleep (dwMilliseconds=0xa) [0135.185] timeGetTime () returned 0x34870 [0135.185] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0135.185] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0135.185] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0135.185] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0135.185] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0135.186] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0135.186] RegCloseKey (hKey=0x240) returned 0x0 [0135.186] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0135.186] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0135.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0135.186] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0135.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0135.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0135.186] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0135.186] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0135.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0135.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0135.187] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0135.187] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0135.279] FreeLibrary (hLibModule=0x77150000) returned 1 [0135.279] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0135.279] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0135.279] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0135.279] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0135.279] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0135.279] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0135.279] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0135.279] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0135.280] timeGetTime () returned 0x348ce [0135.280] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.280] Sleep (dwMilliseconds=0xa) [0135.585] timeGetTime () returned 0x349f7 [0135.585] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.585] Sleep (dwMilliseconds=0xa) [0135.626] timeGetTime () returned 0x34a26 [0135.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.626] Sleep (dwMilliseconds=0xa) [0135.717] timeGetTime () returned 0x34a84 [0135.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0135.717] TranslateMessage (lpMsg=0x8bf798) returned 0 [0135.717] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0135.717] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0135.717] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0135.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.717] Sleep (dwMilliseconds=0xa) [0135.742] timeGetTime () returned 0x34a93 [0135.742] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.742] Sleep (dwMilliseconds=0xa) [0135.772] timeGetTime () returned 0x34ab3 [0135.772] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.772] Sleep (dwMilliseconds=0xa) [0135.795] timeGetTime () returned 0x34ad2 [0135.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.795] Sleep (dwMilliseconds=0xa) [0135.810] timeGetTime () returned 0x34ae1 [0135.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.810] Sleep (dwMilliseconds=0xa) [0135.826] timeGetTime () returned 0x34af1 [0135.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.826] Sleep (dwMilliseconds=0xa) [0135.842] timeGetTime () returned 0x34b01 [0135.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.842] Sleep (dwMilliseconds=0xa) [0135.857] timeGetTime () returned 0x34b10 [0135.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.857] Sleep (dwMilliseconds=0xa) [0135.872] timeGetTime () returned 0x34b20 [0135.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.872] Sleep (dwMilliseconds=0xa) [0135.888] timeGetTime () returned 0x34b30 [0135.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.888] Sleep (dwMilliseconds=0xa) [0135.904] timeGetTime () returned 0x34b3f [0135.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.904] Sleep (dwMilliseconds=0xa) [0135.919] timeGetTime () returned 0x34b4f [0135.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.919] Sleep (dwMilliseconds=0xa) [0135.935] timeGetTime () returned 0x34b5e [0135.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.935] Sleep (dwMilliseconds=0xa) [0135.951] timeGetTime () returned 0x34b6e [0135.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.951] Sleep (dwMilliseconds=0xa) [0135.979] timeGetTime () returned 0x34b7e [0135.979] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.979] Sleep (dwMilliseconds=0xa) [0135.997] timeGetTime () returned 0x34b9d [0135.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0135.998] Sleep (dwMilliseconds=0xa) [0136.013] timeGetTime () returned 0x34bad [0136.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.013] Sleep (dwMilliseconds=0xa) [0136.029] timeGetTime () returned 0x34bbc [0136.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.029] Sleep (dwMilliseconds=0xa) [0136.045] timeGetTime () returned 0x34bcc [0136.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.045] Sleep (dwMilliseconds=0xa) [0136.060] timeGetTime () returned 0x34bdb [0136.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.060] Sleep (dwMilliseconds=0xa) [0136.075] timeGetTime () returned 0x34beb [0136.075] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.075] Sleep (dwMilliseconds=0xa) [0136.091] timeGetTime () returned 0x34bfb [0136.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.091] Sleep (dwMilliseconds=0xa) [0136.107] timeGetTime () returned 0x34c0a [0136.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.107] Sleep (dwMilliseconds=0xa) [0136.123] timeGetTime () returned 0x34c1a [0136.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.123] Sleep (dwMilliseconds=0xa) [0136.138] timeGetTime () returned 0x34c2a [0136.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.138] Sleep (dwMilliseconds=0xa) [0136.154] timeGetTime () returned 0x34c39 [0136.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.154] Sleep (dwMilliseconds=0xa) [0136.169] timeGetTime () returned 0x34c49 [0136.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.169] Sleep (dwMilliseconds=0xa) [0136.185] timeGetTime () returned 0x34c58 [0136.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.185] Sleep (dwMilliseconds=0xa) [0136.200] timeGetTime () returned 0x34c68 [0136.200] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.200] Sleep (dwMilliseconds=0xa) [0136.216] timeGetTime () returned 0x34c78 [0136.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.217] Sleep (dwMilliseconds=0xa) [0136.232] timeGetTime () returned 0x34c87 [0136.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.232] Sleep (dwMilliseconds=0xa) [0136.247] timeGetTime () returned 0x34c97 [0136.247] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.247] Sleep (dwMilliseconds=0xa) [0136.263] timeGetTime () returned 0x34ca7 [0136.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.263] Sleep (dwMilliseconds=0xa) [0136.280] timeGetTime () returned 0x34cb7 [0136.280] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0136.280] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0136.280] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0136.280] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0136.280] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0136.280] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0136.280] RegCloseKey (hKey=0x240) returned 0x0 [0136.280] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0136.280] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0136.280] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0136.281] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0136.281] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0136.281] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0136.281] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0136.281] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0136.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0136.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0136.281] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0136.281] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0136.389] FreeLibrary (hLibModule=0x77150000) returned 1 [0136.389] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0136.389] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0136.389] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0136.389] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0136.389] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0136.389] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0136.389] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0136.389] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0136.389] timeGetTime () returned 0x34d24 [0136.389] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.389] Sleep (dwMilliseconds=0xa) [0136.498] timeGetTime () returned 0x34d91 [0136.498] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0136.498] TranslateMessage (lpMsg=0x8bf798) returned 0 [0136.498] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0136.498] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0136.498] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0136.498] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.499] Sleep (dwMilliseconds=0xa) [0136.544] timeGetTime () returned 0x34dc0 [0136.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.544] Sleep (dwMilliseconds=0xa) [0136.591] timeGetTime () returned 0x34def [0136.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.591] Sleep (dwMilliseconds=0xa) [0136.638] timeGetTime () returned 0x34e1e [0136.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.638] Sleep (dwMilliseconds=0xa) [0136.659] timeGetTime () returned 0x34e2d [0136.659] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.659] Sleep (dwMilliseconds=0xa) [0136.669] timeGetTime () returned 0x34e3d [0136.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.669] Sleep (dwMilliseconds=0xa) [0136.686] timeGetTime () returned 0x34e4c [0136.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.686] Sleep (dwMilliseconds=0xa) [0136.709] timeGetTime () returned 0x34e5c [0136.709] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.709] Sleep (dwMilliseconds=0xa) [0136.732] timeGetTime () returned 0x34e7b [0136.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.732] Sleep (dwMilliseconds=0xa) [0136.747] timeGetTime () returned 0x34e8b [0136.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.747] Sleep (dwMilliseconds=0xa) [0136.763] timeGetTime () returned 0x34e9b [0136.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.763] Sleep (dwMilliseconds=0xa) [0136.779] timeGetTime () returned 0x34eaa [0136.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.779] Sleep (dwMilliseconds=0xa) [0136.794] timeGetTime () returned 0x34eba [0136.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.794] Sleep (dwMilliseconds=0xa) [0136.810] timeGetTime () returned 0x34ec9 [0136.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.810] Sleep (dwMilliseconds=0xa) [0136.826] timeGetTime () returned 0x34ed9 [0136.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.826] Sleep (dwMilliseconds=0xa) [0136.841] timeGetTime () returned 0x34ee9 [0136.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.841] Sleep (dwMilliseconds=0xa) [0136.857] timeGetTime () returned 0x34ef8 [0136.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.857] Sleep (dwMilliseconds=0xa) [0136.873] timeGetTime () returned 0x34f08 [0136.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.873] Sleep (dwMilliseconds=0xa) [0136.888] timeGetTime () returned 0x34f18 [0136.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.888] Sleep (dwMilliseconds=0xa) [0136.905] timeGetTime () returned 0x34f27 [0136.905] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.905] Sleep (dwMilliseconds=0xa) [0136.919] timeGetTime () returned 0x34f37 [0136.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.919] Sleep (dwMilliseconds=0xa) [0136.935] timeGetTime () returned 0x34f46 [0136.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.935] Sleep (dwMilliseconds=0xa) [0136.950] timeGetTime () returned 0x34f56 [0136.950] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.950] Sleep (dwMilliseconds=0xa) [0136.967] timeGetTime () returned 0x34f66 [0136.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.967] Sleep (dwMilliseconds=0xa) [0136.982] timeGetTime () returned 0x34f75 [0136.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.982] Sleep (dwMilliseconds=0xa) [0136.997] timeGetTime () returned 0x34f85 [0136.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0136.997] Sleep (dwMilliseconds=0xa) [0137.013] timeGetTime () returned 0x34f95 [0137.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.013] Sleep (dwMilliseconds=0xa) [0137.029] timeGetTime () returned 0x34fa4 [0137.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.029] Sleep (dwMilliseconds=0xa) [0137.044] timeGetTime () returned 0x34fb4 [0137.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.044] Sleep (dwMilliseconds=0xa) [0137.060] timeGetTime () returned 0x34fc3 [0137.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.060] Sleep (dwMilliseconds=0xa) [0137.076] timeGetTime () returned 0x34fd3 [0137.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.076] Sleep (dwMilliseconds=0xa) [0137.154] timeGetTime () returned 0x35021 [0137.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.154] Sleep (dwMilliseconds=0xa) [0137.169] timeGetTime () returned 0x35031 [0137.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.169] Sleep (dwMilliseconds=0xa) [0137.185] timeGetTime () returned 0x35040 [0137.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.185] Sleep (dwMilliseconds=0xa) [0137.200] timeGetTime () returned 0x35050 [0137.200] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.201] Sleep (dwMilliseconds=0xa) [0137.216] timeGetTime () returned 0x35060 [0137.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.216] Sleep (dwMilliseconds=0xa) [0137.232] timeGetTime () returned 0x3506f [0137.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.232] Sleep (dwMilliseconds=0xa) [0137.291] timeGetTime () returned 0x3509e [0137.291] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0137.291] TranslateMessage (lpMsg=0x8bf798) returned 0 [0137.291] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0137.291] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0137.291] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0137.291] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.291] Sleep (dwMilliseconds=0xa) [0137.310] timeGetTime () returned 0x350bd [0137.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.310] Sleep (dwMilliseconds=0xa) [0137.325] timeGetTime () returned 0x350cd [0137.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.326] Sleep (dwMilliseconds=0xa) [0137.341] timeGetTime () returned 0x350dd [0137.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.341] Sleep (dwMilliseconds=0xa) [0137.357] timeGetTime () returned 0x350ec [0137.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.357] Sleep (dwMilliseconds=0xa) [0137.372] timeGetTime () returned 0x350fc [0137.372] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.372] Sleep (dwMilliseconds=0xa) [0137.388] timeGetTime () returned 0x3510c [0137.388] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0137.388] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0137.388] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0137.388] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0137.388] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0137.388] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0137.388] RegCloseKey (hKey=0x240) returned 0x0 [0137.389] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0137.389] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0137.389] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0137.389] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0137.389] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0137.389] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0137.389] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0137.389] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0137.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0137.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0137.389] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0137.389] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0137.529] FreeLibrary (hLibModule=0x77150000) returned 1 [0137.529] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0137.529] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0137.529] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0137.529] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0137.529] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0137.529] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0137.529] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0137.529] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0137.529] timeGetTime () returned 0x35198 [0137.529] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.529] Sleep (dwMilliseconds=0xa) [0137.575] timeGetTime () returned 0x351c7 [0137.575] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.576] Sleep (dwMilliseconds=0xa) [0137.623] timeGetTime () returned 0x351f6 [0137.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.623] Sleep (dwMilliseconds=0xa) [0137.669] timeGetTime () returned 0x35225 [0137.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.669] Sleep (dwMilliseconds=0xa) [0137.716] timeGetTime () returned 0x35254 [0137.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.716] Sleep (dwMilliseconds=0xa) [0137.757] timeGetTime () returned 0x35273 [0137.757] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.757] Sleep (dwMilliseconds=0xa) [0137.780] timeGetTime () returned 0x35292 [0137.780] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.780] Sleep (dwMilliseconds=0xa) [0137.801] timeGetTime () returned 0x352a2 [0137.801] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.801] Sleep (dwMilliseconds=0xa) [0137.826] timeGetTime () returned 0x352c1 [0137.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.826] Sleep (dwMilliseconds=0xa) [0137.841] timeGetTime () returned 0x352d1 [0137.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.841] Sleep (dwMilliseconds=0xa) [0137.858] timeGetTime () returned 0x352e0 [0137.858] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.858] Sleep (dwMilliseconds=0xa) [0137.872] timeGetTime () returned 0x352f0 [0137.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.872] Sleep (dwMilliseconds=0xa) [0137.888] timeGetTime () returned 0x35300 [0137.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.888] Sleep (dwMilliseconds=0xa) [0137.904] timeGetTime () returned 0x3530f [0137.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.904] Sleep (dwMilliseconds=0xa) [0137.919] timeGetTime () returned 0x3531f [0137.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.919] Sleep (dwMilliseconds=0xa) [0137.935] timeGetTime () returned 0x3532e [0137.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.935] Sleep (dwMilliseconds=0xa) [0137.951] timeGetTime () returned 0x3533e [0137.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.951] Sleep (dwMilliseconds=0xa) [0137.966] timeGetTime () returned 0x3534e [0137.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.966] Sleep (dwMilliseconds=0xa) [0137.982] timeGetTime () returned 0x3535d [0137.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.982] Sleep (dwMilliseconds=0xa) [0137.998] timeGetTime () returned 0x3536d [0137.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0137.998] Sleep (dwMilliseconds=0xa) [0138.013] timeGetTime () returned 0x3537d [0138.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.013] Sleep (dwMilliseconds=0xa) [0138.029] timeGetTime () returned 0x3538c [0138.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.029] Sleep (dwMilliseconds=0xa) [0138.044] timeGetTime () returned 0x3539c [0138.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0138.044] TranslateMessage (lpMsg=0x8bf798) returned 0 [0138.044] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0138.045] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0138.045] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0138.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.045] Sleep (dwMilliseconds=0xa) [0138.061] timeGetTime () returned 0x353ab [0138.061] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.061] Sleep (dwMilliseconds=0xa) [0138.077] timeGetTime () returned 0x353bb [0138.077] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.077] Sleep (dwMilliseconds=0xa) [0138.092] timeGetTime () returned 0x353cb [0138.092] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.092] Sleep (dwMilliseconds=0xa) [0138.107] timeGetTime () returned 0x353da [0138.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.107] Sleep (dwMilliseconds=0xa) [0138.122] timeGetTime () returned 0x353ea [0138.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.122] Sleep (dwMilliseconds=0xa) [0138.139] timeGetTime () returned 0x353fa [0138.139] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.139] Sleep (dwMilliseconds=0xa) [0138.154] timeGetTime () returned 0x35409 [0138.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.154] Sleep (dwMilliseconds=0xa) [0138.170] timeGetTime () returned 0x35419 [0138.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.170] Sleep (dwMilliseconds=0xa) [0138.185] timeGetTime () returned 0x35428 [0138.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.185] Sleep (dwMilliseconds=0xa) [0138.200] timeGetTime () returned 0x35438 [0138.200] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.201] Sleep (dwMilliseconds=0xa) [0138.216] timeGetTime () returned 0x35448 [0138.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.216] Sleep (dwMilliseconds=0xa) [0138.232] timeGetTime () returned 0x35457 [0138.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.232] Sleep (dwMilliseconds=0xa) [0138.248] timeGetTime () returned 0x35467 [0138.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.248] Sleep (dwMilliseconds=0xa) [0138.263] timeGetTime () returned 0x35477 [0138.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.263] Sleep (dwMilliseconds=0xa) [0138.279] timeGetTime () returned 0x35486 [0138.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.279] Sleep (dwMilliseconds=0xa) [0138.295] timeGetTime () returned 0x35496 [0138.295] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.295] Sleep (dwMilliseconds=0xa) [0138.310] timeGetTime () returned 0x354a5 [0138.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.310] Sleep (dwMilliseconds=0xa) [0138.326] timeGetTime () returned 0x354b5 [0138.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.326] Sleep (dwMilliseconds=0xa) [0138.341] timeGetTime () returned 0x354c5 [0138.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.341] Sleep (dwMilliseconds=0xa) [0138.357] timeGetTime () returned 0x354d4 [0138.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.357] Sleep (dwMilliseconds=0xa) [0138.433] timeGetTime () returned 0x35513 [0138.433] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.433] Sleep (dwMilliseconds=0xa) [0138.456] timeGetTime () returned 0x35532 [0138.456] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.456] Sleep (dwMilliseconds=0xa) [0138.467] timeGetTime () returned 0x35542 [0138.467] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.467] Sleep (dwMilliseconds=0xa) [0138.482] timeGetTime () returned 0x35551 [0138.482] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.482] Sleep (dwMilliseconds=0xa) [0138.498] timeGetTime () returned 0x35562 [0138.498] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.498] Sleep (dwMilliseconds=0xa) [0138.519] timeGetTime () returned 0x35571 [0138.519] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.519] Sleep (dwMilliseconds=0xa) [0138.545] timeGetTime () returned 0x35590 [0138.545] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0138.545] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0138.545] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0138.546] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0138.546] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0138.546] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0138.546] RegCloseKey (hKey=0x240) returned 0x0 [0138.546] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0138.546] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0138.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0138.546] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0138.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0138.546] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0138.546] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0138.546] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0138.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0138.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0138.547] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0138.547] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0138.638] FreeLibrary (hLibModule=0x77150000) returned 1 [0138.638] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0138.639] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0138.639] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0138.639] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0138.639] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0138.639] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0138.639] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0138.639] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0138.639] timeGetTime () returned 0x355ee [0138.639] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.639] Sleep (dwMilliseconds=0xa) [0138.686] timeGetTime () returned 0x3561d [0138.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.686] Sleep (dwMilliseconds=0xa) [0138.732] timeGetTime () returned 0x3564b [0138.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.732] Sleep (dwMilliseconds=0xa) [0138.767] timeGetTime () returned 0x3566b [0138.767] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.767] Sleep (dwMilliseconds=0xa) [0138.811] timeGetTime () returned 0x35699 [0138.811] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0138.811] TranslateMessage (lpMsg=0x8bf798) returned 0 [0138.811] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0138.811] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0138.811] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0138.811] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.811] Sleep (dwMilliseconds=0xa) [0138.856] timeGetTime () returned 0x356b9 [0138.856] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.856] Sleep (dwMilliseconds=0xa) [0138.872] timeGetTime () returned 0x356d8 [0138.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.873] Sleep (dwMilliseconds=0xa) [0138.898] timeGetTime () returned 0x356e8 [0138.898] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.898] Sleep (dwMilliseconds=0xa) [0138.919] timeGetTime () returned 0x35707 [0138.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.919] Sleep (dwMilliseconds=0xa) [0138.935] timeGetTime () returned 0x35716 [0138.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.935] Sleep (dwMilliseconds=0xa) [0138.950] timeGetTime () returned 0x35726 [0138.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.951] Sleep (dwMilliseconds=0xa) [0138.966] timeGetTime () returned 0x35736 [0138.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.966] Sleep (dwMilliseconds=0xa) [0138.982] timeGetTime () returned 0x35745 [0138.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.982] Sleep (dwMilliseconds=0xa) [0138.998] timeGetTime () returned 0x35755 [0138.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0138.998] Sleep (dwMilliseconds=0xa) [0139.013] timeGetTime () returned 0x35765 [0139.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.013] Sleep (dwMilliseconds=0xa) [0139.029] timeGetTime () returned 0x35774 [0139.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.029] Sleep (dwMilliseconds=0xa) [0139.044] timeGetTime () returned 0x35784 [0139.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.044] Sleep (dwMilliseconds=0xa) [0139.060] timeGetTime () returned 0x35793 [0139.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.060] Sleep (dwMilliseconds=0xa) [0139.106] timeGetTime () returned 0x357b3 [0139.106] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.106] Sleep (dwMilliseconds=0xa) [0139.122] timeGetTime () returned 0x357d2 [0139.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.122] Sleep (dwMilliseconds=0xa) [0139.138] timeGetTime () returned 0x357e2 [0139.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.138] Sleep (dwMilliseconds=0xa) [0139.154] timeGetTime () returned 0x357f1 [0139.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.154] Sleep (dwMilliseconds=0xa) [0139.170] timeGetTime () returned 0x35801 [0139.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.170] Sleep (dwMilliseconds=0xa) [0139.185] timeGetTime () returned 0x35810 [0139.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.185] Sleep (dwMilliseconds=0xa) [0139.201] timeGetTime () returned 0x35820 [0139.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.201] Sleep (dwMilliseconds=0xa) [0139.216] timeGetTime () returned 0x35830 [0139.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.216] Sleep (dwMilliseconds=0xa) [0139.232] timeGetTime () returned 0x3583f [0139.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.232] Sleep (dwMilliseconds=0xa) [0139.247] timeGetTime () returned 0x3584f [0139.247] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.247] Sleep (dwMilliseconds=0xa) [0139.263] timeGetTime () returned 0x3585f [0139.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.263] Sleep (dwMilliseconds=0xa) [0139.279] timeGetTime () returned 0x3586e [0139.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.279] Sleep (dwMilliseconds=0xa) [0139.294] timeGetTime () returned 0x3587e [0139.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.294] Sleep (dwMilliseconds=0xa) [0139.339] timeGetTime () returned 0x3589d [0139.339] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.339] Sleep (dwMilliseconds=0xa) [0139.357] timeGetTime () returned 0x358bc [0139.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.357] Sleep (dwMilliseconds=0xa) [0139.372] timeGetTime () returned 0x358cc [0139.372] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.372] Sleep (dwMilliseconds=0xa) [0139.388] timeGetTime () returned 0x358dc [0139.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.388] Sleep (dwMilliseconds=0xa) [0139.404] timeGetTime () returned 0x358eb [0139.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.404] Sleep (dwMilliseconds=0xa) [0139.420] timeGetTime () returned 0x358fb [0139.420] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.420] Sleep (dwMilliseconds=0xa) [0139.456] timeGetTime () returned 0x3591a [0139.456] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.456] Sleep (dwMilliseconds=0xa) [0139.466] timeGetTime () returned 0x3592a [0139.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.466] Sleep (dwMilliseconds=0xa) [0139.482] timeGetTime () returned 0x35939 [0139.482] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.482] Sleep (dwMilliseconds=0xa) [0139.497] timeGetTime () returned 0x35949 [0139.497] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.497] Sleep (dwMilliseconds=0xa) [0139.519] timeGetTime () returned 0x35959 [0139.519] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.519] Sleep (dwMilliseconds=0xa) [0139.544] timeGetTime () returned 0x35978 [0139.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.544] Sleep (dwMilliseconds=0xa) [0139.560] timeGetTime () returned 0x35987 [0139.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0139.560] TranslateMessage (lpMsg=0x8bf798) returned 0 [0139.561] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0139.561] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0139.561] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0139.561] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.561] Sleep (dwMilliseconds=0xa) [0139.575] timeGetTime () returned 0x35997 [0139.575] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.575] Sleep (dwMilliseconds=0xa) [0139.591] timeGetTime () returned 0x359a7 [0139.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.591] Sleep (dwMilliseconds=0xa) [0139.607] timeGetTime () returned 0x359b6 [0139.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.607] Sleep (dwMilliseconds=0xa) [0139.622] timeGetTime () returned 0x359c6 [0139.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.623] Sleep (dwMilliseconds=0xa) [0139.638] timeGetTime () returned 0x359d6 [0139.638] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0139.638] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0139.638] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0139.638] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0139.638] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0139.638] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0139.639] RegCloseKey (hKey=0x240) returned 0x0 [0139.639] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0139.639] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0139.639] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0139.639] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0139.639] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0139.639] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0139.639] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0139.639] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0139.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0139.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0139.639] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0139.639] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0139.732] FreeLibrary (hLibModule=0x77150000) returned 1 [0139.732] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0139.732] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0139.732] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0139.732] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0139.732] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0139.732] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0139.733] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0139.733] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0139.733] timeGetTime () returned 0x35a33 [0139.733] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.733] Sleep (dwMilliseconds=0xa) [0139.779] timeGetTime () returned 0x35a62 [0139.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.779] Sleep (dwMilliseconds=0xa) [0139.826] timeGetTime () returned 0x35a91 [0139.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.826] Sleep (dwMilliseconds=0xa) [0139.860] timeGetTime () returned 0x35ab1 [0139.860] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.860] Sleep (dwMilliseconds=0xa) [0139.904] timeGetTime () returned 0x35ae0 [0139.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.904] Sleep (dwMilliseconds=0xa) [0139.952] timeGetTime () returned 0x35b0f [0139.952] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.952] Sleep (dwMilliseconds=0xa) [0139.977] timeGetTime () returned 0x35b1e [0139.977] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0139.977] Sleep (dwMilliseconds=0xa) [0140.014] timeGetTime () returned 0x35b4d [0140.014] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.014] Sleep (dwMilliseconds=0xa) [0140.038] timeGetTime () returned 0x35b5c [0140.038] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.039] Sleep (dwMilliseconds=0xa) [0140.060] timeGetTime () returned 0x35b7b [0140.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.060] Sleep (dwMilliseconds=0xa) [0140.076] timeGetTime () returned 0x35b8b [0140.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.076] Sleep (dwMilliseconds=0xa) [0140.091] timeGetTime () returned 0x35b9b [0140.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.091] Sleep (dwMilliseconds=0xa) [0140.107] timeGetTime () returned 0x35bab [0140.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.107] Sleep (dwMilliseconds=0xa) [0140.122] timeGetTime () returned 0x35bba [0140.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.122] Sleep (dwMilliseconds=0xa) [0140.139] timeGetTime () returned 0x35bca [0140.139] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.139] Sleep (dwMilliseconds=0xa) [0140.154] timeGetTime () returned 0x35bd9 [0140.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.154] Sleep (dwMilliseconds=0xa) [0140.169] timeGetTime () returned 0x35be9 [0140.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.169] Sleep (dwMilliseconds=0xa) [0140.185] timeGetTime () returned 0x35bf8 [0140.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.185] Sleep (dwMilliseconds=0xa) [0140.201] timeGetTime () returned 0x35c08 [0140.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.201] Sleep (dwMilliseconds=0xa) [0140.216] timeGetTime () returned 0x35c18 [0140.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.216] Sleep (dwMilliseconds=0xa) [0140.232] timeGetTime () returned 0x35c27 [0140.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.232] Sleep (dwMilliseconds=0xa) [0140.248] timeGetTime () returned 0x35c37 [0140.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.248] Sleep (dwMilliseconds=0xa) [0140.264] timeGetTime () returned 0x35c47 [0140.264] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.264] Sleep (dwMilliseconds=0xa) [0140.279] timeGetTime () returned 0x35c56 [0140.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.279] Sleep (dwMilliseconds=0xa) [0140.294] timeGetTime () returned 0x35c66 [0140.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.294] Sleep (dwMilliseconds=0xa) [0140.310] timeGetTime () returned 0x35c75 [0140.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.310] Sleep (dwMilliseconds=0xa) [0140.326] timeGetTime () returned 0x35c85 [0140.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0140.326] TranslateMessage (lpMsg=0x8bf798) returned 0 [0140.326] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0140.326] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0140.326] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0140.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.326] Sleep (dwMilliseconds=0xa) [0140.341] timeGetTime () returned 0x35c95 [0140.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.341] Sleep (dwMilliseconds=0xa) [0140.357] timeGetTime () returned 0x35ca4 [0140.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.357] Sleep (dwMilliseconds=0xa) [0140.372] timeGetTime () returned 0x35cb4 [0140.372] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.372] Sleep (dwMilliseconds=0xa) [0140.389] timeGetTime () returned 0x35cc4 [0140.389] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.389] Sleep (dwMilliseconds=0xa) [0140.404] timeGetTime () returned 0x35cd3 [0140.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.404] Sleep (dwMilliseconds=0xa) [0140.424] timeGetTime () returned 0x35ce3 [0140.424] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.424] Sleep (dwMilliseconds=0xa) [0140.511] timeGetTime () returned 0x35d31 [0140.511] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.511] Sleep (dwMilliseconds=0xa) [0140.533] timeGetTime () returned 0x35d50 [0140.533] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.533] Sleep (dwMilliseconds=0xa) [0140.565] timeGetTime () returned 0x35d6f [0140.565] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.565] Sleep (dwMilliseconds=0xa) [0140.576] timeGetTime () returned 0x35d7f [0140.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.576] Sleep (dwMilliseconds=0xa) [0140.591] timeGetTime () returned 0x35d8f [0140.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.591] Sleep (dwMilliseconds=0xa) [0140.607] timeGetTime () returned 0x35d9e [0140.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.607] Sleep (dwMilliseconds=0xa) [0140.623] timeGetTime () returned 0x35dae [0140.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.623] Sleep (dwMilliseconds=0xa) [0140.640] timeGetTime () returned 0x35dbe [0140.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.641] Sleep (dwMilliseconds=0xa) [0140.654] timeGetTime () returned 0x35dcd [0140.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.654] Sleep (dwMilliseconds=0xa) [0140.671] timeGetTime () returned 0x35ddd [0140.671] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.671] Sleep (dwMilliseconds=0xa) [0140.685] timeGetTime () returned 0x35dec [0140.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.685] Sleep (dwMilliseconds=0xa) [0140.707] timeGetTime () returned 0x35dfc [0140.707] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.707] Sleep (dwMilliseconds=0xa) [0140.732] timeGetTime () returned 0x35e1b [0140.732] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0140.732] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0140.732] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0140.732] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0140.732] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0140.732] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0140.732] RegCloseKey (hKey=0x240) returned 0x0 [0140.732] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0140.732] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0140.733] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0140.733] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0140.733] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0140.733] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0140.733] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0140.733] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0140.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0140.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0140.733] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0140.733] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.841] FreeLibrary (hLibModule=0x77150000) returned 1 [0140.841] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0140.841] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0140.841] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0140.841] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0140.842] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0140.842] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0140.842] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0140.842] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0140.842] timeGetTime () returned 0x35e89 [0140.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.842] Sleep (dwMilliseconds=0xa) [0140.888] timeGetTime () returned 0x35eb8 [0140.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.888] Sleep (dwMilliseconds=0xa) [0140.935] timeGetTime () returned 0x35ee6 [0140.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0140.935] Sleep (dwMilliseconds=0xa) [0141.029] timeGetTime () returned 0x35f44 [0141.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.029] Sleep (dwMilliseconds=0xa) [0141.050] timeGetTime () returned 0x35f54 [0141.050] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.050] Sleep (dwMilliseconds=0xa) [0141.082] timeGetTime () returned 0x35f73 [0141.082] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0141.082] TranslateMessage (lpMsg=0x8bf798) returned 0 [0141.082] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0141.082] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0141.083] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0141.083] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.083] Sleep (dwMilliseconds=0xa) [0141.111] timeGetTime () returned 0x35f92 [0141.111] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.111] Sleep (dwMilliseconds=0xa) [0141.122] timeGetTime () returned 0x35fa2 [0141.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.122] Sleep (dwMilliseconds=0xa) [0141.138] timeGetTime () returned 0x35fb2 [0141.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.138] Sleep (dwMilliseconds=0xa) [0141.154] timeGetTime () returned 0x35fc1 [0141.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.154] Sleep (dwMilliseconds=0xa) [0141.170] timeGetTime () returned 0x35fd1 [0141.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.170] Sleep (dwMilliseconds=0xa) [0141.186] timeGetTime () returned 0x35fe1 [0141.186] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.186] Sleep (dwMilliseconds=0xa) [0141.200] timeGetTime () returned 0x35ff0 [0141.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.201] Sleep (dwMilliseconds=0xa) [0141.216] timeGetTime () returned 0x36000 [0141.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.216] Sleep (dwMilliseconds=0xa) [0141.232] timeGetTime () returned 0x3600f [0141.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.232] Sleep (dwMilliseconds=0xa) [0141.248] timeGetTime () returned 0x3601f [0141.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.248] Sleep (dwMilliseconds=0xa) [0141.272] timeGetTime () returned 0x3602f [0141.272] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.272] Sleep (dwMilliseconds=0xa) [0141.294] timeGetTime () returned 0x3604e [0141.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.294] Sleep (dwMilliseconds=0xa) [0141.310] timeGetTime () returned 0x3605d [0141.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.310] Sleep (dwMilliseconds=0xa) [0141.326] timeGetTime () returned 0x3606d [0141.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.326] Sleep (dwMilliseconds=0xa) [0141.341] timeGetTime () returned 0x3607d [0141.342] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.342] Sleep (dwMilliseconds=0xa) [0141.357] timeGetTime () returned 0x3608c [0141.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.357] Sleep (dwMilliseconds=0xa) [0141.372] timeGetTime () returned 0x3609c [0141.372] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.372] Sleep (dwMilliseconds=0xa) [0141.388] timeGetTime () returned 0x360ac [0141.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.388] Sleep (dwMilliseconds=0xa) [0141.404] timeGetTime () returned 0x360bb [0141.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.404] Sleep (dwMilliseconds=0xa) [0141.419] timeGetTime () returned 0x360cb [0141.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.419] Sleep (dwMilliseconds=0xa) [0141.435] timeGetTime () returned 0x360da [0141.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.435] Sleep (dwMilliseconds=0xa) [0141.489] timeGetTime () returned 0x36109 [0141.489] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.489] Sleep (dwMilliseconds=0xa) [0141.520] timeGetTime () returned 0x36129 [0141.520] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.520] Sleep (dwMilliseconds=0xa) [0141.544] timeGetTime () returned 0x36148 [0141.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.544] Sleep (dwMilliseconds=0xa) [0141.560] timeGetTime () returned 0x36157 [0141.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.560] Sleep (dwMilliseconds=0xa) [0141.575] timeGetTime () returned 0x36167 [0141.575] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.575] Sleep (dwMilliseconds=0xa) [0141.591] timeGetTime () returned 0x36177 [0141.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.591] Sleep (dwMilliseconds=0xa) [0141.607] timeGetTime () returned 0x36186 [0141.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.607] Sleep (dwMilliseconds=0xa) [0141.622] timeGetTime () returned 0x36196 [0141.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.622] Sleep (dwMilliseconds=0xa) [0141.638] timeGetTime () returned 0x361a6 [0141.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.638] Sleep (dwMilliseconds=0xa) [0141.654] timeGetTime () returned 0x361b5 [0141.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.654] Sleep (dwMilliseconds=0xa) [0141.669] timeGetTime () returned 0x361c5 [0141.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.670] Sleep (dwMilliseconds=0xa) [0141.685] timeGetTime () returned 0x361d5 [0141.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.685] Sleep (dwMilliseconds=0xa) [0141.701] timeGetTime () returned 0x361e4 [0141.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.701] Sleep (dwMilliseconds=0xa) [0141.716] timeGetTime () returned 0x361f4 [0141.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.716] Sleep (dwMilliseconds=0xa) [0141.732] timeGetTime () returned 0x36203 [0141.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.732] Sleep (dwMilliseconds=0xa) [0141.747] timeGetTime () returned 0x36213 [0141.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.747] Sleep (dwMilliseconds=0xa) [0141.763] timeGetTime () returned 0x36223 [0141.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.763] Sleep (dwMilliseconds=0xa) [0141.779] timeGetTime () returned 0x36232 [0141.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.779] Sleep (dwMilliseconds=0xa) [0141.795] timeGetTime () returned 0x36242 [0141.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.795] Sleep (dwMilliseconds=0xa) [0141.810] timeGetTime () returned 0x36251 [0141.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.810] Sleep (dwMilliseconds=0xa) [0141.826] timeGetTime () returned 0x36261 [0141.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0141.826] TranslateMessage (lpMsg=0x8bf798) returned 0 [0141.826] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0141.826] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0141.826] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0141.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.826] Sleep (dwMilliseconds=0xa) [0141.841] timeGetTime () returned 0x36271 [0141.841] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0141.841] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0141.842] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0141.842] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0141.842] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0141.842] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0141.842] RegCloseKey (hKey=0x240) returned 0x0 [0141.842] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0141.842] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0141.842] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0141.842] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0141.842] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0141.842] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0141.842] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0141.843] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0141.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0141.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0141.843] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0141.843] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.935] FreeLibrary (hLibModule=0x77150000) returned 1 [0141.935] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0141.935] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0141.935] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0141.935] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0141.935] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0141.935] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0141.935] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0141.935] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0141.935] timeGetTime () returned 0x362ce [0141.936] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.936] Sleep (dwMilliseconds=0xa) [0141.982] timeGetTime () returned 0x362fd [0141.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0141.982] Sleep (dwMilliseconds=0xa) [0142.029] timeGetTime () returned 0x3632c [0142.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.029] Sleep (dwMilliseconds=0xa) [0142.076] timeGetTime () returned 0x3635b [0142.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.076] Sleep (dwMilliseconds=0xa) [0142.122] timeGetTime () returned 0x3638a [0142.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.122] Sleep (dwMilliseconds=0xa) [0142.167] timeGetTime () returned 0x363a9 [0142.167] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.167] Sleep (dwMilliseconds=0xa) [0142.186] timeGetTime () returned 0x363c8 [0142.186] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.186] Sleep (dwMilliseconds=0xa) [0142.201] timeGetTime () returned 0x363d8 [0142.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.201] Sleep (dwMilliseconds=0xa) [0142.224] timeGetTime () returned 0x363e8 [0142.224] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.224] Sleep (dwMilliseconds=0xa) [0142.259] timeGetTime () returned 0x36407 [0142.260] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.260] Sleep (dwMilliseconds=0xa) [0142.279] timeGetTime () returned 0x36426 [0142.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.279] Sleep (dwMilliseconds=0xa) [0142.294] timeGetTime () returned 0x36436 [0142.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.294] Sleep (dwMilliseconds=0xa) [0142.310] timeGetTime () returned 0x36445 [0142.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.310] Sleep (dwMilliseconds=0xa) [0142.325] timeGetTime () returned 0x36455 [0142.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.326] Sleep (dwMilliseconds=0xa) [0142.341] timeGetTime () returned 0x36465 [0142.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.342] Sleep (dwMilliseconds=0xa) [0142.357] timeGetTime () returned 0x36474 [0142.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.357] Sleep (dwMilliseconds=0xa) [0142.373] timeGetTime () returned 0x36484 [0142.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.373] Sleep (dwMilliseconds=0xa) [0142.388] timeGetTime () returned 0x36494 [0142.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.388] Sleep (dwMilliseconds=0xa) [0142.404] timeGetTime () returned 0x364a3 [0142.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.404] Sleep (dwMilliseconds=0xa) [0142.419] timeGetTime () returned 0x364b3 [0142.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.419] Sleep (dwMilliseconds=0xa) [0142.436] timeGetTime () returned 0x364c2 [0142.436] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.436] Sleep (dwMilliseconds=0xa) [0142.499] timeGetTime () returned 0x36501 [0142.499] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.499] Sleep (dwMilliseconds=0xa) [0142.524] timeGetTime () returned 0x36511 [0142.525] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.525] Sleep (dwMilliseconds=0xa) [0142.544] timeGetTime () returned 0x36530 [0142.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.544] Sleep (dwMilliseconds=0xa) [0142.560] timeGetTime () returned 0x3653f [0142.561] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.561] Sleep (dwMilliseconds=0xa) [0142.575] timeGetTime () returned 0x3654f [0142.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0142.576] TranslateMessage (lpMsg=0x8bf798) returned 0 [0142.576] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0142.576] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0142.576] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0142.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.576] Sleep (dwMilliseconds=0xa) [0142.591] timeGetTime () returned 0x3655f [0142.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.591] Sleep (dwMilliseconds=0xa) [0142.607] timeGetTime () returned 0x3656e [0142.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.607] Sleep (dwMilliseconds=0xa) [0142.623] timeGetTime () returned 0x3657e [0142.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.623] Sleep (dwMilliseconds=0xa) [0142.638] timeGetTime () returned 0x3658e [0142.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.638] Sleep (dwMilliseconds=0xa) [0142.654] timeGetTime () returned 0x3659d [0142.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.654] Sleep (dwMilliseconds=0xa) [0142.669] timeGetTime () returned 0x365ad [0142.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.669] Sleep (dwMilliseconds=0xa) [0142.686] timeGetTime () returned 0x365bc [0142.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.686] Sleep (dwMilliseconds=0xa) [0142.700] timeGetTime () returned 0x365cc [0142.700] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.701] Sleep (dwMilliseconds=0xa) [0142.717] timeGetTime () returned 0x365dc [0142.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.717] Sleep (dwMilliseconds=0xa) [0142.732] timeGetTime () returned 0x365eb [0142.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.732] Sleep (dwMilliseconds=0xa) [0142.747] timeGetTime () returned 0x365fb [0142.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.748] Sleep (dwMilliseconds=0xa) [0142.763] timeGetTime () returned 0x3660b [0142.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.763] Sleep (dwMilliseconds=0xa) [0142.779] timeGetTime () returned 0x3661a [0142.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.779] Sleep (dwMilliseconds=0xa) [0142.794] timeGetTime () returned 0x3662a [0142.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.794] Sleep (dwMilliseconds=0xa) [0142.810] timeGetTime () returned 0x36639 [0142.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.810] Sleep (dwMilliseconds=0xa) [0142.825] timeGetTime () returned 0x36649 [0142.825] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.826] Sleep (dwMilliseconds=0xa) [0142.841] timeGetTime () returned 0x36659 [0142.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.841] Sleep (dwMilliseconds=0xa) [0142.857] timeGetTime () returned 0x36668 [0142.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.857] Sleep (dwMilliseconds=0xa) [0142.872] timeGetTime () returned 0x36678 [0142.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.873] Sleep (dwMilliseconds=0xa) [0142.888] timeGetTime () returned 0x36688 [0142.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.888] Sleep (dwMilliseconds=0xa) [0142.904] timeGetTime () returned 0x36697 [0142.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.904] Sleep (dwMilliseconds=0xa) [0142.919] timeGetTime () returned 0x366a7 [0142.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0142.919] Sleep (dwMilliseconds=0xa) [0142.935] timeGetTime () returned 0x366b6 [0142.935] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0142.935] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0142.935] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0142.935] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0142.935] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0142.936] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0142.936] RegCloseKey (hKey=0x240) returned 0x0 [0142.936] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0142.936] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0142.936] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0142.936] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0142.936] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0142.936] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0142.936] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0142.936] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0142.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0142.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abf8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0142.936] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0142.937] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0143.029] FreeLibrary (hLibModule=0x77150000) returned 1 [0143.029] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0143.029] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0143.029] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0143.029] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0143.029] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0143.029] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0143.030] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0143.030] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0143.030] timeGetTime () returned 0x36714 [0143.030] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.030] Sleep (dwMilliseconds=0xa) [0143.077] timeGetTime () returned 0x36744 [0143.077] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.077] Sleep (dwMilliseconds=0xa) [0143.123] timeGetTime () returned 0x36772 [0143.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.123] Sleep (dwMilliseconds=0xa) [0143.157] timeGetTime () returned 0x36791 [0143.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.157] Sleep (dwMilliseconds=0xa) [0143.201] timeGetTime () returned 0x367c0 [0143.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.201] Sleep (dwMilliseconds=0xa) [0143.244] timeGetTime () returned 0x367df [0143.244] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.244] Sleep (dwMilliseconds=0xa) [0143.273] timeGetTime () returned 0x367ff [0143.273] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.273] Sleep (dwMilliseconds=0xa) [0143.294] timeGetTime () returned 0x3681e [0143.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.294] Sleep (dwMilliseconds=0xa) [0143.310] timeGetTime () returned 0x3682d [0143.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.310] Sleep (dwMilliseconds=0xa) [0143.326] timeGetTime () returned 0x3683d [0143.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0143.326] TranslateMessage (lpMsg=0x8bf798) returned 0 [0143.326] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0143.326] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0143.326] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0143.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.326] Sleep (dwMilliseconds=0xa) [0143.341] timeGetTime () returned 0x3684d [0143.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.341] Sleep (dwMilliseconds=0xa) [0143.357] timeGetTime () returned 0x3685c [0143.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.357] Sleep (dwMilliseconds=0xa) [0143.372] timeGetTime () returned 0x3686c [0143.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.373] Sleep (dwMilliseconds=0xa) [0143.388] timeGetTime () returned 0x3687c [0143.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.388] Sleep (dwMilliseconds=0xa) [0143.410] timeGetTime () returned 0x3688b [0143.410] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.410] Sleep (dwMilliseconds=0xa) [0143.435] timeGetTime () returned 0x368aa [0143.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.435] Sleep (dwMilliseconds=0xa) [0143.470] timeGetTime () returned 0x368ca [0143.470] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.470] Sleep (dwMilliseconds=0xa) [0143.483] timeGetTime () returned 0x368d9 [0143.483] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.483] Sleep (dwMilliseconds=0xa) [0143.497] timeGetTime () returned 0x368e9 [0143.497] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.497] Sleep (dwMilliseconds=0xa) [0143.521] timeGetTime () returned 0x368f9 [0143.521] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.521] Sleep (dwMilliseconds=0xa) [0143.544] timeGetTime () returned 0x36918 [0143.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.544] Sleep (dwMilliseconds=0xa) [0143.560] timeGetTime () returned 0x36927 [0143.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.560] Sleep (dwMilliseconds=0xa) [0143.575] timeGetTime () returned 0x36937 [0143.575] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.575] Sleep (dwMilliseconds=0xa) [0143.591] timeGetTime () returned 0x36947 [0143.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.591] Sleep (dwMilliseconds=0xa) [0143.607] timeGetTime () returned 0x36956 [0143.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.607] Sleep (dwMilliseconds=0xa) [0143.622] timeGetTime () returned 0x36966 [0143.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.622] Sleep (dwMilliseconds=0xa) [0143.638] timeGetTime () returned 0x36976 [0143.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.638] Sleep (dwMilliseconds=0xa) [0143.654] timeGetTime () returned 0x36985 [0143.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.654] Sleep (dwMilliseconds=0xa) [0143.669] timeGetTime () returned 0x36995 [0143.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.669] Sleep (dwMilliseconds=0xa) [0143.686] timeGetTime () returned 0x369a4 [0143.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.686] Sleep (dwMilliseconds=0xa) [0143.700] timeGetTime () returned 0x369b4 [0143.700] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.701] Sleep (dwMilliseconds=0xa) [0143.717] timeGetTime () returned 0x369c4 [0143.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.717] Sleep (dwMilliseconds=0xa) [0143.732] timeGetTime () returned 0x369d3 [0143.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.732] Sleep (dwMilliseconds=0xa) [0143.747] timeGetTime () returned 0x369e3 [0143.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.747] Sleep (dwMilliseconds=0xa) [0143.763] timeGetTime () returned 0x369f3 [0143.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.763] Sleep (dwMilliseconds=0xa) [0143.779] timeGetTime () returned 0x36a02 [0143.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.779] Sleep (dwMilliseconds=0xa) [0143.795] timeGetTime () returned 0x36a12 [0143.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.795] Sleep (dwMilliseconds=0xa) [0143.811] timeGetTime () returned 0x36a21 [0143.811] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.811] Sleep (dwMilliseconds=0xa) [0143.825] timeGetTime () returned 0x36a31 [0143.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.826] Sleep (dwMilliseconds=0xa) [0143.841] timeGetTime () returned 0x36a41 [0143.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.841] Sleep (dwMilliseconds=0xa) [0143.857] timeGetTime () returned 0x36a50 [0143.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.857] Sleep (dwMilliseconds=0xa) [0143.872] timeGetTime () returned 0x36a60 [0143.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.872] Sleep (dwMilliseconds=0xa) [0143.888] timeGetTime () returned 0x36a70 [0143.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.888] Sleep (dwMilliseconds=0xa) [0143.904] timeGetTime () returned 0x36a7f [0143.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.905] Sleep (dwMilliseconds=0xa) [0143.919] timeGetTime () returned 0x36a8f [0143.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.919] Sleep (dwMilliseconds=0xa) [0143.936] timeGetTime () returned 0x36a9f [0143.936] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.936] Sleep (dwMilliseconds=0xa) [0143.950] timeGetTime () returned 0x36aae [0143.950] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.950] Sleep (dwMilliseconds=0xa) [0143.967] timeGetTime () returned 0x36abe [0143.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.967] Sleep (dwMilliseconds=0xa) [0143.982] timeGetTime () returned 0x36acd [0143.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.982] Sleep (dwMilliseconds=0xa) [0143.997] timeGetTime () returned 0x36add [0143.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0143.997] Sleep (dwMilliseconds=0xa) [0144.013] timeGetTime () returned 0x36aed [0144.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.013] Sleep (dwMilliseconds=0xa) [0144.029] timeGetTime () returned 0x36afc [0144.029] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0144.029] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0144.029] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0144.029] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0144.029] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0144.029] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0144.030] RegCloseKey (hKey=0x240) returned 0x0 [0144.030] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0144.030] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0144.030] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0144.030] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0144.030] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0144.030] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0144.030] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0144.030] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0144.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0144.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aad8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0144.031] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0144.031] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0144.123] FreeLibrary (hLibModule=0x77150000) returned 1 [0144.123] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0144.123] TranslateMessage (lpMsg=0x8bf708) returned 0 [0144.123] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0144.123] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0144.123] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0144.123] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0144.123] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0144.123] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0144.123] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0144.123] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0144.123] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0144.123] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0144.124] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0144.124] timeGetTime () returned 0x36b5a [0144.124] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.124] Sleep (dwMilliseconds=0xa) [0144.169] timeGetTime () returned 0x36b89 [0144.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.169] Sleep (dwMilliseconds=0xa) [0144.221] timeGetTime () returned 0x36bb8 [0144.221] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.221] Sleep (dwMilliseconds=0xa) [0144.263] timeGetTime () returned 0x36be7 [0144.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.263] Sleep (dwMilliseconds=0xa) [0144.310] timeGetTime () returned 0x36c15 [0144.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.310] Sleep (dwMilliseconds=0xa) [0144.357] timeGetTime () returned 0x36c44 [0144.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.357] Sleep (dwMilliseconds=0xa) [0144.393] timeGetTime () returned 0x36c64 [0144.393] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.393] Sleep (dwMilliseconds=0xa) [0144.404] timeGetTime () returned 0x36c73 [0144.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.404] Sleep (dwMilliseconds=0xa) [0144.419] timeGetTime () returned 0x36c83 [0144.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.419] Sleep (dwMilliseconds=0xa) [0144.443] timeGetTime () returned 0x36c92 [0144.443] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.443] Sleep (dwMilliseconds=0xa) [0144.501] timeGetTime () returned 0x36cd1 [0144.501] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.501] Sleep (dwMilliseconds=0xa) [0144.521] timeGetTime () returned 0x36ce1 [0144.521] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.521] Sleep (dwMilliseconds=0xa) [0144.544] timeGetTime () returned 0x36d00 [0144.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.544] Sleep (dwMilliseconds=0xa) [0144.560] timeGetTime () returned 0x36d0f [0144.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.560] Sleep (dwMilliseconds=0xa) [0144.575] timeGetTime () returned 0x36d1f [0144.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.576] Sleep (dwMilliseconds=0xa) [0144.591] timeGetTime () returned 0x36d2f [0144.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.591] Sleep (dwMilliseconds=0xa) [0144.607] timeGetTime () returned 0x36d3e [0144.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.607] Sleep (dwMilliseconds=0xa) [0144.623] timeGetTime () returned 0x36d4e [0144.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.623] Sleep (dwMilliseconds=0xa) [0144.638] timeGetTime () returned 0x36d5e [0144.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.638] Sleep (dwMilliseconds=0xa) [0144.654] timeGetTime () returned 0x36d6d [0144.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.654] Sleep (dwMilliseconds=0xa) [0144.670] timeGetTime () returned 0x36d7e [0144.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.671] Sleep (dwMilliseconds=0xa) [0144.686] timeGetTime () returned 0x36d8c [0144.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.686] Sleep (dwMilliseconds=0xa) [0144.701] timeGetTime () returned 0x36d9c [0144.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.701] Sleep (dwMilliseconds=0xa) [0144.716] timeGetTime () returned 0x36dac [0144.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.716] Sleep (dwMilliseconds=0xa) [0144.732] timeGetTime () returned 0x36dbb [0144.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.732] Sleep (dwMilliseconds=0xa) [0144.748] timeGetTime () returned 0x36dcb [0144.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.748] Sleep (dwMilliseconds=0xa) [0144.763] timeGetTime () returned 0x36ddb [0144.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.763] Sleep (dwMilliseconds=0xa) [0144.779] timeGetTime () returned 0x36dea [0144.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.779] Sleep (dwMilliseconds=0xa) [0144.794] timeGetTime () returned 0x36dfa [0144.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.794] Sleep (dwMilliseconds=0xa) [0144.811] timeGetTime () returned 0x36e09 [0144.811] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.811] Sleep (dwMilliseconds=0xa) [0144.826] timeGetTime () returned 0x36e19 [0144.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.826] Sleep (dwMilliseconds=0xa) [0144.841] timeGetTime () returned 0x36e29 [0144.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.841] Sleep (dwMilliseconds=0xa) [0144.857] timeGetTime () returned 0x36e38 [0144.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.857] Sleep (dwMilliseconds=0xa) [0144.874] timeGetTime () returned 0x36e48 [0144.874] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.874] Sleep (dwMilliseconds=0xa) [0144.888] timeGetTime () returned 0x36e58 [0144.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0144.888] TranslateMessage (lpMsg=0x8bf798) returned 0 [0144.888] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0144.888] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0144.888] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0144.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.888] Sleep (dwMilliseconds=0xa) [0144.904] timeGetTime () returned 0x36e67 [0144.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.904] Sleep (dwMilliseconds=0xa) [0144.919] timeGetTime () returned 0x36e77 [0144.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.919] Sleep (dwMilliseconds=0xa) [0144.935] timeGetTime () returned 0x36e86 [0144.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.935] Sleep (dwMilliseconds=0xa) [0144.951] timeGetTime () returned 0x36e96 [0144.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.951] Sleep (dwMilliseconds=0xa) [0144.966] timeGetTime () returned 0x36ea6 [0144.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.966] Sleep (dwMilliseconds=0xa) [0144.982] timeGetTime () returned 0x36eb5 [0144.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.982] Sleep (dwMilliseconds=0xa) [0144.998] timeGetTime () returned 0x36ec5 [0144.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0144.998] Sleep (dwMilliseconds=0xa) [0145.013] timeGetTime () returned 0x36ed5 [0145.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.013] Sleep (dwMilliseconds=0xa) [0145.029] timeGetTime () returned 0x36ee4 [0145.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.029] Sleep (dwMilliseconds=0xa) [0145.044] timeGetTime () returned 0x36ef4 [0145.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.044] Sleep (dwMilliseconds=0xa) [0145.060] timeGetTime () returned 0x36f03 [0145.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.060] Sleep (dwMilliseconds=0xa) [0145.077] timeGetTime () returned 0x36f14 [0145.077] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.077] Sleep (dwMilliseconds=0xa) [0145.091] timeGetTime () returned 0x36f23 [0145.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.091] Sleep (dwMilliseconds=0xa) [0145.107] timeGetTime () returned 0x36f32 [0145.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.107] Sleep (dwMilliseconds=0xa) [0145.123] timeGetTime () returned 0x36f42 [0145.123] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0145.123] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0145.123] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0145.123] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0145.123] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0145.123] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0145.123] RegCloseKey (hKey=0x240) returned 0x0 [0145.123] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0145.123] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0145.123] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0145.123] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0145.124] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0145.124] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0145.124] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0145.124] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0145.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0145.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aad8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0145.124] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0145.124] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0145.233] FreeLibrary (hLibModule=0x77150000) returned 1 [0145.234] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0145.234] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0145.234] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0145.234] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0145.234] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0145.234] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0145.234] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0145.234] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0145.234] timeGetTime () returned 0x36fb1 [0145.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.234] Sleep (dwMilliseconds=0xa) [0145.279] timeGetTime () returned 0x36fde [0145.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.279] Sleep (dwMilliseconds=0xa) [0145.326] timeGetTime () returned 0x3700d [0145.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.326] Sleep (dwMilliseconds=0xa) [0145.372] timeGetTime () returned 0x3703c [0145.372] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.372] Sleep (dwMilliseconds=0xa) [0145.419] timeGetTime () returned 0x3706b [0145.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.419] Sleep (dwMilliseconds=0xa) [0145.438] timeGetTime () returned 0x3707a [0145.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.438] Sleep (dwMilliseconds=0xa) [0145.490] timeGetTime () returned 0x370a9 [0145.490] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.490] Sleep (dwMilliseconds=0xa) [0145.561] timeGetTime () returned 0x370f7 [0145.561] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.562] Sleep (dwMilliseconds=0xa) [0145.585] timeGetTime () returned 0x37107 [0145.585] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.585] Sleep (dwMilliseconds=0xa) [0145.612] timeGetTime () returned 0x37126 [0145.612] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.612] Sleep (dwMilliseconds=0xa) [0145.630] timeGetTime () returned 0x37136 [0145.630] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.630] Sleep (dwMilliseconds=0xa) [0145.665] timeGetTime () returned 0x37155 [0145.665] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0145.665] TranslateMessage (lpMsg=0x8bf798) returned 0 [0145.665] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0145.665] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0145.665] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0145.665] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.665] Sleep (dwMilliseconds=0xa) [0145.689] timeGetTime () returned 0x37174 [0145.689] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.689] Sleep (dwMilliseconds=0xa) [0145.701] timeGetTime () returned 0x37184 [0145.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.701] Sleep (dwMilliseconds=0xa) [0145.717] timeGetTime () returned 0x37194 [0145.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.717] Sleep (dwMilliseconds=0xa) [0145.732] timeGetTime () returned 0x371a3 [0145.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.732] Sleep (dwMilliseconds=0xa) [0145.748] timeGetTime () returned 0x371b3 [0145.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.748] Sleep (dwMilliseconds=0xa) [0145.763] timeGetTime () returned 0x371c3 [0145.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.763] Sleep (dwMilliseconds=0xa) [0145.779] timeGetTime () returned 0x371d2 [0145.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.779] Sleep (dwMilliseconds=0xa) [0145.794] timeGetTime () returned 0x371e2 [0145.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.794] Sleep (dwMilliseconds=0xa) [0145.810] timeGetTime () returned 0x371f1 [0145.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.810] Sleep (dwMilliseconds=0xa) [0145.826] timeGetTime () returned 0x37201 [0145.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.826] Sleep (dwMilliseconds=0xa) [0145.841] timeGetTime () returned 0x37211 [0145.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.841] Sleep (dwMilliseconds=0xa) [0145.857] timeGetTime () returned 0x37220 [0145.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.857] Sleep (dwMilliseconds=0xa) [0145.872] timeGetTime () returned 0x37230 [0145.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.873] Sleep (dwMilliseconds=0xa) [0145.888] timeGetTime () returned 0x37240 [0145.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.888] Sleep (dwMilliseconds=0xa) [0145.904] timeGetTime () returned 0x3724f [0145.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.904] Sleep (dwMilliseconds=0xa) [0145.919] timeGetTime () returned 0x3725f [0145.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.919] Sleep (dwMilliseconds=0xa) [0145.935] timeGetTime () returned 0x3726f [0145.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.935] Sleep (dwMilliseconds=0xa) [0145.951] timeGetTime () returned 0x3727e [0145.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.951] Sleep (dwMilliseconds=0xa) [0145.966] timeGetTime () returned 0x3728e [0145.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.966] Sleep (dwMilliseconds=0xa) [0145.982] timeGetTime () returned 0x3729d [0145.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.982] Sleep (dwMilliseconds=0xa) [0145.998] timeGetTime () returned 0x372ad [0145.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0145.998] Sleep (dwMilliseconds=0xa) [0146.013] timeGetTime () returned 0x372bd [0146.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.013] Sleep (dwMilliseconds=0xa) [0146.029] timeGetTime () returned 0x372cc [0146.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.029] Sleep (dwMilliseconds=0xa) [0146.046] timeGetTime () returned 0x372dd [0146.046] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.046] Sleep (dwMilliseconds=0xa) [0146.060] timeGetTime () returned 0x372eb [0146.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.060] Sleep (dwMilliseconds=0xa) [0146.075] timeGetTime () returned 0x372fb [0146.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.076] Sleep (dwMilliseconds=0xa) [0146.091] timeGetTime () returned 0x3730b [0146.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.091] Sleep (dwMilliseconds=0xa) [0146.107] timeGetTime () returned 0x3731a [0146.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.107] Sleep (dwMilliseconds=0xa) [0146.122] timeGetTime () returned 0x3732a [0146.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.123] Sleep (dwMilliseconds=0xa) [0146.139] timeGetTime () returned 0x3733a [0146.139] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.139] Sleep (dwMilliseconds=0xa) [0146.154] timeGetTime () returned 0x37349 [0146.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.154] Sleep (dwMilliseconds=0xa) [0146.169] timeGetTime () returned 0x37359 [0146.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.169] Sleep (dwMilliseconds=0xa) [0146.185] timeGetTime () returned 0x37368 [0146.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.185] Sleep (dwMilliseconds=0xa) [0146.200] timeGetTime () returned 0x37378 [0146.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.201] Sleep (dwMilliseconds=0xa) [0146.216] timeGetTime () returned 0x37388 [0146.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.216] Sleep (dwMilliseconds=0xa) [0146.232] timeGetTime () returned 0x37397 [0146.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.232] Sleep (dwMilliseconds=0xa) [0146.247] timeGetTime () returned 0x373a7 [0146.248] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0146.248] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0146.248] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0146.248] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0146.248] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0146.248] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0146.248] RegCloseKey (hKey=0x240) returned 0x0 [0146.248] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0146.248] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0146.248] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0146.248] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0146.248] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0146.248] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0146.248] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0146.248] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0146.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0146.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0146.249] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0146.249] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0146.357] FreeLibrary (hLibModule=0x77150000) returned 1 [0146.357] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0146.357] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0146.357] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0146.357] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0146.357] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0146.357] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0146.357] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0146.357] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0146.357] timeGetTime () returned 0x37414 [0146.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.357] Sleep (dwMilliseconds=0xa) [0146.404] timeGetTime () returned 0x37443 [0146.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.404] Sleep (dwMilliseconds=0xa) [0146.490] timeGetTime () returned 0x37493 [0146.490] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0146.490] TranslateMessage (lpMsg=0x8bf798) returned 0 [0146.491] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0146.491] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0146.491] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0146.491] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.491] Sleep (dwMilliseconds=0xa) [0146.545] timeGetTime () returned 0x374d0 [0146.545] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.545] Sleep (dwMilliseconds=0xa) [0146.593] timeGetTime () returned 0x374ff [0146.593] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.593] Sleep (dwMilliseconds=0xa) [0146.638] timeGetTime () returned 0x3752e [0146.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.638] Sleep (dwMilliseconds=0xa) [0146.653] timeGetTime () returned 0x3753d [0146.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.654] Sleep (dwMilliseconds=0xa) [0146.669] timeGetTime () returned 0x3754d [0146.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.670] Sleep (dwMilliseconds=0xa) [0146.686] timeGetTime () returned 0x3755c [0146.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.686] Sleep (dwMilliseconds=0xa) [0146.709] timeGetTime () returned 0x3756c [0146.709] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.709] Sleep (dwMilliseconds=0xa) [0146.732] timeGetTime () returned 0x3758b [0146.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.732] Sleep (dwMilliseconds=0xa) [0146.747] timeGetTime () returned 0x3759b [0146.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.747] Sleep (dwMilliseconds=0xa) [0146.763] timeGetTime () returned 0x375ab [0146.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.763] Sleep (dwMilliseconds=0xa) [0146.779] timeGetTime () returned 0x375ba [0146.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.779] Sleep (dwMilliseconds=0xa) [0146.794] timeGetTime () returned 0x375ca [0146.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.794] Sleep (dwMilliseconds=0xa) [0146.810] timeGetTime () returned 0x375d9 [0146.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.810] Sleep (dwMilliseconds=0xa) [0146.826] timeGetTime () returned 0x375e9 [0146.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.826] Sleep (dwMilliseconds=0xa) [0146.841] timeGetTime () returned 0x375f9 [0146.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.841] Sleep (dwMilliseconds=0xa) [0146.857] timeGetTime () returned 0x37608 [0146.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.857] Sleep (dwMilliseconds=0xa) [0146.872] timeGetTime () returned 0x37618 [0146.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.872] Sleep (dwMilliseconds=0xa) [0146.889] timeGetTime () returned 0x37628 [0146.889] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.889] Sleep (dwMilliseconds=0xa) [0146.904] timeGetTime () returned 0x37637 [0146.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.904] Sleep (dwMilliseconds=0xa) [0146.919] timeGetTime () returned 0x37647 [0146.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.919] Sleep (dwMilliseconds=0xa) [0146.935] timeGetTime () returned 0x37656 [0146.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.935] Sleep (dwMilliseconds=0xa) [0146.951] timeGetTime () returned 0x37666 [0146.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.951] Sleep (dwMilliseconds=0xa) [0146.966] timeGetTime () returned 0x37676 [0146.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.966] Sleep (dwMilliseconds=0xa) [0146.982] timeGetTime () returned 0x37685 [0146.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.982] Sleep (dwMilliseconds=0xa) [0146.997] timeGetTime () returned 0x37695 [0146.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0146.997] Sleep (dwMilliseconds=0xa) [0147.013] timeGetTime () returned 0x376a5 [0147.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.013] Sleep (dwMilliseconds=0xa) [0147.029] timeGetTime () returned 0x376b4 [0147.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.029] Sleep (dwMilliseconds=0xa) [0147.044] timeGetTime () returned 0x376c4 [0147.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.044] Sleep (dwMilliseconds=0xa) [0147.060] timeGetTime () returned 0x376d3 [0147.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.060] Sleep (dwMilliseconds=0xa) [0147.077] timeGetTime () returned 0x376e3 [0147.077] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.077] Sleep (dwMilliseconds=0xa) [0147.092] timeGetTime () returned 0x376f3 [0147.092] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.092] Sleep (dwMilliseconds=0xa) [0147.107] timeGetTime () returned 0x37702 [0147.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.107] Sleep (dwMilliseconds=0xa) [0147.122] timeGetTime () returned 0x37712 [0147.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.122] Sleep (dwMilliseconds=0xa) [0147.138] timeGetTime () returned 0x37722 [0147.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.138] Sleep (dwMilliseconds=0xa) [0147.154] timeGetTime () returned 0x37731 [0147.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.154] Sleep (dwMilliseconds=0xa) [0147.169] timeGetTime () returned 0x37741 [0147.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.169] Sleep (dwMilliseconds=0xa) [0147.185] timeGetTime () returned 0x37750 [0147.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.185] Sleep (dwMilliseconds=0xa) [0147.201] timeGetTime () returned 0x37760 [0147.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.201] Sleep (dwMilliseconds=0xa) [0147.216] timeGetTime () returned 0x37770 [0147.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.216] Sleep (dwMilliseconds=0xa) [0147.232] timeGetTime () returned 0x3777f [0147.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.232] Sleep (dwMilliseconds=0xa) [0147.247] timeGetTime () returned 0x3778f [0147.247] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0147.248] TranslateMessage (lpMsg=0x8bf798) returned 0 [0147.248] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0147.248] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0147.248] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0147.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.248] Sleep (dwMilliseconds=0xa) [0147.263] timeGetTime () returned 0x3779f [0147.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.263] Sleep (dwMilliseconds=0xa) [0147.279] timeGetTime () returned 0x377ae [0147.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.279] Sleep (dwMilliseconds=0xa) [0147.296] timeGetTime () returned 0x377c0 [0147.296] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.296] Sleep (dwMilliseconds=0xa) [0147.310] timeGetTime () returned 0x377cd [0147.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.310] Sleep (dwMilliseconds=0xa) [0147.326] timeGetTime () returned 0x377dd [0147.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.326] Sleep (dwMilliseconds=0xa) [0147.341] timeGetTime () returned 0x377ed [0147.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.341] Sleep (dwMilliseconds=0xa) [0147.357] timeGetTime () returned 0x377fc [0147.357] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0147.357] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0147.357] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0147.357] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0147.357] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0147.357] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0147.357] RegCloseKey (hKey=0x240) returned 0x0 [0147.357] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0147.357] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0147.357] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0147.358] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0147.358] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0147.358] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0147.358] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0147.358] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0147.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0147.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0147.358] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0147.358] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0147.473] FreeLibrary (hLibModule=0x77150000) returned 1 [0147.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0147.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0147.473] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0147.474] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0147.474] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0147.474] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0147.474] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0147.474] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0147.474] timeGetTime () returned 0x3786a [0147.474] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.474] Sleep (dwMilliseconds=0xa) [0147.519] timeGetTime () returned 0x37899 [0147.519] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.519] Sleep (dwMilliseconds=0xa) [0147.561] timeGetTime () returned 0x378c7 [0147.561] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.561] Sleep (dwMilliseconds=0xa) [0147.607] timeGetTime () returned 0x378f6 [0147.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.607] Sleep (dwMilliseconds=0xa) [0147.653] timeGetTime () returned 0x37925 [0147.653] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.653] Sleep (dwMilliseconds=0xa) [0147.689] timeGetTime () returned 0x37944 [0147.689] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.689] Sleep (dwMilliseconds=0xa) [0147.701] timeGetTime () returned 0x37954 [0147.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.701] Sleep (dwMilliseconds=0xa) [0147.725] timeGetTime () returned 0x37964 [0147.725] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.725] Sleep (dwMilliseconds=0xa) [0147.748] timeGetTime () returned 0x37983 [0147.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.748] Sleep (dwMilliseconds=0xa) [0147.763] timeGetTime () returned 0x37993 [0147.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.763] Sleep (dwMilliseconds=0xa) [0147.779] timeGetTime () returned 0x379a2 [0147.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.779] Sleep (dwMilliseconds=0xa) [0147.795] timeGetTime () returned 0x379b2 [0147.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.795] Sleep (dwMilliseconds=0xa) [0147.811] timeGetTime () returned 0x379c1 [0147.811] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.811] Sleep (dwMilliseconds=0xa) [0147.826] timeGetTime () returned 0x379d1 [0147.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.826] Sleep (dwMilliseconds=0xa) [0147.841] timeGetTime () returned 0x379e1 [0147.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.841] Sleep (dwMilliseconds=0xa) [0147.857] timeGetTime () returned 0x379f0 [0147.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.857] Sleep (dwMilliseconds=0xa) [0147.873] timeGetTime () returned 0x37a00 [0147.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.873] Sleep (dwMilliseconds=0xa) [0147.888] timeGetTime () returned 0x37a10 [0147.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.888] Sleep (dwMilliseconds=0xa) [0147.905] timeGetTime () returned 0x37a1f [0147.905] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.906] Sleep (dwMilliseconds=0xa) [0147.919] timeGetTime () returned 0x37a2f [0147.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.919] Sleep (dwMilliseconds=0xa) [0147.935] timeGetTime () returned 0x37a3e [0147.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.935] Sleep (dwMilliseconds=0xa) [0147.951] timeGetTime () returned 0x37a4e [0147.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.951] Sleep (dwMilliseconds=0xa) [0147.966] timeGetTime () returned 0x37a5e [0147.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.966] Sleep (dwMilliseconds=0xa) [0147.988] timeGetTime () returned 0x37a6d [0147.988] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0147.988] Sleep (dwMilliseconds=0xa) [0148.013] timeGetTime () returned 0x37a8d [0148.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0148.013] TranslateMessage (lpMsg=0x8bf798) returned 0 [0148.013] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0148.013] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0148.013] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0148.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.013] Sleep (dwMilliseconds=0xa) [0148.029] timeGetTime () returned 0x37a9c [0148.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.029] Sleep (dwMilliseconds=0xa) [0148.044] timeGetTime () returned 0x37aac [0148.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.044] Sleep (dwMilliseconds=0xa) [0148.060] timeGetTime () returned 0x37abb [0148.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.060] Sleep (dwMilliseconds=0xa) [0148.075] timeGetTime () returned 0x37acb [0148.075] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.076] Sleep (dwMilliseconds=0xa) [0148.091] timeGetTime () returned 0x37adb [0148.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.091] Sleep (dwMilliseconds=0xa) [0148.107] timeGetTime () returned 0x37aea [0148.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.107] Sleep (dwMilliseconds=0xa) [0148.123] timeGetTime () returned 0x37afa [0148.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.123] Sleep (dwMilliseconds=0xa) [0148.138] timeGetTime () returned 0x37b0a [0148.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.138] Sleep (dwMilliseconds=0xa) [0148.154] timeGetTime () returned 0x37b19 [0148.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.154] Sleep (dwMilliseconds=0xa) [0148.169] timeGetTime () returned 0x37b29 [0148.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.169] Sleep (dwMilliseconds=0xa) [0148.185] timeGetTime () returned 0x37b38 [0148.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.185] Sleep (dwMilliseconds=0xa) [0148.201] timeGetTime () returned 0x37b48 [0148.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.201] Sleep (dwMilliseconds=0xa) [0148.217] timeGetTime () returned 0x37b58 [0148.217] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.217] Sleep (dwMilliseconds=0xa) [0148.232] timeGetTime () returned 0x37b67 [0148.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.232] Sleep (dwMilliseconds=0xa) [0148.248] timeGetTime () returned 0x37b77 [0148.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.248] Sleep (dwMilliseconds=0xa) [0148.263] timeGetTime () returned 0x37b87 [0148.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.263] Sleep (dwMilliseconds=0xa) [0148.279] timeGetTime () returned 0x37b96 [0148.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.279] Sleep (dwMilliseconds=0xa) [0148.294] timeGetTime () returned 0x37ba6 [0148.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.294] Sleep (dwMilliseconds=0xa) [0148.310] timeGetTime () returned 0x37bb5 [0148.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.310] Sleep (dwMilliseconds=0xa) [0148.325] timeGetTime () returned 0x37bc5 [0148.325] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.326] Sleep (dwMilliseconds=0xa) [0148.341] timeGetTime () returned 0x37bd5 [0148.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.341] Sleep (dwMilliseconds=0xa) [0148.357] timeGetTime () returned 0x37be4 [0148.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.357] Sleep (dwMilliseconds=0xa) [0148.373] timeGetTime () returned 0x37bf4 [0148.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.373] Sleep (dwMilliseconds=0xa) [0148.388] timeGetTime () returned 0x37c04 [0148.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.388] Sleep (dwMilliseconds=0xa) [0148.404] timeGetTime () returned 0x37c13 [0148.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.404] Sleep (dwMilliseconds=0xa) [0148.419] timeGetTime () returned 0x37c23 [0148.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.419] Sleep (dwMilliseconds=0xa) [0148.436] timeGetTime () returned 0x37c33 [0148.436] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.436] Sleep (dwMilliseconds=0xa) [0148.472] timeGetTime () returned 0x37c52 [0148.473] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0148.473] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0148.473] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0148.473] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0148.473] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0148.473] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0148.473] RegCloseKey (hKey=0x240) returned 0x0 [0148.473] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0148.473] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0148.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0148.473] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0148.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0148.473] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0148.474] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0148.474] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0148.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0148.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0148.474] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0148.474] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0148.562] FreeLibrary (hLibModule=0x77150000) returned 1 [0148.562] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0148.562] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0148.562] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0148.563] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0148.563] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0148.563] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0148.563] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0148.563] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0148.563] timeGetTime () returned 0x37caf [0148.563] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.563] Sleep (dwMilliseconds=0xa) [0148.607] timeGetTime () returned 0x37cde [0148.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.607] Sleep (dwMilliseconds=0xa) [0148.654] timeGetTime () returned 0x37d0d [0148.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.654] Sleep (dwMilliseconds=0xa) [0148.702] timeGetTime () returned 0x37d3c [0148.702] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.702] Sleep (dwMilliseconds=0xa) [0148.747] timeGetTime () returned 0x37d6b [0148.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.747] Sleep (dwMilliseconds=0xa) [0148.794] timeGetTime () returned 0x37d9a [0148.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0148.794] TranslateMessage (lpMsg=0x8bf798) returned 0 [0148.794] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0148.794] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0148.795] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0148.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.795] Sleep (dwMilliseconds=0xa) [0148.813] timeGetTime () returned 0x37da9 [0148.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.813] Sleep (dwMilliseconds=0xa) [0148.825] timeGetTime () returned 0x37db9 [0148.825] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.825] Sleep (dwMilliseconds=0xa) [0148.842] timeGetTime () returned 0x37dc9 [0148.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.842] Sleep (dwMilliseconds=0xa) [0148.894] timeGetTime () returned 0x37df8 [0148.894] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.894] Sleep (dwMilliseconds=0xa) [0148.919] timeGetTime () returned 0x37e17 [0148.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.919] Sleep (dwMilliseconds=0xa) [0148.935] timeGetTime () returned 0x37e26 [0148.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.935] Sleep (dwMilliseconds=0xa) [0148.951] timeGetTime () returned 0x37e36 [0148.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.951] Sleep (dwMilliseconds=0xa) [0148.966] timeGetTime () returned 0x37e46 [0148.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.966] Sleep (dwMilliseconds=0xa) [0148.982] timeGetTime () returned 0x37e55 [0148.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.982] Sleep (dwMilliseconds=0xa) [0148.997] timeGetTime () returned 0x37e65 [0148.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0148.997] Sleep (dwMilliseconds=0xa) [0149.013] timeGetTime () returned 0x37e75 [0149.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.013] Sleep (dwMilliseconds=0xa) [0149.029] timeGetTime () returned 0x37e84 [0149.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.029] Sleep (dwMilliseconds=0xa) [0149.044] timeGetTime () returned 0x37e94 [0149.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.044] Sleep (dwMilliseconds=0xa) [0149.060] timeGetTime () returned 0x37ea3 [0149.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.060] Sleep (dwMilliseconds=0xa) [0149.076] timeGetTime () returned 0x37eb3 [0149.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.076] Sleep (dwMilliseconds=0xa) [0149.092] timeGetTime () returned 0x37ec3 [0149.092] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.092] Sleep (dwMilliseconds=0xa) [0149.107] timeGetTime () returned 0x37ed2 [0149.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.107] Sleep (dwMilliseconds=0xa) [0149.122] timeGetTime () returned 0x37ee2 [0149.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.122] Sleep (dwMilliseconds=0xa) [0149.138] timeGetTime () returned 0x37ef2 [0149.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.138] Sleep (dwMilliseconds=0xa) [0149.154] timeGetTime () returned 0x37f01 [0149.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.154] Sleep (dwMilliseconds=0xa) [0149.169] timeGetTime () returned 0x37f11 [0149.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.170] Sleep (dwMilliseconds=0xa) [0149.255] timeGetTime () returned 0x37f5f [0149.255] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.255] Sleep (dwMilliseconds=0xa) [0149.279] timeGetTime () returned 0x37f7e [0149.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.279] Sleep (dwMilliseconds=0xa) [0149.294] timeGetTime () returned 0x37f8e [0149.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.294] Sleep (dwMilliseconds=0xa) [0149.316] timeGetTime () returned 0x37f9d [0149.316] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.316] Sleep (dwMilliseconds=0xa) [0149.341] timeGetTime () returned 0x37fbd [0149.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.341] Sleep (dwMilliseconds=0xa) [0149.357] timeGetTime () returned 0x37fcc [0149.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.357] Sleep (dwMilliseconds=0xa) [0149.374] timeGetTime () returned 0x37fdc [0149.374] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.374] Sleep (dwMilliseconds=0xa) [0149.388] timeGetTime () returned 0x37fec [0149.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.388] Sleep (dwMilliseconds=0xa) [0149.404] timeGetTime () returned 0x37ffb [0149.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.404] Sleep (dwMilliseconds=0xa) [0149.419] timeGetTime () returned 0x3800b [0149.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.419] Sleep (dwMilliseconds=0xa) [0149.435] timeGetTime () returned 0x3801a [0149.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.435] Sleep (dwMilliseconds=0xa) [0149.451] timeGetTime () returned 0x3802a [0149.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.451] Sleep (dwMilliseconds=0xa) [0149.485] timeGetTime () returned 0x38049 [0149.485] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.485] Sleep (dwMilliseconds=0xa) [0149.498] timeGetTime () returned 0x38059 [0149.499] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.499] Sleep (dwMilliseconds=0xa) [0149.519] timeGetTime () returned 0x38069 [0149.519] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.519] Sleep (dwMilliseconds=0xa) [0149.544] timeGetTime () returned 0x38088 [0149.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0149.544] TranslateMessage (lpMsg=0x8bf798) returned 0 [0149.544] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0149.545] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0149.545] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0149.545] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.545] Sleep (dwMilliseconds=0xa) [0149.560] timeGetTime () returned 0x38098 [0149.560] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0149.560] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0149.560] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0149.560] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0149.560] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0149.561] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0149.561] RegCloseKey (hKey=0x240) returned 0x0 [0149.561] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0149.561] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0149.561] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0149.561] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0149.561] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0149.561] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0149.561] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0149.561] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0149.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0149.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0149.562] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0149.562] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0149.654] FreeLibrary (hLibModule=0x77150000) returned 1 [0149.654] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0149.654] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0149.654] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0149.654] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0149.654] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0149.654] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0149.654] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0149.654] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0149.654] timeGetTime () returned 0x380f5 [0149.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.654] Sleep (dwMilliseconds=0xa) [0149.700] timeGetTime () returned 0x38124 [0149.700] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.700] Sleep (dwMilliseconds=0xa) [0149.747] timeGetTime () returned 0x38153 [0149.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.748] Sleep (dwMilliseconds=0xa) [0149.794] timeGetTime () returned 0x38182 [0149.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.794] Sleep (dwMilliseconds=0xa) [0149.841] timeGetTime () returned 0x381b1 [0149.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.841] Sleep (dwMilliseconds=0xa) [0149.885] timeGetTime () returned 0x381d0 [0149.885] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.885] Sleep (dwMilliseconds=0xa) [0149.912] timeGetTime () returned 0x381ef [0149.912] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.912] Sleep (dwMilliseconds=0xa) [0149.944] timeGetTime () returned 0x3820e [0149.944] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.944] Sleep (dwMilliseconds=0xa) [0149.966] timeGetTime () returned 0x3822e [0149.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.966] Sleep (dwMilliseconds=0xa) [0149.982] timeGetTime () returned 0x3823d [0149.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.982] Sleep (dwMilliseconds=0xa) [0149.997] timeGetTime () returned 0x3824d [0149.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0149.998] Sleep (dwMilliseconds=0xa) [0150.013] timeGetTime () returned 0x3825d [0150.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.013] Sleep (dwMilliseconds=0xa) [0150.029] timeGetTime () returned 0x3826c [0150.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.029] Sleep (dwMilliseconds=0xa) [0150.053] timeGetTime () returned 0x3827c [0150.055] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.055] Sleep (dwMilliseconds=0xa) [0150.076] timeGetTime () returned 0x3829b [0150.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.076] Sleep (dwMilliseconds=0xa) [0150.091] timeGetTime () returned 0x382ab [0150.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.091] Sleep (dwMilliseconds=0xa) [0150.107] timeGetTime () returned 0x382ba [0150.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.107] Sleep (dwMilliseconds=0xa) [0150.122] timeGetTime () returned 0x382ca [0150.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.122] Sleep (dwMilliseconds=0xa) [0150.138] timeGetTime () returned 0x382da [0150.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.138] Sleep (dwMilliseconds=0xa) [0150.154] timeGetTime () returned 0x382ea [0150.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.154] Sleep (dwMilliseconds=0xa) [0150.169] timeGetTime () returned 0x382f9 [0150.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.169] Sleep (dwMilliseconds=0xa) [0150.185] timeGetTime () returned 0x38308 [0150.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.185] Sleep (dwMilliseconds=0xa) [0150.201] timeGetTime () returned 0x38318 [0150.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.201] Sleep (dwMilliseconds=0xa) [0150.216] timeGetTime () returned 0x38328 [0150.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.216] Sleep (dwMilliseconds=0xa) [0150.233] timeGetTime () returned 0x38337 [0150.233] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.233] Sleep (dwMilliseconds=0xa) [0150.247] timeGetTime () returned 0x38347 [0150.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.248] Sleep (dwMilliseconds=0xa) [0150.263] timeGetTime () returned 0x38357 [0150.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.263] Sleep (dwMilliseconds=0xa) [0150.279] timeGetTime () returned 0x38366 [0150.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.279] Sleep (dwMilliseconds=0xa) [0150.295] timeGetTime () returned 0x38376 [0150.295] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.295] Sleep (dwMilliseconds=0xa) [0150.310] timeGetTime () returned 0x38385 [0150.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0150.310] TranslateMessage (lpMsg=0x8bf798) returned 0 [0150.310] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0150.310] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0150.310] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0150.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.310] Sleep (dwMilliseconds=0xa) [0150.325] timeGetTime () returned 0x38395 [0150.325] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.325] Sleep (dwMilliseconds=0xa) [0150.341] timeGetTime () returned 0x383a5 [0150.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.341] Sleep (dwMilliseconds=0xa) [0150.357] timeGetTime () returned 0x383b4 [0150.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.357] Sleep (dwMilliseconds=0xa) [0150.372] timeGetTime () returned 0x383c4 [0150.372] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.373] Sleep (dwMilliseconds=0xa) [0150.388] timeGetTime () returned 0x383d4 [0150.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.388] Sleep (dwMilliseconds=0xa) [0150.404] timeGetTime () returned 0x383e3 [0150.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.404] Sleep (dwMilliseconds=0xa) [0150.420] timeGetTime () returned 0x383f3 [0150.420] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.420] Sleep (dwMilliseconds=0xa) [0150.435] timeGetTime () returned 0x38402 [0150.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.435] Sleep (dwMilliseconds=0xa) [0150.450] timeGetTime () returned 0x38412 [0150.450] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.450] Sleep (dwMilliseconds=0xa) [0150.484] timeGetTime () returned 0x38431 [0150.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.484] Sleep (dwMilliseconds=0xa) [0150.497] timeGetTime () returned 0x38441 [0150.497] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.497] Sleep (dwMilliseconds=0xa) [0150.519] timeGetTime () returned 0x38451 [0150.519] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.519] Sleep (dwMilliseconds=0xa) [0150.545] timeGetTime () returned 0x38470 [0150.545] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.545] Sleep (dwMilliseconds=0xa) [0150.560] timeGetTime () returned 0x3847f [0150.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.560] Sleep (dwMilliseconds=0xa) [0150.576] timeGetTime () returned 0x3848f [0150.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.576] Sleep (dwMilliseconds=0xa) [0150.591] timeGetTime () returned 0x3849f [0150.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.591] Sleep (dwMilliseconds=0xa) [0150.607] timeGetTime () returned 0x384ae [0150.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.607] Sleep (dwMilliseconds=0xa) [0150.622] timeGetTime () returned 0x384be [0150.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.622] Sleep (dwMilliseconds=0xa) [0150.638] timeGetTime () returned 0x384ce [0150.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.638] Sleep (dwMilliseconds=0xa) [0150.654] timeGetTime () returned 0x384dd [0150.654] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0150.654] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0150.654] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0150.654] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0150.654] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0150.654] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0150.654] RegCloseKey (hKey=0x240) returned 0x0 [0150.654] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0150.654] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0150.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0150.655] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0150.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0150.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0150.655] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0150.655] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0150.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0150.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0150.655] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0150.655] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0150.801] FreeLibrary (hLibModule=0x77150000) returned 1 [0150.801] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0150.801] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0150.801] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0150.801] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0150.801] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0150.801] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0150.801] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0150.802] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0150.802] timeGetTime () returned 0x3856a [0150.802] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.802] Sleep (dwMilliseconds=0xa) [0150.859] timeGetTime () returned 0x385a8 [0150.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.859] Sleep (dwMilliseconds=0xa) [0150.911] timeGetTime () returned 0x385d7 [0150.911] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.911] Sleep (dwMilliseconds=0xa) [0150.953] timeGetTime () returned 0x38606 [0150.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.953] Sleep (dwMilliseconds=0xa) [0150.997] timeGetTime () returned 0x38635 [0150.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0150.997] Sleep (dwMilliseconds=0xa) [0151.039] timeGetTime () returned 0x38654 [0151.039] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.039] Sleep (dwMilliseconds=0xa) [0151.060] timeGetTime () returned 0x38673 [0151.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.060] Sleep (dwMilliseconds=0xa) [0151.083] timeGetTime () returned 0x38683 [0151.083] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0151.083] TranslateMessage (lpMsg=0x8bf798) returned 0 [0151.083] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0151.083] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0151.083] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0151.084] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.084] Sleep (dwMilliseconds=0xa) [0151.116] timeGetTime () returned 0x386a2 [0151.116] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.116] Sleep (dwMilliseconds=0xa) [0151.138] timeGetTime () returned 0x386c2 [0151.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.138] Sleep (dwMilliseconds=0xa) [0151.154] timeGetTime () returned 0x386d1 [0151.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.154] Sleep (dwMilliseconds=0xa) [0151.169] timeGetTime () returned 0x386e1 [0151.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.169] Sleep (dwMilliseconds=0xa) [0151.185] timeGetTime () returned 0x386f0 [0151.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.185] Sleep (dwMilliseconds=0xa) [0151.201] timeGetTime () returned 0x38701 [0151.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.201] Sleep (dwMilliseconds=0xa) [0151.216] timeGetTime () returned 0x38710 [0151.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.216] Sleep (dwMilliseconds=0xa) [0151.232] timeGetTime () returned 0x3871f [0151.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.232] Sleep (dwMilliseconds=0xa) [0151.248] timeGetTime () returned 0x3872f [0151.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.248] Sleep (dwMilliseconds=0xa) [0151.263] timeGetTime () returned 0x3873f [0151.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.263] Sleep (dwMilliseconds=0xa) [0151.279] timeGetTime () returned 0x3874e [0151.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.279] Sleep (dwMilliseconds=0xa) [0151.294] timeGetTime () returned 0x3875e [0151.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.294] Sleep (dwMilliseconds=0xa) [0151.310] timeGetTime () returned 0x3876d [0151.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.310] Sleep (dwMilliseconds=0xa) [0151.326] timeGetTime () returned 0x3877d [0151.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.326] Sleep (dwMilliseconds=0xa) [0151.341] timeGetTime () returned 0x3878d [0151.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.341] Sleep (dwMilliseconds=0xa) [0151.357] timeGetTime () returned 0x3879c [0151.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.357] Sleep (dwMilliseconds=0xa) [0151.373] timeGetTime () returned 0x387ac [0151.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.373] Sleep (dwMilliseconds=0xa) [0151.393] timeGetTime () returned 0x387bc [0151.393] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.393] Sleep (dwMilliseconds=0xa) [0151.403] timeGetTime () returned 0x387cb [0151.403] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.403] Sleep (dwMilliseconds=0xa) [0151.419] timeGetTime () returned 0x387db [0151.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.419] Sleep (dwMilliseconds=0xa) [0151.435] timeGetTime () returned 0x387ea [0151.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.435] Sleep (dwMilliseconds=0xa) [0151.450] timeGetTime () returned 0x387fa [0151.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.451] Sleep (dwMilliseconds=0xa) [0151.483] timeGetTime () returned 0x38819 [0151.483] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.483] Sleep (dwMilliseconds=0xa) [0151.497] timeGetTime () returned 0x38829 [0151.497] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.497] Sleep (dwMilliseconds=0xa) [0151.518] timeGetTime () returned 0x38839 [0151.519] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.519] Sleep (dwMilliseconds=0xa) [0151.544] timeGetTime () returned 0x38858 [0151.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.544] Sleep (dwMilliseconds=0xa) [0151.560] timeGetTime () returned 0x38867 [0151.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.560] Sleep (dwMilliseconds=0xa) [0151.576] timeGetTime () returned 0x38877 [0151.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.576] Sleep (dwMilliseconds=0xa) [0151.591] timeGetTime () returned 0x38887 [0151.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.591] Sleep (dwMilliseconds=0xa) [0151.607] timeGetTime () returned 0x38896 [0151.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.607] Sleep (dwMilliseconds=0xa) [0151.622] timeGetTime () returned 0x388a6 [0151.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.622] Sleep (dwMilliseconds=0xa) [0151.638] timeGetTime () returned 0x388b6 [0151.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.638] Sleep (dwMilliseconds=0xa) [0151.654] timeGetTime () returned 0x388c5 [0151.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.654] Sleep (dwMilliseconds=0xa) [0151.669] timeGetTime () returned 0x388d5 [0151.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.669] Sleep (dwMilliseconds=0xa) [0151.686] timeGetTime () returned 0x388e4 [0151.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.686] Sleep (dwMilliseconds=0xa) [0151.701] timeGetTime () returned 0x388f4 [0151.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.701] Sleep (dwMilliseconds=0xa) [0151.716] timeGetTime () returned 0x38904 [0151.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.716] Sleep (dwMilliseconds=0xa) [0151.732] timeGetTime () returned 0x38913 [0151.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.732] Sleep (dwMilliseconds=0xa) [0151.747] timeGetTime () returned 0x38923 [0151.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.747] Sleep (dwMilliseconds=0xa) [0151.763] timeGetTime () returned 0x38933 [0151.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.763] Sleep (dwMilliseconds=0xa) [0151.779] timeGetTime () returned 0x38942 [0151.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.779] Sleep (dwMilliseconds=0xa) [0151.794] timeGetTime () returned 0x38952 [0151.794] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0151.794] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0151.794] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0151.794] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0151.794] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0151.795] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0151.795] RegCloseKey (hKey=0x240) returned 0x0 [0151.795] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0151.795] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0151.795] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0151.795] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0151.795] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0151.795] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0151.795] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0151.795] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0151.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0151.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a958, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0151.795] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0151.796] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0151.888] FreeLibrary (hLibModule=0x77150000) returned 1 [0151.888] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0151.888] TranslateMessage (lpMsg=0x8bf708) returned 0 [0151.888] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0151.888] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0151.888] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0151.888] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0151.889] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0151.889] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0151.889] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0151.889] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0151.889] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0151.889] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0151.889] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0151.889] timeGetTime () returned 0x389b0 [0151.889] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.889] Sleep (dwMilliseconds=0xa) [0151.935] timeGetTime () returned 0x389de [0151.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.935] Sleep (dwMilliseconds=0xa) [0151.982] timeGetTime () returned 0x38a0d [0151.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0151.982] Sleep (dwMilliseconds=0xa) [0152.029] timeGetTime () returned 0x38a3c [0152.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.029] Sleep (dwMilliseconds=0xa) [0152.075] timeGetTime () returned 0x38a6b [0152.075] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.075] Sleep (dwMilliseconds=0xa) [0152.094] timeGetTime () returned 0x38a7b [0152.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.094] Sleep (dwMilliseconds=0xa) [0152.107] timeGetTime () returned 0x38a8a [0152.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.107] Sleep (dwMilliseconds=0xa) [0152.122] timeGetTime () returned 0x38a9a [0152.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.122] Sleep (dwMilliseconds=0xa) [0152.146] timeGetTime () returned 0x38aaa [0152.146] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.146] Sleep (dwMilliseconds=0xa) [0152.186] timeGetTime () returned 0x38ad8 [0152.186] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.186] Sleep (dwMilliseconds=0xa) [0152.200] timeGetTime () returned 0x38ae8 [0152.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.201] Sleep (dwMilliseconds=0xa) [0152.216] timeGetTime () returned 0x38af8 [0152.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.216] Sleep (dwMilliseconds=0xa) [0152.232] timeGetTime () returned 0x38b07 [0152.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.232] Sleep (dwMilliseconds=0xa) [0152.248] timeGetTime () returned 0x38b17 [0152.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.248] Sleep (dwMilliseconds=0xa) [0152.263] timeGetTime () returned 0x38b27 [0152.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.263] Sleep (dwMilliseconds=0xa) [0152.279] timeGetTime () returned 0x38b36 [0152.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.279] Sleep (dwMilliseconds=0xa) [0152.294] timeGetTime () returned 0x38b46 [0152.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.294] Sleep (dwMilliseconds=0xa) [0152.310] timeGetTime () returned 0x38b55 [0152.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.310] Sleep (dwMilliseconds=0xa) [0152.325] timeGetTime () returned 0x38b65 [0152.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.326] Sleep (dwMilliseconds=0xa) [0152.341] timeGetTime () returned 0x38b75 [0152.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.341] Sleep (dwMilliseconds=0xa) [0152.357] timeGetTime () returned 0x38b84 [0152.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.357] Sleep (dwMilliseconds=0xa) [0152.372] timeGetTime () returned 0x38b94 [0152.372] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.372] Sleep (dwMilliseconds=0xa) [0152.388] timeGetTime () returned 0x38ba4 [0152.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.388] Sleep (dwMilliseconds=0xa) [0152.404] timeGetTime () returned 0x38bb3 [0152.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.404] Sleep (dwMilliseconds=0xa) [0152.419] timeGetTime () returned 0x38bc3 [0152.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.419] Sleep (dwMilliseconds=0xa) [0152.435] timeGetTime () returned 0x38bd2 [0152.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.435] Sleep (dwMilliseconds=0xa) [0152.452] timeGetTime () returned 0x38be3 [0152.452] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.452] Sleep (dwMilliseconds=0xa) [0152.485] timeGetTime () returned 0x38c01 [0152.485] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.485] Sleep (dwMilliseconds=0xa) [0152.497] timeGetTime () returned 0x38c11 [0152.497] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.497] Sleep (dwMilliseconds=0xa) [0152.519] timeGetTime () returned 0x38c21 [0152.519] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.519] Sleep (dwMilliseconds=0xa) [0152.544] timeGetTime () returned 0x38c40 [0152.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.544] Sleep (dwMilliseconds=0xa) [0152.560] timeGetTime () returned 0x38c4f [0152.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.560] Sleep (dwMilliseconds=0xa) [0152.576] timeGetTime () returned 0x38c5f [0152.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.576] Sleep (dwMilliseconds=0xa) [0152.591] timeGetTime () returned 0x38c6f [0152.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.591] Sleep (dwMilliseconds=0xa) [0152.607] timeGetTime () returned 0x38c7e [0152.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.607] Sleep (dwMilliseconds=0xa) [0152.622] timeGetTime () returned 0x38c8e [0152.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.622] Sleep (dwMilliseconds=0xa) [0152.638] timeGetTime () returned 0x38c9e [0152.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.638] Sleep (dwMilliseconds=0xa) [0152.654] timeGetTime () returned 0x38cad [0152.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0152.654] TranslateMessage (lpMsg=0x8bf798) returned 0 [0152.654] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0152.654] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0152.654] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0152.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.654] Sleep (dwMilliseconds=0xa) [0152.669] timeGetTime () returned 0x38cbd [0152.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.669] Sleep (dwMilliseconds=0xa) [0152.686] timeGetTime () returned 0x38ccc [0152.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.686] Sleep (dwMilliseconds=0xa) [0152.702] timeGetTime () returned 0x38cdc [0152.702] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.702] Sleep (dwMilliseconds=0xa) [0152.716] timeGetTime () returned 0x38cec [0152.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.716] Sleep (dwMilliseconds=0xa) [0152.732] timeGetTime () returned 0x38cfb [0152.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.732] Sleep (dwMilliseconds=0xa) [0152.747] timeGetTime () returned 0x38d0b [0152.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.748] Sleep (dwMilliseconds=0xa) [0152.763] timeGetTime () returned 0x38d1b [0152.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.763] Sleep (dwMilliseconds=0xa) [0152.779] timeGetTime () returned 0x38d2a [0152.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.779] Sleep (dwMilliseconds=0xa) [0152.795] timeGetTime () returned 0x38d3a [0152.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.795] Sleep (dwMilliseconds=0xa) [0152.810] timeGetTime () returned 0x38d49 [0152.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.810] Sleep (dwMilliseconds=0xa) [0152.825] timeGetTime () returned 0x38d59 [0152.825] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.825] Sleep (dwMilliseconds=0xa) [0152.841] timeGetTime () returned 0x38d69 [0152.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.841] Sleep (dwMilliseconds=0xa) [0152.857] timeGetTime () returned 0x38d78 [0152.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.857] Sleep (dwMilliseconds=0xa) [0152.872] timeGetTime () returned 0x38d88 [0152.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.872] Sleep (dwMilliseconds=0xa) [0152.888] timeGetTime () returned 0x38d98 [0152.888] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0152.888] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0152.888] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0152.888] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0152.888] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0152.888] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0152.888] RegCloseKey (hKey=0x240) returned 0x0 [0152.888] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0152.889] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0152.889] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0152.889] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0152.889] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0152.889] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0152.889] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0152.889] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0152.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0152.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9b8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0152.889] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0152.889] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0152.982] FreeLibrary (hLibModule=0x77150000) returned 1 [0152.982] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0152.982] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0152.982] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0152.982] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0152.982] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0152.982] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0152.982] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0152.982] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0152.982] timeGetTime () returned 0x38df5 [0152.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0152.982] Sleep (dwMilliseconds=0xa) [0153.030] timeGetTime () returned 0x38e24 [0153.030] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.030] Sleep (dwMilliseconds=0xa) [0153.079] timeGetTime () returned 0x38e53 [0153.080] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.080] Sleep (dwMilliseconds=0xa) [0153.123] timeGetTime () returned 0x38e82 [0153.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.123] Sleep (dwMilliseconds=0xa) [0153.176] timeGetTime () returned 0x38eb1 [0153.176] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.176] Sleep (dwMilliseconds=0xa) [0153.233] timeGetTime () returned 0x38eef [0153.233] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.233] Sleep (dwMilliseconds=0xa) [0153.257] timeGetTime () returned 0x38eff [0153.257] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.257] Sleep (dwMilliseconds=0xa) [0153.325] timeGetTime () returned 0x38f4d [0153.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.326] Sleep (dwMilliseconds=0xa) [0153.374] timeGetTime () returned 0x38f7c [0153.374] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.374] Sleep (dwMilliseconds=0xa) [0153.388] timeGetTime () returned 0x38f8c [0153.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.388] Sleep (dwMilliseconds=0xa) [0153.404] timeGetTime () returned 0x38f9b [0153.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.404] Sleep (dwMilliseconds=0xa) [0153.419] timeGetTime () returned 0x38fab [0153.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0153.420] TranslateMessage (lpMsg=0x8bf798) returned 0 [0153.420] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0153.420] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0153.420] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0153.420] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.420] Sleep (dwMilliseconds=0xa) [0153.435] timeGetTime () returned 0x38fba [0153.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.435] Sleep (dwMilliseconds=0xa) [0153.451] timeGetTime () returned 0x38fca [0153.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.451] Sleep (dwMilliseconds=0xa) [0153.526] timeGetTime () returned 0x39009 [0153.526] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.526] Sleep (dwMilliseconds=0xa) [0153.544] timeGetTime () returned 0x39028 [0153.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.544] Sleep (dwMilliseconds=0xa) [0153.560] timeGetTime () returned 0x39037 [0153.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.560] Sleep (dwMilliseconds=0xa) [0153.576] timeGetTime () returned 0x39047 [0153.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.576] Sleep (dwMilliseconds=0xa) [0153.591] timeGetTime () returned 0x39057 [0153.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.591] Sleep (dwMilliseconds=0xa) [0153.607] timeGetTime () returned 0x39066 [0153.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.607] Sleep (dwMilliseconds=0xa) [0153.622] timeGetTime () returned 0x39076 [0153.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.622] Sleep (dwMilliseconds=0xa) [0153.638] timeGetTime () returned 0x39086 [0153.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.638] Sleep (dwMilliseconds=0xa) [0153.654] timeGetTime () returned 0x39095 [0153.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.654] Sleep (dwMilliseconds=0xa) [0153.670] timeGetTime () returned 0x390a5 [0153.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.670] Sleep (dwMilliseconds=0xa) [0153.685] timeGetTime () returned 0x390b4 [0153.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.685] Sleep (dwMilliseconds=0xa) [0153.701] timeGetTime () returned 0x390c4 [0153.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.701] Sleep (dwMilliseconds=0xa) [0153.716] timeGetTime () returned 0x390d4 [0153.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.716] Sleep (dwMilliseconds=0xa) [0153.732] timeGetTime () returned 0x390e3 [0153.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.732] Sleep (dwMilliseconds=0xa) [0153.747] timeGetTime () returned 0x390f3 [0153.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.747] Sleep (dwMilliseconds=0xa) [0153.763] timeGetTime () returned 0x39103 [0153.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.763] Sleep (dwMilliseconds=0xa) [0153.778] timeGetTime () returned 0x39112 [0153.778] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.779] Sleep (dwMilliseconds=0xa) [0153.794] timeGetTime () returned 0x39122 [0153.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.794] Sleep (dwMilliseconds=0xa) [0153.810] timeGetTime () returned 0x39131 [0153.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.810] Sleep (dwMilliseconds=0xa) [0153.826] timeGetTime () returned 0x39141 [0153.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.826] Sleep (dwMilliseconds=0xa) [0153.841] timeGetTime () returned 0x39151 [0153.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.841] Sleep (dwMilliseconds=0xa) [0153.857] timeGetTime () returned 0x39160 [0153.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.857] Sleep (dwMilliseconds=0xa) [0153.872] timeGetTime () returned 0x39170 [0153.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.872] Sleep (dwMilliseconds=0xa) [0153.889] timeGetTime () returned 0x39180 [0153.889] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.889] Sleep (dwMilliseconds=0xa) [0153.904] timeGetTime () returned 0x3918f [0153.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.904] Sleep (dwMilliseconds=0xa) [0153.919] timeGetTime () returned 0x3919f [0153.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.919] Sleep (dwMilliseconds=0xa) [0153.935] timeGetTime () returned 0x391ae [0153.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.935] Sleep (dwMilliseconds=0xa) [0153.951] timeGetTime () returned 0x391be [0153.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.951] Sleep (dwMilliseconds=0xa) [0153.966] timeGetTime () returned 0x391ce [0153.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0153.966] Sleep (dwMilliseconds=0xa) [0153.982] timeGetTime () returned 0x391dd [0153.982] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0153.982] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0153.982] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0153.982] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0153.982] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0153.982] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0153.982] RegCloseKey (hKey=0x240) returned 0x0 [0153.982] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0153.982] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0153.982] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0153.982] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0153.983] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0153.983] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0153.983] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0153.983] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0153.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0153.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aad8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0153.983] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0153.983] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0154.075] FreeLibrary (hLibModule=0x77150000) returned 1 [0154.076] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0154.076] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0154.076] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0154.076] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0154.076] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0154.076] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0154.076] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0154.076] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0154.076] timeGetTime () returned 0x3923b [0154.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.076] Sleep (dwMilliseconds=0xa) [0154.123] timeGetTime () returned 0x3926a [0154.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.123] Sleep (dwMilliseconds=0xa) [0154.169] timeGetTime () returned 0x39299 [0154.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0154.169] TranslateMessage (lpMsg=0x8bf798) returned 0 [0154.169] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0154.169] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0154.169] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0154.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.170] Sleep (dwMilliseconds=0xa) [0154.216] timeGetTime () returned 0x392c8 [0154.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.216] Sleep (dwMilliseconds=0xa) [0154.263] timeGetTime () returned 0x392f7 [0154.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.263] Sleep (dwMilliseconds=0xa) [0154.278] timeGetTime () returned 0x39306 [0154.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.279] Sleep (dwMilliseconds=0xa) [0154.301] timeGetTime () returned 0x39316 [0154.301] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.301] Sleep (dwMilliseconds=0xa) [0154.326] timeGetTime () returned 0x39335 [0154.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.326] Sleep (dwMilliseconds=0xa) [0154.346] timeGetTime () returned 0x39345 [0154.346] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.346] Sleep (dwMilliseconds=0xa) [0154.357] timeGetTime () returned 0x39354 [0154.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.357] Sleep (dwMilliseconds=0xa) [0154.372] timeGetTime () returned 0x39364 [0154.372] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.372] Sleep (dwMilliseconds=0xa) [0154.388] timeGetTime () returned 0x39374 [0154.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.388] Sleep (dwMilliseconds=0xa) [0154.404] timeGetTime () returned 0x39383 [0154.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.404] Sleep (dwMilliseconds=0xa) [0154.419] timeGetTime () returned 0x39393 [0154.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.419] Sleep (dwMilliseconds=0xa) [0154.435] timeGetTime () returned 0x393a2 [0154.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.435] Sleep (dwMilliseconds=0xa) [0154.450] timeGetTime () returned 0x393b2 [0154.450] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.450] Sleep (dwMilliseconds=0xa) [0154.483] timeGetTime () returned 0x393d1 [0154.483] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.483] Sleep (dwMilliseconds=0xa) [0154.497] timeGetTime () returned 0x393e1 [0154.497] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.497] Sleep (dwMilliseconds=0xa) [0154.518] timeGetTime () returned 0x393f1 [0154.519] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.519] Sleep (dwMilliseconds=0xa) [0154.544] timeGetTime () returned 0x39410 [0154.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.545] Sleep (dwMilliseconds=0xa) [0154.560] timeGetTime () returned 0x3941f [0154.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.560] Sleep (dwMilliseconds=0xa) [0154.576] timeGetTime () returned 0x3942f [0154.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.576] Sleep (dwMilliseconds=0xa) [0154.591] timeGetTime () returned 0x3943f [0154.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.591] Sleep (dwMilliseconds=0xa) [0154.608] timeGetTime () returned 0x39450 [0154.608] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.608] Sleep (dwMilliseconds=0xa) [0154.622] timeGetTime () returned 0x3945e [0154.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.622] Sleep (dwMilliseconds=0xa) [0154.638] timeGetTime () returned 0x3946e [0154.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.638] Sleep (dwMilliseconds=0xa) [0154.654] timeGetTime () returned 0x3947d [0154.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.654] Sleep (dwMilliseconds=0xa) [0154.669] timeGetTime () returned 0x3948d [0154.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.669] Sleep (dwMilliseconds=0xa) [0154.686] timeGetTime () returned 0x3949c [0154.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.686] Sleep (dwMilliseconds=0xa) [0154.701] timeGetTime () returned 0x394ac [0154.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.701] Sleep (dwMilliseconds=0xa) [0154.716] timeGetTime () returned 0x394bc [0154.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.716] Sleep (dwMilliseconds=0xa) [0154.732] timeGetTime () returned 0x394cb [0154.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.732] Sleep (dwMilliseconds=0xa) [0154.747] timeGetTime () returned 0x394db [0154.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.747] Sleep (dwMilliseconds=0xa) [0154.763] timeGetTime () returned 0x394eb [0154.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.763] Sleep (dwMilliseconds=0xa) [0154.779] timeGetTime () returned 0x394fa [0154.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.779] Sleep (dwMilliseconds=0xa) [0154.795] timeGetTime () returned 0x3950a [0154.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.795] Sleep (dwMilliseconds=0xa) [0154.810] timeGetTime () returned 0x39519 [0154.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.810] Sleep (dwMilliseconds=0xa) [0154.826] timeGetTime () returned 0x39529 [0154.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.826] Sleep (dwMilliseconds=0xa) [0154.841] timeGetTime () returned 0x39539 [0154.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.841] Sleep (dwMilliseconds=0xa) [0154.857] timeGetTime () returned 0x39548 [0154.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.857] Sleep (dwMilliseconds=0xa) [0154.872] timeGetTime () returned 0x39558 [0154.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.872] Sleep (dwMilliseconds=0xa) [0154.888] timeGetTime () returned 0x39568 [0154.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.888] Sleep (dwMilliseconds=0xa) [0154.904] timeGetTime () returned 0x39577 [0154.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.904] Sleep (dwMilliseconds=0xa) [0154.919] timeGetTime () returned 0x39587 [0154.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0154.919] TranslateMessage (lpMsg=0x8bf798) returned 0 [0154.919] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0154.919] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0154.919] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0154.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.920] Sleep (dwMilliseconds=0xa) [0154.935] timeGetTime () returned 0x39596 [0154.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.935] Sleep (dwMilliseconds=0xa) [0154.950] timeGetTime () returned 0x395a6 [0154.950] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.950] Sleep (dwMilliseconds=0xa) [0154.966] timeGetTime () returned 0x395b6 [0154.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.966] Sleep (dwMilliseconds=0xa) [0154.982] timeGetTime () returned 0x395c5 [0154.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.982] Sleep (dwMilliseconds=0xa) [0154.997] timeGetTime () returned 0x395d5 [0154.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0154.997] Sleep (dwMilliseconds=0xa) [0155.013] timeGetTime () returned 0x395e5 [0155.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.013] Sleep (dwMilliseconds=0xa) [0155.029] timeGetTime () returned 0x395f4 [0155.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.029] Sleep (dwMilliseconds=0xa) [0155.045] timeGetTime () returned 0x39604 [0155.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.045] Sleep (dwMilliseconds=0xa) [0155.060] timeGetTime () returned 0x39613 [0155.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.060] Sleep (dwMilliseconds=0xa) [0155.076] timeGetTime () returned 0x39623 [0155.076] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0155.076] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0155.076] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0155.076] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0155.076] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0155.076] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0155.076] RegCloseKey (hKey=0x240) returned 0x0 [0155.076] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0155.076] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0155.076] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0155.076] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0155.076] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0155.076] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0155.076] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0155.076] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0155.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0155.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a978, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0155.077] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0155.077] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0155.170] FreeLibrary (hLibModule=0x77150000) returned 1 [0155.170] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0155.170] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0155.170] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0155.170] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0155.170] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0155.170] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0155.170] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0155.170] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0155.170] timeGetTime () returned 0x39681 [0155.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.170] Sleep (dwMilliseconds=0xa) [0155.216] timeGetTime () returned 0x396b0 [0155.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.216] Sleep (dwMilliseconds=0xa) [0155.264] timeGetTime () returned 0x396df [0155.264] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.264] Sleep (dwMilliseconds=0xa) [0155.310] timeGetTime () returned 0x3970d [0155.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.310] Sleep (dwMilliseconds=0xa) [0155.364] timeGetTime () returned 0x3973c [0155.364] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.364] Sleep (dwMilliseconds=0xa) [0155.388] timeGetTime () returned 0x3975c [0155.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.388] Sleep (dwMilliseconds=0xa) [0155.405] timeGetTime () returned 0x3976b [0155.405] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.405] Sleep (dwMilliseconds=0xa) [0155.419] timeGetTime () returned 0x3977b [0155.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.419] Sleep (dwMilliseconds=0xa) [0155.435] timeGetTime () returned 0x3978a [0155.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.435] Sleep (dwMilliseconds=0xa) [0155.450] timeGetTime () returned 0x3979a [0155.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.451] Sleep (dwMilliseconds=0xa) [0155.502] timeGetTime () returned 0x397c9 [0155.502] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.502] Sleep (dwMilliseconds=0xa) [0155.518] timeGetTime () returned 0x397d9 [0155.518] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.518] Sleep (dwMilliseconds=0xa) [0155.544] timeGetTime () returned 0x397f8 [0155.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.544] Sleep (dwMilliseconds=0xa) [0155.560] timeGetTime () returned 0x39807 [0155.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.560] Sleep (dwMilliseconds=0xa) [0155.576] timeGetTime () returned 0x39817 [0155.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.576] Sleep (dwMilliseconds=0xa) [0155.591] timeGetTime () returned 0x39827 [0155.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.591] Sleep (dwMilliseconds=0xa) [0155.607] timeGetTime () returned 0x39836 [0155.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.607] Sleep (dwMilliseconds=0xa) [0155.623] timeGetTime () returned 0x39846 [0155.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.623] Sleep (dwMilliseconds=0xa) [0155.638] timeGetTime () returned 0x39856 [0155.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.638] Sleep (dwMilliseconds=0xa) [0155.654] timeGetTime () returned 0x39865 [0155.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.654] Sleep (dwMilliseconds=0xa) [0155.669] timeGetTime () returned 0x39875 [0155.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.669] Sleep (dwMilliseconds=0xa) [0155.688] timeGetTime () returned 0x39884 [0155.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0155.688] TranslateMessage (lpMsg=0x8bf798) returned 0 [0155.688] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0155.688] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0155.688] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0155.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.688] Sleep (dwMilliseconds=0xa) [0155.700] timeGetTime () returned 0x39894 [0155.700] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.700] Sleep (dwMilliseconds=0xa) [0155.716] timeGetTime () returned 0x398a4 [0155.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.716] Sleep (dwMilliseconds=0xa) [0155.733] timeGetTime () returned 0x398b3 [0155.733] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.733] Sleep (dwMilliseconds=0xa) [0155.757] timeGetTime () returned 0x398c3 [0155.757] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.757] Sleep (dwMilliseconds=0xa) [0155.784] timeGetTime () returned 0x398e2 [0155.784] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.784] Sleep (dwMilliseconds=0xa) [0155.800] timeGetTime () returned 0x398f2 [0155.800] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.800] Sleep (dwMilliseconds=0xa) [0155.830] timeGetTime () returned 0x39911 [0155.831] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.831] Sleep (dwMilliseconds=0xa) [0155.845] timeGetTime () returned 0x39921 [0155.845] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.845] Sleep (dwMilliseconds=0xa) [0155.864] timeGetTime () returned 0x39930 [0155.864] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.864] Sleep (dwMilliseconds=0xa) [0155.890] timeGetTime () returned 0x39950 [0155.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.890] Sleep (dwMilliseconds=0xa) [0155.904] timeGetTime () returned 0x3995f [0155.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.904] Sleep (dwMilliseconds=0xa) [0155.920] timeGetTime () returned 0x3996f [0155.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.920] Sleep (dwMilliseconds=0xa) [0155.935] timeGetTime () returned 0x3997e [0155.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.935] Sleep (dwMilliseconds=0xa) [0155.951] timeGetTime () returned 0x3998e [0155.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.951] Sleep (dwMilliseconds=0xa) [0155.966] timeGetTime () returned 0x3999e [0155.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.966] Sleep (dwMilliseconds=0xa) [0155.982] timeGetTime () returned 0x399ad [0155.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.982] Sleep (dwMilliseconds=0xa) [0155.997] timeGetTime () returned 0x399bd [0155.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0155.997] Sleep (dwMilliseconds=0xa) [0156.013] timeGetTime () returned 0x399cd [0156.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.013] Sleep (dwMilliseconds=0xa) [0156.029] timeGetTime () returned 0x399dc [0156.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.029] Sleep (dwMilliseconds=0xa) [0156.044] timeGetTime () returned 0x399ec [0156.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.044] Sleep (dwMilliseconds=0xa) [0156.060] timeGetTime () returned 0x399fb [0156.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.060] Sleep (dwMilliseconds=0xa) [0156.076] timeGetTime () returned 0x39a0b [0156.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.076] Sleep (dwMilliseconds=0xa) [0156.091] timeGetTime () returned 0x39a1b [0156.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.091] Sleep (dwMilliseconds=0xa) [0156.107] timeGetTime () returned 0x39a2a [0156.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.107] Sleep (dwMilliseconds=0xa) [0156.122] timeGetTime () returned 0x39a3a [0156.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.122] Sleep (dwMilliseconds=0xa) [0156.138] timeGetTime () returned 0x39a4a [0156.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.138] Sleep (dwMilliseconds=0xa) [0156.154] timeGetTime () returned 0x39a59 [0156.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.154] Sleep (dwMilliseconds=0xa) [0156.169] timeGetTime () returned 0x39a69 [0156.169] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0156.169] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0156.170] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0156.170] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0156.170] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0156.170] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0156.170] RegCloseKey (hKey=0x240) returned 0x0 [0156.170] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0156.170] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0156.170] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0156.170] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0156.170] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0156.170] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0156.170] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0156.170] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0156.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0156.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0156.171] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0156.171] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0156.263] FreeLibrary (hLibModule=0x77150000) returned 1 [0156.263] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0156.263] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0156.263] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0156.263] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0156.263] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0156.263] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0156.263] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0156.264] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0156.264] timeGetTime () returned 0x39ac7 [0156.264] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.264] Sleep (dwMilliseconds=0xa) [0156.310] timeGetTime () returned 0x39af5 [0156.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.310] Sleep (dwMilliseconds=0xa) [0156.357] timeGetTime () returned 0x39b24 [0156.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.357] Sleep (dwMilliseconds=0xa) [0156.404] timeGetTime () returned 0x39b53 [0156.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.404] Sleep (dwMilliseconds=0xa) [0156.450] timeGetTime () returned 0x39b82 [0156.450] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0156.451] TranslateMessage (lpMsg=0x8bf798) returned 0 [0156.451] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0156.451] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0156.451] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0156.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.451] Sleep (dwMilliseconds=0xa) [0156.522] timeGetTime () returned 0x39bc1 [0156.522] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.522] Sleep (dwMilliseconds=0xa) [0156.544] timeGetTime () returned 0x39be0 [0156.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.544] Sleep (dwMilliseconds=0xa) [0156.568] timeGetTime () returned 0x39bef [0156.568] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.568] Sleep (dwMilliseconds=0xa) [0156.591] timeGetTime () returned 0x39c0f [0156.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.591] Sleep (dwMilliseconds=0xa) [0156.607] timeGetTime () returned 0x39c1e [0156.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.607] Sleep (dwMilliseconds=0xa) [0156.622] timeGetTime () returned 0x39c2e [0156.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.622] Sleep (dwMilliseconds=0xa) [0156.639] timeGetTime () returned 0x39c3e [0156.639] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.639] Sleep (dwMilliseconds=0xa) [0156.653] timeGetTime () returned 0x39c4d [0156.653] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.653] Sleep (dwMilliseconds=0xa) [0156.669] timeGetTime () returned 0x39c5d [0156.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.669] Sleep (dwMilliseconds=0xa) [0156.686] timeGetTime () returned 0x39c6c [0156.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.686] Sleep (dwMilliseconds=0xa) [0156.702] timeGetTime () returned 0x39c7c [0156.702] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.702] Sleep (dwMilliseconds=0xa) [0156.716] timeGetTime () returned 0x39c8c [0156.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.716] Sleep (dwMilliseconds=0xa) [0156.732] timeGetTime () returned 0x39c9b [0156.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.732] Sleep (dwMilliseconds=0xa) [0156.747] timeGetTime () returned 0x39cab [0156.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.747] Sleep (dwMilliseconds=0xa) [0156.764] timeGetTime () returned 0x39cbb [0156.764] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.764] Sleep (dwMilliseconds=0xa) [0156.778] timeGetTime () returned 0x39cca [0156.778] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.779] Sleep (dwMilliseconds=0xa) [0156.794] timeGetTime () returned 0x39cda [0156.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.794] Sleep (dwMilliseconds=0xa) [0156.810] timeGetTime () returned 0x39ce9 [0156.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.810] Sleep (dwMilliseconds=0xa) [0156.826] timeGetTime () returned 0x39cf9 [0156.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.826] Sleep (dwMilliseconds=0xa) [0156.841] timeGetTime () returned 0x39d09 [0156.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.841] Sleep (dwMilliseconds=0xa) [0156.935] timeGetTime () returned 0x39d67 [0156.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.935] Sleep (dwMilliseconds=0xa) [0156.950] timeGetTime () returned 0x39d76 [0156.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.951] Sleep (dwMilliseconds=0xa) [0156.966] timeGetTime () returned 0x39d86 [0156.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.966] Sleep (dwMilliseconds=0xa) [0156.982] timeGetTime () returned 0x39d95 [0156.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.982] Sleep (dwMilliseconds=0xa) [0156.998] timeGetTime () returned 0x39da5 [0156.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0156.998] Sleep (dwMilliseconds=0xa) [0157.013] timeGetTime () returned 0x39db5 [0157.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.013] Sleep (dwMilliseconds=0xa) [0157.029] timeGetTime () returned 0x39dc4 [0157.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.029] Sleep (dwMilliseconds=0xa) [0157.044] timeGetTime () returned 0x39dd4 [0157.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.045] Sleep (dwMilliseconds=0xa) [0157.060] timeGetTime () returned 0x39de3 [0157.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.060] Sleep (dwMilliseconds=0xa) [0157.075] timeGetTime () returned 0x39df3 [0157.075] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.075] Sleep (dwMilliseconds=0xa) [0157.091] timeGetTime () returned 0x39e03 [0157.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.091] Sleep (dwMilliseconds=0xa) [0157.107] timeGetTime () returned 0x39e12 [0157.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.107] Sleep (dwMilliseconds=0xa) [0157.122] timeGetTime () returned 0x39e22 [0157.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.123] Sleep (dwMilliseconds=0xa) [0157.138] timeGetTime () returned 0x39e32 [0157.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.138] Sleep (dwMilliseconds=0xa) [0157.154] timeGetTime () returned 0x39e41 [0157.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.154] Sleep (dwMilliseconds=0xa) [0157.169] timeGetTime () returned 0x39e51 [0157.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.169] Sleep (dwMilliseconds=0xa) [0157.185] timeGetTime () returned 0x39e60 [0157.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.185] Sleep (dwMilliseconds=0xa) [0157.201] timeGetTime () returned 0x39e70 [0157.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0157.201] TranslateMessage (lpMsg=0x8bf798) returned 0 [0157.201] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0157.201] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0157.201] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0157.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.201] Sleep (dwMilliseconds=0xa) [0157.216] timeGetTime () returned 0x39e80 [0157.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.216] Sleep (dwMilliseconds=0xa) [0157.232] timeGetTime () returned 0x39e8f [0157.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.232] Sleep (dwMilliseconds=0xa) [0157.248] timeGetTime () returned 0x39e9f [0157.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.248] Sleep (dwMilliseconds=0xa) [0157.263] timeGetTime () returned 0x39eaf [0157.263] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0157.263] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0157.263] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0157.263] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0157.263] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0157.263] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0157.263] RegCloseKey (hKey=0x240) returned 0x0 [0157.264] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0157.264] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0157.264] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0157.264] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0157.264] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0157.264] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0157.264] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0157.264] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0157.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0157.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0157.264] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0157.264] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0157.357] FreeLibrary (hLibModule=0x77150000) returned 1 [0157.357] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0157.357] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0157.357] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0157.357] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0157.357] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0157.357] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0157.357] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0157.357] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0157.357] timeGetTime () returned 0x39f0c [0157.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.358] Sleep (dwMilliseconds=0xa) [0157.404] timeGetTime () returned 0x39f3b [0157.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.404] Sleep (dwMilliseconds=0xa) [0157.452] timeGetTime () returned 0x39f6a [0157.452] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.452] Sleep (dwMilliseconds=0xa) [0157.545] timeGetTime () returned 0x39fc8 [0157.545] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.545] Sleep (dwMilliseconds=0xa) [0157.592] timeGetTime () returned 0x39ff7 [0157.592] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.592] Sleep (dwMilliseconds=0xa) [0157.613] timeGetTime () returned 0x3a006 [0157.613] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.613] Sleep (dwMilliseconds=0xa) [0157.638] timeGetTime () returned 0x3a026 [0157.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.638] Sleep (dwMilliseconds=0xa) [0157.661] timeGetTime () returned 0x3a035 [0157.661] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.661] Sleep (dwMilliseconds=0xa) [0157.687] timeGetTime () returned 0x3a054 [0157.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.687] Sleep (dwMilliseconds=0xa) [0157.700] timeGetTime () returned 0x3a064 [0157.700] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.700] Sleep (dwMilliseconds=0xa) [0157.716] timeGetTime () returned 0x3a074 [0157.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.716] Sleep (dwMilliseconds=0xa) [0157.734] timeGetTime () returned 0x3a083 [0157.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.734] Sleep (dwMilliseconds=0xa) [0157.747] timeGetTime () returned 0x3a093 [0157.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.747] Sleep (dwMilliseconds=0xa) [0157.763] timeGetTime () returned 0x3a0a3 [0157.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.763] Sleep (dwMilliseconds=0xa) [0157.779] timeGetTime () returned 0x3a0b2 [0157.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.779] Sleep (dwMilliseconds=0xa) [0157.794] timeGetTime () returned 0x3a0c2 [0157.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.794] Sleep (dwMilliseconds=0xa) [0157.810] timeGetTime () returned 0x3a0d1 [0157.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.810] Sleep (dwMilliseconds=0xa) [0157.825] timeGetTime () returned 0x3a0e1 [0157.825] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.825] Sleep (dwMilliseconds=0xa) [0157.841] timeGetTime () returned 0x3a0f1 [0157.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.841] Sleep (dwMilliseconds=0xa) [0157.857] timeGetTime () returned 0x3a100 [0157.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.857] Sleep (dwMilliseconds=0xa) [0157.872] timeGetTime () returned 0x3a110 [0157.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.872] Sleep (dwMilliseconds=0xa) [0157.888] timeGetTime () returned 0x3a120 [0157.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.888] Sleep (dwMilliseconds=0xa) [0157.904] timeGetTime () returned 0x3a12f [0157.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.904] Sleep (dwMilliseconds=0xa) [0157.919] timeGetTime () returned 0x3a13f [0157.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.919] Sleep (dwMilliseconds=0xa) [0157.935] timeGetTime () returned 0x3a14e [0157.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.935] Sleep (dwMilliseconds=0xa) [0157.950] timeGetTime () returned 0x3a15e [0157.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0157.951] TranslateMessage (lpMsg=0x8bf798) returned 0 [0157.951] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0157.951] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0157.951] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0157.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.951] Sleep (dwMilliseconds=0xa) [0157.966] timeGetTime () returned 0x3a16e [0157.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.966] Sleep (dwMilliseconds=0xa) [0157.982] timeGetTime () returned 0x3a17d [0157.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.982] Sleep (dwMilliseconds=0xa) [0157.997] timeGetTime () returned 0x3a18d [0157.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0157.997] Sleep (dwMilliseconds=0xa) [0158.013] timeGetTime () returned 0x3a19d [0158.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.013] Sleep (dwMilliseconds=0xa) [0158.029] timeGetTime () returned 0x3a1ac [0158.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.029] Sleep (dwMilliseconds=0xa) [0158.046] timeGetTime () returned 0x3a1bc [0158.046] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.046] Sleep (dwMilliseconds=0xa) [0158.060] timeGetTime () returned 0x3a1cb [0158.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.060] Sleep (dwMilliseconds=0xa) [0158.075] timeGetTime () returned 0x3a1db [0158.075] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.075] Sleep (dwMilliseconds=0xa) [0158.091] timeGetTime () returned 0x3a1eb [0158.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.091] Sleep (dwMilliseconds=0xa) [0158.107] timeGetTime () returned 0x3a1fa [0158.108] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.108] Sleep (dwMilliseconds=0xa) [0158.122] timeGetTime () returned 0x3a20a [0158.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.122] Sleep (dwMilliseconds=0xa) [0158.138] timeGetTime () returned 0x3a21a [0158.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.138] Sleep (dwMilliseconds=0xa) [0158.153] timeGetTime () returned 0x3a229 [0158.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.154] Sleep (dwMilliseconds=0xa) [0158.169] timeGetTime () returned 0x3a239 [0158.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.169] Sleep (dwMilliseconds=0xa) [0158.185] timeGetTime () returned 0x3a248 [0158.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.185] Sleep (dwMilliseconds=0xa) [0158.200] timeGetTime () returned 0x3a258 [0158.200] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.200] Sleep (dwMilliseconds=0xa) [0158.216] timeGetTime () returned 0x3a268 [0158.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.216] Sleep (dwMilliseconds=0xa) [0158.232] timeGetTime () returned 0x3a277 [0158.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.233] Sleep (dwMilliseconds=0xa) [0158.248] timeGetTime () returned 0x3a287 [0158.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.248] Sleep (dwMilliseconds=0xa) [0158.263] timeGetTime () returned 0x3a297 [0158.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.263] Sleep (dwMilliseconds=0xa) [0158.279] timeGetTime () returned 0x3a2a6 [0158.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.279] Sleep (dwMilliseconds=0xa) [0158.295] timeGetTime () returned 0x3a2b6 [0158.295] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.295] Sleep (dwMilliseconds=0xa) [0158.310] timeGetTime () returned 0x3a2c6 [0158.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.310] Sleep (dwMilliseconds=0xa) [0158.325] timeGetTime () returned 0x3a2d5 [0158.325] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.325] Sleep (dwMilliseconds=0xa) [0158.341] timeGetTime () returned 0x3a2e5 [0158.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.341] Sleep (dwMilliseconds=0xa) [0158.357] timeGetTime () returned 0x3a2f4 [0158.357] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0158.357] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0158.357] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0158.357] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0158.357] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0158.357] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0158.358] RegCloseKey (hKey=0x240) returned 0x0 [0158.358] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0158.358] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0158.358] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0158.358] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0158.358] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0158.358] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0158.358] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0158.358] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0158.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0158.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0158.358] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0158.358] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0158.451] FreeLibrary (hLibModule=0x77150000) returned 1 [0158.451] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0158.451] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0158.451] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0158.451] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0158.451] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0158.451] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0158.451] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0158.451] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0158.451] timeGetTime () returned 0x3a352 [0158.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.451] Sleep (dwMilliseconds=0xa) [0158.519] timeGetTime () returned 0x3a391 [0158.519] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.519] Sleep (dwMilliseconds=0xa) [0158.561] timeGetTime () returned 0x3a3bf [0158.561] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.561] Sleep (dwMilliseconds=0xa) [0158.594] timeGetTime () returned 0x3a3df [0158.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.594] Sleep (dwMilliseconds=0xa) [0158.638] timeGetTime () returned 0x3a40e [0158.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.638] Sleep (dwMilliseconds=0xa) [0158.683] timeGetTime () returned 0x3a42d [0158.683] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.683] Sleep (dwMilliseconds=0xa) [0158.701] timeGetTime () returned 0x3a44c [0158.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.701] Sleep (dwMilliseconds=0xa) [0158.717] timeGetTime () returned 0x3a45c [0158.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0158.717] TranslateMessage (lpMsg=0x8bf798) returned 0 [0158.717] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0158.717] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0158.717] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0158.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.717] Sleep (dwMilliseconds=0xa) [0158.739] timeGetTime () returned 0x3a46b [0158.739] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.739] Sleep (dwMilliseconds=0xa) [0158.772] timeGetTime () returned 0x3a48b [0158.772] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.772] Sleep (dwMilliseconds=0xa) [0158.794] timeGetTime () returned 0x3a4aa [0158.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.794] Sleep (dwMilliseconds=0xa) [0158.810] timeGetTime () returned 0x3a4b9 [0158.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.810] Sleep (dwMilliseconds=0xa) [0158.826] timeGetTime () returned 0x3a4c9 [0158.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.826] Sleep (dwMilliseconds=0xa) [0158.841] timeGetTime () returned 0x3a4d9 [0158.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.841] Sleep (dwMilliseconds=0xa) [0158.857] timeGetTime () returned 0x3a4e8 [0158.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.857] Sleep (dwMilliseconds=0xa) [0158.872] timeGetTime () returned 0x3a4f8 [0158.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.872] Sleep (dwMilliseconds=0xa) [0158.888] timeGetTime () returned 0x3a508 [0158.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.888] Sleep (dwMilliseconds=0xa) [0158.904] timeGetTime () returned 0x3a517 [0158.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.904] Sleep (dwMilliseconds=0xa) [0158.919] timeGetTime () returned 0x3a527 [0158.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.919] Sleep (dwMilliseconds=0xa) [0158.935] timeGetTime () returned 0x3a536 [0158.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.935] Sleep (dwMilliseconds=0xa) [0158.951] timeGetTime () returned 0x3a546 [0158.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.951] Sleep (dwMilliseconds=0xa) [0158.966] timeGetTime () returned 0x3a556 [0158.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.966] Sleep (dwMilliseconds=0xa) [0158.982] timeGetTime () returned 0x3a565 [0158.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.982] Sleep (dwMilliseconds=0xa) [0158.997] timeGetTime () returned 0x3a575 [0158.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0158.997] Sleep (dwMilliseconds=0xa) [0159.013] timeGetTime () returned 0x3a585 [0159.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.013] Sleep (dwMilliseconds=0xa) [0159.030] timeGetTime () returned 0x3a594 [0159.030] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.030] Sleep (dwMilliseconds=0xa) [0159.044] timeGetTime () returned 0x3a5a4 [0159.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.044] Sleep (dwMilliseconds=0xa) [0159.060] timeGetTime () returned 0x3a5b3 [0159.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.060] Sleep (dwMilliseconds=0xa) [0159.076] timeGetTime () returned 0x3a5c3 [0159.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.076] Sleep (dwMilliseconds=0xa) [0159.091] timeGetTime () returned 0x3a5d3 [0159.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.091] Sleep (dwMilliseconds=0xa) [0159.107] timeGetTime () returned 0x3a5e2 [0159.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.107] Sleep (dwMilliseconds=0xa) [0159.122] timeGetTime () returned 0x3a5f2 [0159.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.122] Sleep (dwMilliseconds=0xa) [0159.138] timeGetTime () returned 0x3a602 [0159.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.138] Sleep (dwMilliseconds=0xa) [0159.153] timeGetTime () returned 0x3a611 [0159.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.154] Sleep (dwMilliseconds=0xa) [0159.169] timeGetTime () returned 0x3a621 [0159.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.169] Sleep (dwMilliseconds=0xa) [0159.185] timeGetTime () returned 0x3a630 [0159.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.185] Sleep (dwMilliseconds=0xa) [0159.201] timeGetTime () returned 0x3a640 [0159.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.201] Sleep (dwMilliseconds=0xa) [0159.216] timeGetTime () returned 0x3a650 [0159.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.216] Sleep (dwMilliseconds=0xa) [0159.232] timeGetTime () returned 0x3a65f [0159.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.232] Sleep (dwMilliseconds=0xa) [0159.247] timeGetTime () returned 0x3a66f [0159.247] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.247] Sleep (dwMilliseconds=0xa) [0159.263] timeGetTime () returned 0x3a67f [0159.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.263] Sleep (dwMilliseconds=0xa) [0159.279] timeGetTime () returned 0x3a68e [0159.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.279] Sleep (dwMilliseconds=0xa) [0159.294] timeGetTime () returned 0x3a69e [0159.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.294] Sleep (dwMilliseconds=0xa) [0159.310] timeGetTime () returned 0x3a6ad [0159.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.310] Sleep (dwMilliseconds=0xa) [0159.326] timeGetTime () returned 0x3a6bd [0159.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.326] Sleep (dwMilliseconds=0xa) [0159.341] timeGetTime () returned 0x3a6cd [0159.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.341] Sleep (dwMilliseconds=0xa) [0159.357] timeGetTime () returned 0x3a6dc [0159.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.357] Sleep (dwMilliseconds=0xa) [0159.373] timeGetTime () returned 0x3a6ed [0159.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.373] Sleep (dwMilliseconds=0xa) [0159.388] timeGetTime () returned 0x3a6fc [0159.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.388] Sleep (dwMilliseconds=0xa) [0159.404] timeGetTime () returned 0x3a70b [0159.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.404] Sleep (dwMilliseconds=0xa) [0159.419] timeGetTime () returned 0x3a71b [0159.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.419] Sleep (dwMilliseconds=0xa) [0159.435] timeGetTime () returned 0x3a72a [0159.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.435] Sleep (dwMilliseconds=0xa) [0159.452] timeGetTime () returned 0x3a73b [0159.452] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0159.452] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0159.452] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0159.452] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0159.452] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0159.452] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0159.453] RegCloseKey (hKey=0x240) returned 0x0 [0159.453] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0159.453] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0159.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0159.453] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0159.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0159.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0159.453] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0159.453] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0159.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0159.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9b8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0159.454] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0159.454] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0159.560] FreeLibrary (hLibModule=0x77150000) returned 1 [0159.560] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0159.560] TranslateMessage (lpMsg=0x8bf708) returned 0 [0159.560] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0159.560] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0159.560] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0159.560] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0159.561] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0159.561] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0159.561] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0159.561] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0159.561] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0159.561] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0159.561] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0159.561] timeGetTime () returned 0x3a7a7 [0159.561] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.561] Sleep (dwMilliseconds=0xa) [0159.608] timeGetTime () returned 0x3a7d8 [0159.608] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.608] Sleep (dwMilliseconds=0xa) [0159.653] timeGetTime () returned 0x3a805 [0159.653] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.654] Sleep (dwMilliseconds=0xa) [0159.703] timeGetTime () returned 0x3a834 [0159.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.703] Sleep (dwMilliseconds=0xa) [0159.747] timeGetTime () returned 0x3a863 [0159.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.747] Sleep (dwMilliseconds=0xa) [0159.784] timeGetTime () returned 0x3a882 [0159.784] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.784] Sleep (dwMilliseconds=0xa) [0159.820] timeGetTime () returned 0x3a8a1 [0159.820] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.820] Sleep (dwMilliseconds=0xa) [0159.841] timeGetTime () returned 0x3a8c1 [0159.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.841] Sleep (dwMilliseconds=0xa) [0159.857] timeGetTime () returned 0x3a8d0 [0159.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.857] Sleep (dwMilliseconds=0xa) [0159.873] timeGetTime () returned 0x3a8e0 [0159.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.873] Sleep (dwMilliseconds=0xa) [0159.888] timeGetTime () returned 0x3a8f0 [0159.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.888] Sleep (dwMilliseconds=0xa) [0159.904] timeGetTime () returned 0x3a8ff [0159.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.904] Sleep (dwMilliseconds=0xa) [0159.919] timeGetTime () returned 0x3a90f [0159.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.919] Sleep (dwMilliseconds=0xa) [0159.935] timeGetTime () returned 0x3a91e [0159.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.935] Sleep (dwMilliseconds=0xa) [0159.951] timeGetTime () returned 0x3a92e [0159.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.951] Sleep (dwMilliseconds=0xa) [0159.966] timeGetTime () returned 0x3a93e [0159.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.966] Sleep (dwMilliseconds=0xa) [0159.982] timeGetTime () returned 0x3a94d [0159.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.982] Sleep (dwMilliseconds=0xa) [0159.998] timeGetTime () returned 0x3a95d [0159.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0159.998] Sleep (dwMilliseconds=0xa) [0160.013] timeGetTime () returned 0x3a96d [0160.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.013] Sleep (dwMilliseconds=0xa) [0160.029] timeGetTime () returned 0x3a97c [0160.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.029] Sleep (dwMilliseconds=0xa) [0160.044] timeGetTime () returned 0x3a98c [0160.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.044] Sleep (dwMilliseconds=0xa) [0160.061] timeGetTime () returned 0x3a99b [0160.061] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.061] Sleep (dwMilliseconds=0xa) [0160.075] timeGetTime () returned 0x3a9ab [0160.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.076] Sleep (dwMilliseconds=0xa) [0160.091] timeGetTime () returned 0x3a9bb [0160.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.091] Sleep (dwMilliseconds=0xa) [0160.107] timeGetTime () returned 0x3a9ca [0160.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.107] Sleep (dwMilliseconds=0xa) [0160.123] timeGetTime () returned 0x3a9da [0160.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.123] Sleep (dwMilliseconds=0xa) [0160.138] timeGetTime () returned 0x3a9ea [0160.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.138] Sleep (dwMilliseconds=0xa) [0160.154] timeGetTime () returned 0x3a9f9 [0160.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.154] Sleep (dwMilliseconds=0xa) [0160.169] timeGetTime () returned 0x3aa09 [0160.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.169] Sleep (dwMilliseconds=0xa) [0160.185] timeGetTime () returned 0x3aa18 [0160.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.185] Sleep (dwMilliseconds=0xa) [0160.206] timeGetTime () returned 0x3aa28 [0160.206] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.206] Sleep (dwMilliseconds=0xa) [0160.232] timeGetTime () returned 0x3aa47 [0160.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.232] Sleep (dwMilliseconds=0xa) [0160.247] timeGetTime () returned 0x3aa57 [0160.247] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.247] Sleep (dwMilliseconds=0xa) [0160.263] timeGetTime () returned 0x3aa67 [0160.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.263] Sleep (dwMilliseconds=0xa) [0160.279] timeGetTime () returned 0x3aa76 [0160.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.279] Sleep (dwMilliseconds=0xa) [0160.294] timeGetTime () returned 0x3aa86 [0160.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.294] Sleep (dwMilliseconds=0xa) [0160.310] timeGetTime () returned 0x3aa95 [0160.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.310] Sleep (dwMilliseconds=0xa) [0160.326] timeGetTime () returned 0x3aaa5 [0160.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0160.326] TranslateMessage (lpMsg=0x8bf798) returned 0 [0160.326] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0160.326] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0160.326] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0160.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.326] Sleep (dwMilliseconds=0xa) [0160.341] timeGetTime () returned 0x3aab5 [0160.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.341] Sleep (dwMilliseconds=0xa) [0160.357] timeGetTime () returned 0x3aac4 [0160.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.357] Sleep (dwMilliseconds=0xa) [0160.375] timeGetTime () returned 0x3aad6 [0160.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.375] Sleep (dwMilliseconds=0xa) [0160.388] timeGetTime () returned 0x3aae4 [0160.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.388] Sleep (dwMilliseconds=0xa) [0160.404] timeGetTime () returned 0x3aaf3 [0160.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.404] Sleep (dwMilliseconds=0xa) [0160.419] timeGetTime () returned 0x3ab03 [0160.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.419] Sleep (dwMilliseconds=0xa) [0160.435] timeGetTime () returned 0x3ab12 [0160.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.435] Sleep (dwMilliseconds=0xa) [0160.451] timeGetTime () returned 0x3ab22 [0160.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.451] Sleep (dwMilliseconds=0xa) [0160.466] timeGetTime () returned 0x3ab32 [0160.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.466] Sleep (dwMilliseconds=0xa) [0160.503] timeGetTime () returned 0x3ab51 [0160.504] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.504] Sleep (dwMilliseconds=0xa) [0160.529] timeGetTime () returned 0x3ab70 [0160.529] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.529] Sleep (dwMilliseconds=0xa) [0160.544] timeGetTime () returned 0x3ab80 [0160.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.545] Sleep (dwMilliseconds=0xa) [0160.560] timeGetTime () returned 0x3ab90 [0160.560] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0160.560] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0160.560] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0160.560] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0160.560] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0160.561] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0160.561] RegCloseKey (hKey=0x240) returned 0x0 [0160.561] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0160.561] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0160.561] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0160.561] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0160.561] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0160.561] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0160.561] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0160.561] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0160.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0160.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0160.562] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0160.562] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0160.656] FreeLibrary (hLibModule=0x77150000) returned 1 [0160.656] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0160.656] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0160.656] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0160.656] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0160.656] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0160.656] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0160.656] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0160.657] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0160.657] timeGetTime () returned 0x3abed [0160.657] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.657] Sleep (dwMilliseconds=0xa) [0160.703] timeGetTime () returned 0x3ac1c [0160.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.703] Sleep (dwMilliseconds=0xa) [0160.747] timeGetTime () returned 0x3ac4b [0160.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.747] Sleep (dwMilliseconds=0xa) [0160.813] timeGetTime () returned 0x3ac89 [0160.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.813] Sleep (dwMilliseconds=0xa) [0160.878] timeGetTime () returned 0x3acc8 [0160.878] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.878] Sleep (dwMilliseconds=0xa) [0160.952] timeGetTime () returned 0x3ad16 [0160.952] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.952] Sleep (dwMilliseconds=0xa) [0160.971] timeGetTime () returned 0x3ad26 [0160.971] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.971] Sleep (dwMilliseconds=0xa) [0160.992] timeGetTime () returned 0x3ad35 [0160.992] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0160.992] Sleep (dwMilliseconds=0xa) [0161.013] timeGetTime () returned 0x3ad55 [0161.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.013] Sleep (dwMilliseconds=0xa) [0161.029] timeGetTime () returned 0x3ad64 [0161.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.029] Sleep (dwMilliseconds=0xa) [0161.045] timeGetTime () returned 0x3ad74 [0161.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.045] Sleep (dwMilliseconds=0xa) [0161.060] timeGetTime () returned 0x3ad83 [0161.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.060] Sleep (dwMilliseconds=0xa) [0161.076] timeGetTime () returned 0x3ad93 [0161.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0161.076] TranslateMessage (lpMsg=0x8bf798) returned 0 [0161.076] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0161.076] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0161.076] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0161.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.076] Sleep (dwMilliseconds=0xa) [0161.091] timeGetTime () returned 0x3ada3 [0161.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.091] Sleep (dwMilliseconds=0xa) [0161.107] timeGetTime () returned 0x3adb2 [0161.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.107] Sleep (dwMilliseconds=0xa) [0161.122] timeGetTime () returned 0x3adc2 [0161.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.122] Sleep (dwMilliseconds=0xa) [0161.138] timeGetTime () returned 0x3add2 [0161.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.138] Sleep (dwMilliseconds=0xa) [0161.154] timeGetTime () returned 0x3ade1 [0161.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.154] Sleep (dwMilliseconds=0xa) [0161.169] timeGetTime () returned 0x3adf1 [0161.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.169] Sleep (dwMilliseconds=0xa) [0161.185] timeGetTime () returned 0x3ae00 [0161.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.185] Sleep (dwMilliseconds=0xa) [0161.201] timeGetTime () returned 0x3ae10 [0161.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.201] Sleep (dwMilliseconds=0xa) [0161.227] timeGetTime () returned 0x3ae20 [0161.227] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.227] Sleep (dwMilliseconds=0xa) [0161.247] timeGetTime () returned 0x3ae3f [0161.247] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.247] Sleep (dwMilliseconds=0xa) [0161.263] timeGetTime () returned 0x3ae4f [0161.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.263] Sleep (dwMilliseconds=0xa) [0161.279] timeGetTime () returned 0x3ae5e [0161.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.279] Sleep (dwMilliseconds=0xa) [0161.294] timeGetTime () returned 0x3ae6e [0161.295] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.295] Sleep (dwMilliseconds=0xa) [0161.310] timeGetTime () returned 0x3ae7d [0161.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.310] Sleep (dwMilliseconds=0xa) [0161.325] timeGetTime () returned 0x3ae8d [0161.325] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.325] Sleep (dwMilliseconds=0xa) [0161.341] timeGetTime () returned 0x3ae9d [0161.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.341] Sleep (dwMilliseconds=0xa) [0161.357] timeGetTime () returned 0x3aeac [0161.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.357] Sleep (dwMilliseconds=0xa) [0161.372] timeGetTime () returned 0x3aebc [0161.372] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.372] Sleep (dwMilliseconds=0xa) [0161.388] timeGetTime () returned 0x3aecc [0161.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.388] Sleep (dwMilliseconds=0xa) [0161.404] timeGetTime () returned 0x3aedb [0161.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.404] Sleep (dwMilliseconds=0xa) [0161.419] timeGetTime () returned 0x3aeeb [0161.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.419] Sleep (dwMilliseconds=0xa) [0161.436] timeGetTime () returned 0x3aefb [0161.436] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.436] Sleep (dwMilliseconds=0xa) [0161.450] timeGetTime () returned 0x3af0a [0161.450] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.450] Sleep (dwMilliseconds=0xa) [0161.467] timeGetTime () returned 0x3af1a [0161.467] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.467] Sleep (dwMilliseconds=0xa) [0161.500] timeGetTime () returned 0x3af39 [0161.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.500] Sleep (dwMilliseconds=0xa) [0161.519] timeGetTime () returned 0x3af49 [0161.519] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.519] Sleep (dwMilliseconds=0xa) [0161.544] timeGetTime () returned 0x3af68 [0161.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.544] Sleep (dwMilliseconds=0xa) [0161.560] timeGetTime () returned 0x3af77 [0161.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.560] Sleep (dwMilliseconds=0xa) [0161.576] timeGetTime () returned 0x3af87 [0161.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.576] Sleep (dwMilliseconds=0xa) [0161.591] timeGetTime () returned 0x3af97 [0161.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.591] Sleep (dwMilliseconds=0xa) [0161.607] timeGetTime () returned 0x3afa6 [0161.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.607] Sleep (dwMilliseconds=0xa) [0161.622] timeGetTime () returned 0x3afb6 [0161.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.623] Sleep (dwMilliseconds=0xa) [0161.638] timeGetTime () returned 0x3afc6 [0161.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.638] Sleep (dwMilliseconds=0xa) [0161.654] timeGetTime () returned 0x3afd5 [0161.654] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0161.654] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0161.655] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0161.655] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0161.655] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0161.655] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0161.655] RegCloseKey (hKey=0x240) returned 0x0 [0161.655] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0161.655] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0161.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0161.655] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0161.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0161.655] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0161.655] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0161.656] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0161.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0161.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0161.656] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0161.656] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0161.748] FreeLibrary (hLibModule=0x77150000) returned 1 [0161.748] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0161.748] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0161.748] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0161.749] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0161.749] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0161.749] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0161.749] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0161.749] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0161.749] timeGetTime () returned 0x3b033 [0161.749] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.749] Sleep (dwMilliseconds=0xa) [0161.794] timeGetTime () returned 0x3b062 [0161.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.795] Sleep (dwMilliseconds=0xa) [0161.841] timeGetTime () returned 0x3b091 [0161.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0161.841] TranslateMessage (lpMsg=0x8bf798) returned 0 [0161.841] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0161.841] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0161.841] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0161.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.842] Sleep (dwMilliseconds=0xa) [0161.892] timeGetTime () returned 0x3b0c0 [0161.892] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.892] Sleep (dwMilliseconds=0xa) [0161.935] timeGetTime () returned 0x3b0ee [0161.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.935] Sleep (dwMilliseconds=0xa) [0161.982] timeGetTime () returned 0x3b11d [0161.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0161.982] Sleep (dwMilliseconds=0xa) [0162.001] timeGetTime () returned 0x3b12d [0162.001] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.001] Sleep (dwMilliseconds=0xa) [0162.013] timeGetTime () returned 0x3b13d [0162.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.013] Sleep (dwMilliseconds=0xa) [0162.029] timeGetTime () returned 0x3b14c [0162.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.029] Sleep (dwMilliseconds=0xa) [0162.054] timeGetTime () returned 0x3b15c [0162.054] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.054] Sleep (dwMilliseconds=0xa) [0162.087] timeGetTime () returned 0x3b17b [0162.087] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.087] Sleep (dwMilliseconds=0xa) [0162.107] timeGetTime () returned 0x3b19a [0162.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.107] Sleep (dwMilliseconds=0xa) [0162.123] timeGetTime () returned 0x3b1aa [0162.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.123] Sleep (dwMilliseconds=0xa) [0162.143] timeGetTime () returned 0x3b1ba [0162.143] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.143] Sleep (dwMilliseconds=0xa) [0162.154] timeGetTime () returned 0x3b1c9 [0162.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.154] Sleep (dwMilliseconds=0xa) [0162.169] timeGetTime () returned 0x3b1d9 [0162.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.169] Sleep (dwMilliseconds=0xa) [0162.185] timeGetTime () returned 0x3b1e8 [0162.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.185] Sleep (dwMilliseconds=0xa) [0162.201] timeGetTime () returned 0x3b1f8 [0162.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.201] Sleep (dwMilliseconds=0xa) [0162.216] timeGetTime () returned 0x3b208 [0162.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.216] Sleep (dwMilliseconds=0xa) [0162.232] timeGetTime () returned 0x3b217 [0162.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.232] Sleep (dwMilliseconds=0xa) [0162.247] timeGetTime () returned 0x3b227 [0162.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.248] Sleep (dwMilliseconds=0xa) [0162.263] timeGetTime () returned 0x3b237 [0162.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.263] Sleep (dwMilliseconds=0xa) [0162.279] timeGetTime () returned 0x3b246 [0162.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.279] Sleep (dwMilliseconds=0xa) [0162.294] timeGetTime () returned 0x3b256 [0162.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.294] Sleep (dwMilliseconds=0xa) [0162.310] timeGetTime () returned 0x3b265 [0162.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.310] Sleep (dwMilliseconds=0xa) [0162.327] timeGetTime () returned 0x3b276 [0162.327] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.327] Sleep (dwMilliseconds=0xa) [0162.341] timeGetTime () returned 0x3b285 [0162.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.341] Sleep (dwMilliseconds=0xa) [0162.357] timeGetTime () returned 0x3b294 [0162.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.357] Sleep (dwMilliseconds=0xa) [0162.373] timeGetTime () returned 0x3b2a4 [0162.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.373] Sleep (dwMilliseconds=0xa) [0162.388] timeGetTime () returned 0x3b2b4 [0162.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.388] Sleep (dwMilliseconds=0xa) [0162.404] timeGetTime () returned 0x3b2c3 [0162.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.404] Sleep (dwMilliseconds=0xa) [0162.419] timeGetTime () returned 0x3b2d3 [0162.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.419] Sleep (dwMilliseconds=0xa) [0162.435] timeGetTime () returned 0x3b2e2 [0162.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.435] Sleep (dwMilliseconds=0xa) [0162.451] timeGetTime () returned 0x3b2f2 [0162.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.451] Sleep (dwMilliseconds=0xa) [0162.466] timeGetTime () returned 0x3b302 [0162.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.466] Sleep (dwMilliseconds=0xa) [0162.500] timeGetTime () returned 0x3b321 [0162.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.500] Sleep (dwMilliseconds=0xa) [0162.520] timeGetTime () returned 0x3b331 [0162.520] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.520] Sleep (dwMilliseconds=0xa) [0162.544] timeGetTime () returned 0x3b350 [0162.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.544] Sleep (dwMilliseconds=0xa) [0162.560] timeGetTime () returned 0x3b35f [0162.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.560] Sleep (dwMilliseconds=0xa) [0162.576] timeGetTime () returned 0x3b36f [0162.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.576] Sleep (dwMilliseconds=0xa) [0162.591] timeGetTime () returned 0x3b37f [0162.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.591] Sleep (dwMilliseconds=0xa) [0162.607] timeGetTime () returned 0x3b38e [0162.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0162.607] TranslateMessage (lpMsg=0x8bf798) returned 0 [0162.607] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0162.607] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0162.607] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0162.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.607] Sleep (dwMilliseconds=0xa) [0162.622] timeGetTime () returned 0x3b39e [0162.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.622] Sleep (dwMilliseconds=0xa) [0162.638] timeGetTime () returned 0x3b3ae [0162.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.638] Sleep (dwMilliseconds=0xa) [0162.654] timeGetTime () returned 0x3b3bd [0162.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.654] Sleep (dwMilliseconds=0xa) [0162.669] timeGetTime () returned 0x3b3cd [0162.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.669] Sleep (dwMilliseconds=0xa) [0162.685] timeGetTime () returned 0x3b3dc [0162.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.685] Sleep (dwMilliseconds=0xa) [0162.701] timeGetTime () returned 0x3b3ec [0162.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.701] Sleep (dwMilliseconds=0xa) [0162.717] timeGetTime () returned 0x3b3fc [0162.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.717] Sleep (dwMilliseconds=0xa) [0162.732] timeGetTime () returned 0x3b40b [0162.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.732] Sleep (dwMilliseconds=0xa) [0162.747] timeGetTime () returned 0x3b41b [0162.747] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0162.747] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0162.748] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0162.748] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0162.748] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0162.748] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0162.748] RegCloseKey (hKey=0x240) returned 0x0 [0162.748] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0162.748] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0162.748] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0162.748] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0162.748] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0162.748] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0162.748] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0162.748] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0162.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0162.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0162.749] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0162.749] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0162.844] FreeLibrary (hLibModule=0x77150000) returned 1 [0162.844] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0162.844] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0162.844] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0162.844] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0162.844] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0162.845] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0162.845] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0162.845] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0162.845] timeGetTime () returned 0x3b479 [0162.845] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.845] Sleep (dwMilliseconds=0xa) [0162.888] timeGetTime () returned 0x3b4a8 [0162.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.888] Sleep (dwMilliseconds=0xa) [0162.935] timeGetTime () returned 0x3b4d6 [0162.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.935] Sleep (dwMilliseconds=0xa) [0162.983] timeGetTime () returned 0x3b505 [0162.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0162.984] Sleep (dwMilliseconds=0xa) [0163.029] timeGetTime () returned 0x3b534 [0163.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.029] Sleep (dwMilliseconds=0xa) [0163.075] timeGetTime () returned 0x3b563 [0163.075] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.075] Sleep (dwMilliseconds=0xa) [0163.093] timeGetTime () returned 0x3b573 [0163.093] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.093] Sleep (dwMilliseconds=0xa) [0163.107] timeGetTime () returned 0x3b582 [0163.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.107] Sleep (dwMilliseconds=0xa) [0163.122] timeGetTime () returned 0x3b592 [0163.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.122] Sleep (dwMilliseconds=0xa) [0163.147] timeGetTime () returned 0x3b5a2 [0163.147] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.147] Sleep (dwMilliseconds=0xa) [0163.185] timeGetTime () returned 0x3b5d0 [0163.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.185] Sleep (dwMilliseconds=0xa) [0163.201] timeGetTime () returned 0x3b5e0 [0163.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.201] Sleep (dwMilliseconds=0xa) [0163.216] timeGetTime () returned 0x3b5f0 [0163.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.216] Sleep (dwMilliseconds=0xa) [0163.232] timeGetTime () returned 0x3b5ff [0163.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.232] Sleep (dwMilliseconds=0xa) [0163.248] timeGetTime () returned 0x3b60f [0163.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.248] Sleep (dwMilliseconds=0xa) [0163.263] timeGetTime () returned 0x3b61f [0163.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.263] Sleep (dwMilliseconds=0xa) [0163.279] timeGetTime () returned 0x3b62e [0163.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.279] Sleep (dwMilliseconds=0xa) [0163.294] timeGetTime () returned 0x3b63e [0163.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.294] Sleep (dwMilliseconds=0xa) [0163.310] timeGetTime () returned 0x3b64d [0163.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.311] Sleep (dwMilliseconds=0xa) [0163.325] timeGetTime () returned 0x3b65d [0163.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.326] Sleep (dwMilliseconds=0xa) [0163.341] timeGetTime () returned 0x3b66d [0163.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.341] Sleep (dwMilliseconds=0xa) [0163.357] timeGetTime () returned 0x3b67c [0163.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.357] Sleep (dwMilliseconds=0xa) [0163.373] timeGetTime () returned 0x3b68c [0163.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0163.373] TranslateMessage (lpMsg=0x8bf798) returned 0 [0163.373] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0163.373] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0163.373] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0163.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.373] Sleep (dwMilliseconds=0xa) [0163.388] timeGetTime () returned 0x3b69c [0163.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.388] Sleep (dwMilliseconds=0xa) [0163.404] timeGetTime () returned 0x3b6ab [0163.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.404] Sleep (dwMilliseconds=0xa) [0163.419] timeGetTime () returned 0x3b6bb [0163.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.419] Sleep (dwMilliseconds=0xa) [0163.435] timeGetTime () returned 0x3b6ca [0163.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.435] Sleep (dwMilliseconds=0xa) [0163.451] timeGetTime () returned 0x3b6da [0163.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.451] Sleep (dwMilliseconds=0xa) [0163.468] timeGetTime () returned 0x3b6ea [0163.468] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.468] Sleep (dwMilliseconds=0xa) [0163.505] timeGetTime () returned 0x3b709 [0163.505] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.505] Sleep (dwMilliseconds=0xa) [0163.529] timeGetTime () returned 0x3b728 [0163.529] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.529] Sleep (dwMilliseconds=0xa) [0163.544] timeGetTime () returned 0x3b738 [0163.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.544] Sleep (dwMilliseconds=0xa) [0163.560] timeGetTime () returned 0x3b747 [0163.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.560] Sleep (dwMilliseconds=0xa) [0163.576] timeGetTime () returned 0x3b757 [0163.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.576] Sleep (dwMilliseconds=0xa) [0163.591] timeGetTime () returned 0x3b767 [0163.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.591] Sleep (dwMilliseconds=0xa) [0163.607] timeGetTime () returned 0x3b776 [0163.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.607] Sleep (dwMilliseconds=0xa) [0163.623] timeGetTime () returned 0x3b786 [0163.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.623] Sleep (dwMilliseconds=0xa) [0163.638] timeGetTime () returned 0x3b796 [0163.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.638] Sleep (dwMilliseconds=0xa) [0163.654] timeGetTime () returned 0x3b7a5 [0163.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.654] Sleep (dwMilliseconds=0xa) [0163.669] timeGetTime () returned 0x3b7b5 [0163.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.669] Sleep (dwMilliseconds=0xa) [0163.686] timeGetTime () returned 0x3b7c5 [0163.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.686] Sleep (dwMilliseconds=0xa) [0163.700] timeGetTime () returned 0x3b7d4 [0163.700] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.700] Sleep (dwMilliseconds=0xa) [0163.717] timeGetTime () returned 0x3b7e4 [0163.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.717] Sleep (dwMilliseconds=0xa) [0163.732] timeGetTime () returned 0x3b7f3 [0163.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.732] Sleep (dwMilliseconds=0xa) [0163.748] timeGetTime () returned 0x3b803 [0163.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.748] Sleep (dwMilliseconds=0xa) [0163.763] timeGetTime () returned 0x3b813 [0163.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.763] Sleep (dwMilliseconds=0xa) [0163.779] timeGetTime () returned 0x3b822 [0163.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.779] Sleep (dwMilliseconds=0xa) [0163.795] timeGetTime () returned 0x3b832 [0163.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.795] Sleep (dwMilliseconds=0xa) [0163.810] timeGetTime () returned 0x3b841 [0163.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.810] Sleep (dwMilliseconds=0xa) [0163.826] timeGetTime () returned 0x3b851 [0163.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.826] Sleep (dwMilliseconds=0xa) [0163.842] timeGetTime () returned 0x3b861 [0163.842] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0163.842] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0163.842] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0163.842] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0163.842] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0163.842] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0163.843] RegCloseKey (hKey=0x240) returned 0x0 [0163.843] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0163.843] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0163.843] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0163.843] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0163.843] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0163.843] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0163.843] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0163.843] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0163.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0163.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9b8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0163.844] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0163.844] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0163.951] FreeLibrary (hLibModule=0x77150000) returned 1 [0163.951] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0163.951] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0163.951] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0163.951] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0163.951] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0163.951] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0163.951] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0163.951] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0163.951] timeGetTime () returned 0x3b8ce [0163.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.951] Sleep (dwMilliseconds=0xa) [0163.998] timeGetTime () returned 0x3b8fd [0163.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0163.998] Sleep (dwMilliseconds=0xa) [0164.044] timeGetTime () returned 0x3b92c [0164.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.044] Sleep (dwMilliseconds=0xa) [0164.107] timeGetTime () returned 0x3b96a [0164.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.107] Sleep (dwMilliseconds=0xa) [0164.154] timeGetTime () returned 0x3b999 [0164.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0164.154] TranslateMessage (lpMsg=0x8bf798) returned 0 [0164.154] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0164.154] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0164.154] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0164.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.154] Sleep (dwMilliseconds=0xa) [0164.177] timeGetTime () returned 0x3b9a9 [0164.177] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.177] Sleep (dwMilliseconds=0xa) [0164.210] timeGetTime () returned 0x3b9c8 [0164.210] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.210] Sleep (dwMilliseconds=0xa) [0164.232] timeGetTime () returned 0x3b9e7 [0164.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.232] Sleep (dwMilliseconds=0xa) [0164.247] timeGetTime () returned 0x3b9f7 [0164.247] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.247] Sleep (dwMilliseconds=0xa) [0164.263] timeGetTime () returned 0x3ba07 [0164.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.263] Sleep (dwMilliseconds=0xa) [0164.279] timeGetTime () returned 0x3ba16 [0164.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.279] Sleep (dwMilliseconds=0xa) [0164.294] timeGetTime () returned 0x3ba26 [0164.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.294] Sleep (dwMilliseconds=0xa) [0164.310] timeGetTime () returned 0x3ba35 [0164.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.310] Sleep (dwMilliseconds=0xa) [0164.326] timeGetTime () returned 0x3ba46 [0164.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.326] Sleep (dwMilliseconds=0xa) [0164.341] timeGetTime () returned 0x3ba55 [0164.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.341] Sleep (dwMilliseconds=0xa) [0164.357] timeGetTime () returned 0x3ba64 [0164.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.357] Sleep (dwMilliseconds=0xa) [0164.372] timeGetTime () returned 0x3ba74 [0164.372] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.372] Sleep (dwMilliseconds=0xa) [0164.388] timeGetTime () returned 0x3ba84 [0164.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.388] Sleep (dwMilliseconds=0xa) [0164.405] timeGetTime () returned 0x3ba94 [0164.405] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.405] Sleep (dwMilliseconds=0xa) [0164.420] timeGetTime () returned 0x3baa3 [0164.420] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.420] Sleep (dwMilliseconds=0xa) [0164.436] timeGetTime () returned 0x3bab2 [0164.436] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.436] Sleep (dwMilliseconds=0xa) [0164.450] timeGetTime () returned 0x3bac2 [0164.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.451] Sleep (dwMilliseconds=0xa) [0164.466] timeGetTime () returned 0x3bad2 [0164.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.466] Sleep (dwMilliseconds=0xa) [0164.508] timeGetTime () returned 0x3baf1 [0164.508] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.508] Sleep (dwMilliseconds=0xa) [0164.529] timeGetTime () returned 0x3bb10 [0164.529] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.529] Sleep (dwMilliseconds=0xa) [0164.544] timeGetTime () returned 0x3bb20 [0164.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.544] Sleep (dwMilliseconds=0xa) [0164.560] timeGetTime () returned 0x3bb30 [0164.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.560] Sleep (dwMilliseconds=0xa) [0164.582] timeGetTime () returned 0x3bb3f [0164.582] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.582] Sleep (dwMilliseconds=0xa) [0164.607] timeGetTime () returned 0x3bb5e [0164.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.607] Sleep (dwMilliseconds=0xa) [0164.622] timeGetTime () returned 0x3bb6e [0164.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.622] Sleep (dwMilliseconds=0xa) [0164.638] timeGetTime () returned 0x3bb7e [0164.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.638] Sleep (dwMilliseconds=0xa) [0164.653] timeGetTime () returned 0x3bb8d [0164.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.654] Sleep (dwMilliseconds=0xa) [0164.669] timeGetTime () returned 0x3bb9d [0164.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.669] Sleep (dwMilliseconds=0xa) [0164.686] timeGetTime () returned 0x3bbac [0164.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.686] Sleep (dwMilliseconds=0xa) [0164.700] timeGetTime () returned 0x3bbbc [0164.700] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.701] Sleep (dwMilliseconds=0xa) [0164.717] timeGetTime () returned 0x3bbcc [0164.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.717] Sleep (dwMilliseconds=0xa) [0164.732] timeGetTime () returned 0x3bbdb [0164.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.732] Sleep (dwMilliseconds=0xa) [0164.748] timeGetTime () returned 0x3bbeb [0164.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.748] Sleep (dwMilliseconds=0xa) [0164.763] timeGetTime () returned 0x3bbfb [0164.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.763] Sleep (dwMilliseconds=0xa) [0164.778] timeGetTime () returned 0x3bc0a [0164.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.779] Sleep (dwMilliseconds=0xa) [0164.794] timeGetTime () returned 0x3bc1a [0164.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.794] Sleep (dwMilliseconds=0xa) [0164.887] timeGetTime () returned 0x3bc68 [0164.887] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.887] Sleep (dwMilliseconds=0xa) [0164.904] timeGetTime () returned 0x3bc87 [0164.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.904] Sleep (dwMilliseconds=0xa) [0164.919] timeGetTime () returned 0x3bc97 [0164.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0164.920] TranslateMessage (lpMsg=0x8bf798) returned 0 [0164.920] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0164.920] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0164.920] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0164.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.920] Sleep (dwMilliseconds=0xa) [0164.936] timeGetTime () returned 0x3bca6 [0164.936] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0164.936] Sleep (dwMilliseconds=0xa) [0164.950] timeGetTime () returned 0x3bcb6 [0164.951] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0164.951] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0164.951] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0164.951] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0164.951] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0164.951] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0164.951] RegCloseKey (hKey=0x240) returned 0x0 [0164.951] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0164.951] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0164.951] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0164.951] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0164.951] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0164.951] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0164.951] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0164.951] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0164.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0164.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0164.952] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0164.952] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0165.060] FreeLibrary (hLibModule=0x77150000) returned 1 [0165.060] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0165.060] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0165.060] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0165.060] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0165.060] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0165.061] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0165.061] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0165.061] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0165.061] timeGetTime () returned 0x3bd23 [0165.061] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.061] Sleep (dwMilliseconds=0xa) [0165.108] timeGetTime () returned 0x3bd54 [0165.108] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.108] Sleep (dwMilliseconds=0xa) [0165.154] timeGetTime () returned 0x3bd81 [0165.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.154] Sleep (dwMilliseconds=0xa) [0165.200] timeGetTime () returned 0x3bdb0 [0165.200] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.200] Sleep (dwMilliseconds=0xa) [0165.247] timeGetTime () returned 0x3bddf [0165.247] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.247] Sleep (dwMilliseconds=0xa) [0165.276] timeGetTime () returned 0x3bdef [0165.276] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.276] Sleep (dwMilliseconds=0xa) [0165.294] timeGetTime () returned 0x3be0e [0165.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.294] Sleep (dwMilliseconds=0xa) [0165.323] timeGetTime () returned 0x3be1d [0165.323] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.323] Sleep (dwMilliseconds=0xa) [0165.341] timeGetTime () returned 0x3be3d [0165.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.341] Sleep (dwMilliseconds=0xa) [0165.357] timeGetTime () returned 0x3be4c [0165.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.357] Sleep (dwMilliseconds=0xa) [0165.372] timeGetTime () returned 0x3be5c [0165.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.373] Sleep (dwMilliseconds=0xa) [0165.388] timeGetTime () returned 0x3be6c [0165.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.388] Sleep (dwMilliseconds=0xa) [0165.404] timeGetTime () returned 0x3be7b [0165.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.404] Sleep (dwMilliseconds=0xa) [0165.419] timeGetTime () returned 0x3be8b [0165.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.419] Sleep (dwMilliseconds=0xa) [0165.435] timeGetTime () returned 0x3be9a [0165.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.435] Sleep (dwMilliseconds=0xa) [0165.451] timeGetTime () returned 0x3beaa [0165.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.451] Sleep (dwMilliseconds=0xa) [0165.466] timeGetTime () returned 0x3beba [0165.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.466] Sleep (dwMilliseconds=0xa) [0165.533] timeGetTime () returned 0x3bef8 [0165.533] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.533] Sleep (dwMilliseconds=0xa) [0165.544] timeGetTime () returned 0x3bf08 [0165.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.544] Sleep (dwMilliseconds=0xa) [0165.560] timeGetTime () returned 0x3bf18 [0165.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.560] Sleep (dwMilliseconds=0xa) [0165.576] timeGetTime () returned 0x3bf27 [0165.576] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.576] Sleep (dwMilliseconds=0xa) [0165.592] timeGetTime () returned 0x3bf37 [0165.592] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.592] Sleep (dwMilliseconds=0xa) [0165.607] timeGetTime () returned 0x3bf46 [0165.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.608] Sleep (dwMilliseconds=0xa) [0165.622] timeGetTime () returned 0x3bf56 [0165.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.622] Sleep (dwMilliseconds=0xa) [0165.638] timeGetTime () returned 0x3bf66 [0165.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.638] Sleep (dwMilliseconds=0xa) [0165.654] timeGetTime () returned 0x3bf75 [0165.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.655] Sleep (dwMilliseconds=0xa) [0165.669] timeGetTime () returned 0x3bf85 [0165.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.669] Sleep (dwMilliseconds=0xa) [0165.685] timeGetTime () returned 0x3bf94 [0165.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0165.685] TranslateMessage (lpMsg=0x8bf798) returned 0 [0165.685] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0165.685] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0165.685] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0165.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.685] Sleep (dwMilliseconds=0xa) [0165.700] timeGetTime () returned 0x3bfa4 [0165.700] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.700] Sleep (dwMilliseconds=0xa) [0165.719] timeGetTime () returned 0x3bfb4 [0165.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.719] Sleep (dwMilliseconds=0xa) [0165.732] timeGetTime () returned 0x3bfc3 [0165.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.732] Sleep (dwMilliseconds=0xa) [0165.747] timeGetTime () returned 0x3bfd3 [0165.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.747] Sleep (dwMilliseconds=0xa) [0165.763] timeGetTime () returned 0x3bfe3 [0165.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.763] Sleep (dwMilliseconds=0xa) [0165.779] timeGetTime () returned 0x3bff2 [0165.780] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.780] Sleep (dwMilliseconds=0xa) [0165.794] timeGetTime () returned 0x3c002 [0165.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.794] Sleep (dwMilliseconds=0xa) [0165.811] timeGetTime () returned 0x3c013 [0165.811] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.812] Sleep (dwMilliseconds=0xa) [0165.826] timeGetTime () returned 0x3c021 [0165.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.826] Sleep (dwMilliseconds=0xa) [0165.841] timeGetTime () returned 0x3c031 [0165.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.842] Sleep (dwMilliseconds=0xa) [0165.857] timeGetTime () returned 0x3c040 [0165.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.857] Sleep (dwMilliseconds=0xa) [0165.873] timeGetTime () returned 0x3c050 [0165.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.873] Sleep (dwMilliseconds=0xa) [0165.890] timeGetTime () returned 0x3c060 [0165.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.890] Sleep (dwMilliseconds=0xa) [0165.972] timeGetTime () returned 0x3c0ae [0165.972] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0165.972] Sleep (dwMilliseconds=0xa) [0166.012] timeGetTime () returned 0x3c0cd [0166.012] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.012] Sleep (dwMilliseconds=0xa) [0166.030] timeGetTime () returned 0x3c0ec [0166.030] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.030] Sleep (dwMilliseconds=0xa) [0166.050] timeGetTime () returned 0x3c0fc [0166.050] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.050] Sleep (dwMilliseconds=0xa) [0166.077] timeGetTime () returned 0x3c11b [0166.077] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0166.078] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0166.078] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0166.078] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0166.078] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0166.078] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0166.078] RegCloseKey (hKey=0x240) returned 0x0 [0166.078] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0166.078] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0166.078] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0166.078] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0166.078] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0166.078] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0166.078] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0166.079] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0166.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0166.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0166.079] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0166.079] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0166.173] FreeLibrary (hLibModule=0x77150000) returned 1 [0166.173] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0166.173] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0166.173] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0166.173] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0166.173] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0166.173] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0166.173] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0166.173] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0166.173] timeGetTime () returned 0x3c179 [0166.173] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.173] Sleep (dwMilliseconds=0xa) [0166.219] timeGetTime () returned 0x3c1a8 [0166.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.219] Sleep (dwMilliseconds=0xa) [0166.263] timeGetTime () returned 0x3c1d7 [0166.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.263] Sleep (dwMilliseconds=0xa) [0166.310] timeGetTime () returned 0x3c205 [0166.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.311] Sleep (dwMilliseconds=0xa) [0166.357] timeGetTime () returned 0x3c234 [0166.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.357] Sleep (dwMilliseconds=0xa) [0166.404] timeGetTime () returned 0x3c263 [0166.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.404] Sleep (dwMilliseconds=0xa) [0166.450] timeGetTime () returned 0x3c292 [0166.450] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0166.452] TranslateMessage (lpMsg=0x8bf798) returned 0 [0166.452] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0166.452] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0166.452] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0166.452] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.452] Sleep (dwMilliseconds=0xa) [0166.466] timeGetTime () returned 0x3c2a2 [0166.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.466] Sleep (dwMilliseconds=0xa) [0166.530] timeGetTime () returned 0x3c2e1 [0166.530] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.530] Sleep (dwMilliseconds=0xa) [0166.544] timeGetTime () returned 0x3c2f0 [0166.544] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.544] Sleep (dwMilliseconds=0xa) [0166.569] timeGetTime () returned 0x3c2ff [0166.569] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.569] Sleep (dwMilliseconds=0xa) [0166.591] timeGetTime () returned 0x3c31f [0166.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.591] Sleep (dwMilliseconds=0xa) [0166.607] timeGetTime () returned 0x3c32e [0166.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.607] Sleep (dwMilliseconds=0xa) [0166.622] timeGetTime () returned 0x3c33e [0166.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.622] Sleep (dwMilliseconds=0xa) [0166.638] timeGetTime () returned 0x3c34e [0166.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.638] Sleep (dwMilliseconds=0xa) [0166.654] timeGetTime () returned 0x3c35d [0166.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.654] Sleep (dwMilliseconds=0xa) [0166.669] timeGetTime () returned 0x3c36d [0166.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.669] Sleep (dwMilliseconds=0xa) [0166.685] timeGetTime () returned 0x3c37c [0166.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.685] Sleep (dwMilliseconds=0xa) [0166.700] timeGetTime () returned 0x3c38c [0166.700] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.700] Sleep (dwMilliseconds=0xa) [0166.717] timeGetTime () returned 0x3c39c [0166.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.717] Sleep (dwMilliseconds=0xa) [0166.732] timeGetTime () returned 0x3c3ab [0166.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.732] Sleep (dwMilliseconds=0xa) [0166.747] timeGetTime () returned 0x3c3bb [0166.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.747] Sleep (dwMilliseconds=0xa) [0166.763] timeGetTime () returned 0x3c3cb [0166.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.763] Sleep (dwMilliseconds=0xa) [0166.779] timeGetTime () returned 0x3c3da [0166.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.779] Sleep (dwMilliseconds=0xa) [0166.794] timeGetTime () returned 0x3c3ea [0166.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.794] Sleep (dwMilliseconds=0xa) [0166.811] timeGetTime () returned 0x3c3f9 [0166.811] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.812] Sleep (dwMilliseconds=0xa) [0166.826] timeGetTime () returned 0x3c409 [0166.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.826] Sleep (dwMilliseconds=0xa) [0166.841] timeGetTime () returned 0x3c419 [0166.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.841] Sleep (dwMilliseconds=0xa) [0166.857] timeGetTime () returned 0x3c428 [0166.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.857] Sleep (dwMilliseconds=0xa) [0166.872] timeGetTime () returned 0x3c438 [0166.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.872] Sleep (dwMilliseconds=0xa) [0166.888] timeGetTime () returned 0x3c448 [0166.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.888] Sleep (dwMilliseconds=0xa) [0166.904] timeGetTime () returned 0x3c457 [0166.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.904] Sleep (dwMilliseconds=0xa) [0166.919] timeGetTime () returned 0x3c467 [0166.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.919] Sleep (dwMilliseconds=0xa) [0166.935] timeGetTime () returned 0x3c476 [0166.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.935] Sleep (dwMilliseconds=0xa) [0166.951] timeGetTime () returned 0x3c486 [0166.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.951] Sleep (dwMilliseconds=0xa) [0166.967] timeGetTime () returned 0x3c496 [0166.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.967] Sleep (dwMilliseconds=0xa) [0166.982] timeGetTime () returned 0x3c4a5 [0166.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.982] Sleep (dwMilliseconds=0xa) [0166.997] timeGetTime () returned 0x3c4b5 [0166.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0166.997] Sleep (dwMilliseconds=0xa) [0167.013] timeGetTime () returned 0x3c4c5 [0167.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.013] Sleep (dwMilliseconds=0xa) [0167.029] timeGetTime () returned 0x3c4d4 [0167.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.029] Sleep (dwMilliseconds=0xa) [0167.044] timeGetTime () returned 0x3c4e4 [0167.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.044] Sleep (dwMilliseconds=0xa) [0167.060] timeGetTime () returned 0x3c4f3 [0167.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.060] Sleep (dwMilliseconds=0xa) [0167.076] timeGetTime () returned 0x3c503 [0167.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.076] Sleep (dwMilliseconds=0xa) [0167.091] timeGetTime () returned 0x3c513 [0167.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.091] Sleep (dwMilliseconds=0xa) [0167.107] timeGetTime () returned 0x3c522 [0167.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.107] Sleep (dwMilliseconds=0xa) [0167.122] timeGetTime () returned 0x3c532 [0167.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.122] Sleep (dwMilliseconds=0xa) [0167.138] timeGetTime () returned 0x3c542 [0167.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.138] Sleep (dwMilliseconds=0xa) [0167.154] timeGetTime () returned 0x3c551 [0167.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.154] Sleep (dwMilliseconds=0xa) [0167.170] timeGetTime () returned 0x3c561 [0167.171] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0167.171] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0167.171] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0167.171] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0167.171] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0167.171] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0167.171] RegCloseKey (hKey=0x240) returned 0x0 [0167.171] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0167.171] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0167.171] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0167.171] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0167.171] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0167.171] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0167.172] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0167.172] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0167.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0167.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0167.172] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0167.172] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0167.266] FreeLibrary (hLibModule=0x77150000) returned 1 [0167.266] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0167.266] TranslateMessage (lpMsg=0x8bf708) returned 0 [0167.266] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0167.266] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0167.266] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0167.266] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0167.266] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0167.266] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0167.266] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0167.266] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0167.266] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0167.266] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0167.266] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0167.267] timeGetTime () returned 0x3c5bf [0167.267] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.267] Sleep (dwMilliseconds=0xa) [0167.310] timeGetTime () returned 0x3c5ed [0167.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.310] Sleep (dwMilliseconds=0xa) [0167.357] timeGetTime () returned 0x3c61c [0167.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.357] Sleep (dwMilliseconds=0xa) [0167.405] timeGetTime () returned 0x3c64b [0167.405] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.406] Sleep (dwMilliseconds=0xa) [0167.451] timeGetTime () returned 0x3c67a [0167.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.451] Sleep (dwMilliseconds=0xa) [0167.545] timeGetTime () returned 0x3c6d8 [0167.545] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.545] Sleep (dwMilliseconds=0xa) [0167.560] timeGetTime () returned 0x3c6e7 [0167.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.560] Sleep (dwMilliseconds=0xa) [0167.586] timeGetTime () returned 0x3c6f7 [0167.586] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.586] Sleep (dwMilliseconds=0xa) [0167.619] timeGetTime () returned 0x3c716 [0167.619] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.619] Sleep (dwMilliseconds=0xa) [0167.638] timeGetTime () returned 0x3c736 [0167.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.638] Sleep (dwMilliseconds=0xa) [0167.654] timeGetTime () returned 0x3c745 [0167.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.654] Sleep (dwMilliseconds=0xa) [0167.669] timeGetTime () returned 0x3c755 [0167.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.669] Sleep (dwMilliseconds=0xa) [0167.685] timeGetTime () returned 0x3c764 [0167.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.685] Sleep (dwMilliseconds=0xa) [0167.700] timeGetTime () returned 0x3c774 [0167.700] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.701] Sleep (dwMilliseconds=0xa) [0167.717] timeGetTime () returned 0x3c784 [0167.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.717] Sleep (dwMilliseconds=0xa) [0167.732] timeGetTime () returned 0x3c793 [0167.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.732] Sleep (dwMilliseconds=0xa) [0167.747] timeGetTime () returned 0x3c7a3 [0167.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.747] Sleep (dwMilliseconds=0xa) [0167.763] timeGetTime () returned 0x3c7b3 [0167.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.763] Sleep (dwMilliseconds=0xa) [0167.779] timeGetTime () returned 0x3c7c2 [0167.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.779] Sleep (dwMilliseconds=0xa) [0167.794] timeGetTime () returned 0x3c7d2 [0167.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.794] Sleep (dwMilliseconds=0xa) [0167.810] timeGetTime () returned 0x3c7e1 [0167.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.810] Sleep (dwMilliseconds=0xa) [0167.826] timeGetTime () returned 0x3c7f1 [0167.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.826] Sleep (dwMilliseconds=0xa) [0167.841] timeGetTime () returned 0x3c801 [0167.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.841] Sleep (dwMilliseconds=0xa) [0167.857] timeGetTime () returned 0x3c810 [0167.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.857] Sleep (dwMilliseconds=0xa) [0167.872] timeGetTime () returned 0x3c820 [0167.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.873] Sleep (dwMilliseconds=0xa) [0167.888] timeGetTime () returned 0x3c830 [0167.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.888] Sleep (dwMilliseconds=0xa) [0167.904] timeGetTime () returned 0x3c83f [0167.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.904] Sleep (dwMilliseconds=0xa) [0167.919] timeGetTime () returned 0x3c84f [0167.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.919] Sleep (dwMilliseconds=0xa) [0167.935] timeGetTime () returned 0x3c85e [0167.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.935] Sleep (dwMilliseconds=0xa) [0167.950] timeGetTime () returned 0x3c86e [0167.950] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.950] Sleep (dwMilliseconds=0xa) [0167.971] timeGetTime () returned 0x3c87e [0167.971] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.971] Sleep (dwMilliseconds=0xa) [0167.982] timeGetTime () returned 0x3c88d [0167.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.982] Sleep (dwMilliseconds=0xa) [0167.997] timeGetTime () returned 0x3c89d [0167.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0167.997] Sleep (dwMilliseconds=0xa) [0168.013] timeGetTime () returned 0x3c8ad [0168.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0168.013] TranslateMessage (lpMsg=0x8bf798) returned 0 [0168.013] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0168.013] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0168.013] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0168.014] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.014] Sleep (dwMilliseconds=0xa) [0168.029] timeGetTime () returned 0x3c8bd [0168.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.029] Sleep (dwMilliseconds=0xa) [0168.044] timeGetTime () returned 0x3c8cc [0168.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.045] Sleep (dwMilliseconds=0xa) [0168.060] timeGetTime () returned 0x3c8db [0168.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.060] Sleep (dwMilliseconds=0xa) [0168.075] timeGetTime () returned 0x3c8eb [0168.075] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.075] Sleep (dwMilliseconds=0xa) [0168.091] timeGetTime () returned 0x3c8fb [0168.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.091] Sleep (dwMilliseconds=0xa) [0168.108] timeGetTime () returned 0x3c90a [0168.108] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.108] Sleep (dwMilliseconds=0xa) [0168.122] timeGetTime () returned 0x3c91a [0168.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.122] Sleep (dwMilliseconds=0xa) [0168.138] timeGetTime () returned 0x3c92a [0168.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.138] Sleep (dwMilliseconds=0xa) [0168.154] timeGetTime () returned 0x3c939 [0168.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.154] Sleep (dwMilliseconds=0xa) [0168.170] timeGetTime () returned 0x3c949 [0168.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.170] Sleep (dwMilliseconds=0xa) [0168.185] timeGetTime () returned 0x3c958 [0168.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.185] Sleep (dwMilliseconds=0xa) [0168.200] timeGetTime () returned 0x3c968 [0168.200] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.201] Sleep (dwMilliseconds=0xa) [0168.216] timeGetTime () returned 0x3c978 [0168.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.216] Sleep (dwMilliseconds=0xa) [0168.232] timeGetTime () returned 0x3c987 [0168.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.232] Sleep (dwMilliseconds=0xa) [0168.247] timeGetTime () returned 0x3c997 [0168.247] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.247] Sleep (dwMilliseconds=0xa) [0168.263] timeGetTime () returned 0x3c9a7 [0168.263] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0168.263] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0168.264] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0168.264] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0168.264] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0168.264] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0168.264] RegCloseKey (hKey=0x240) returned 0x0 [0168.264] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0168.264] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0168.264] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0168.264] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0168.264] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0168.264] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0168.264] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0168.264] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0168.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0168.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0168.265] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0168.265] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0168.357] FreeLibrary (hLibModule=0x77150000) returned 1 [0168.357] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0168.357] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0168.357] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0168.357] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0168.357] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0168.357] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0168.358] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0168.358] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0168.358] timeGetTime () returned 0x3ca04 [0168.358] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.358] Sleep (dwMilliseconds=0xa) [0168.404] timeGetTime () returned 0x3ca33 [0168.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.404] Sleep (dwMilliseconds=0xa) [0168.451] timeGetTime () returned 0x3ca62 [0168.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.451] Sleep (dwMilliseconds=0xa) [0168.535] timeGetTime () returned 0x3cab0 [0168.535] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.535] Sleep (dwMilliseconds=0xa) [0168.578] timeGetTime () returned 0x3cadf [0168.578] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.578] Sleep (dwMilliseconds=0xa) [0168.622] timeGetTime () returned 0x3cb0e [0168.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.623] Sleep (dwMilliseconds=0xa) [0168.669] timeGetTime () returned 0x3cb3d [0168.669] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.669] Sleep (dwMilliseconds=0xa) [0168.685] timeGetTime () returned 0x3cb4c [0168.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.686] Sleep (dwMilliseconds=0xa) [0168.712] timeGetTime () returned 0x3cb5d [0168.712] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.712] Sleep (dwMilliseconds=0xa) [0168.746] timeGetTime () returned 0x3cb7b [0168.746] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.746] Sleep (dwMilliseconds=0xa) [0168.764] timeGetTime () returned 0x3cb9b [0168.764] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0168.764] TranslateMessage (lpMsg=0x8bf798) returned 0 [0168.764] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0168.764] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0168.764] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0168.764] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.764] Sleep (dwMilliseconds=0xa) [0168.779] timeGetTime () returned 0x3cbaa [0168.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.779] Sleep (dwMilliseconds=0xa) [0168.795] timeGetTime () returned 0x3cbba [0168.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.795] Sleep (dwMilliseconds=0xa) [0168.810] timeGetTime () returned 0x3cbc9 [0168.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.810] Sleep (dwMilliseconds=0xa) [0168.826] timeGetTime () returned 0x3cbd9 [0168.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.826] Sleep (dwMilliseconds=0xa) [0168.842] timeGetTime () returned 0x3cbe9 [0168.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.842] Sleep (dwMilliseconds=0xa) [0168.857] timeGetTime () returned 0x3cbf8 [0168.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.857] Sleep (dwMilliseconds=0xa) [0168.873] timeGetTime () returned 0x3cc08 [0168.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.873] Sleep (dwMilliseconds=0xa) [0168.888] timeGetTime () returned 0x3cc18 [0168.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.888] Sleep (dwMilliseconds=0xa) [0168.904] timeGetTime () returned 0x3cc27 [0168.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.904] Sleep (dwMilliseconds=0xa) [0168.919] timeGetTime () returned 0x3cc37 [0168.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.919] Sleep (dwMilliseconds=0xa) [0168.935] timeGetTime () returned 0x3cc46 [0168.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.935] Sleep (dwMilliseconds=0xa) [0168.951] timeGetTime () returned 0x3cc56 [0168.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.951] Sleep (dwMilliseconds=0xa) [0168.966] timeGetTime () returned 0x3cc66 [0168.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.966] Sleep (dwMilliseconds=0xa) [0168.982] timeGetTime () returned 0x3cc75 [0168.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.982] Sleep (dwMilliseconds=0xa) [0168.998] timeGetTime () returned 0x3cc85 [0168.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0168.998] Sleep (dwMilliseconds=0xa) [0169.013] timeGetTime () returned 0x3cc95 [0169.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.013] Sleep (dwMilliseconds=0xa) [0169.029] timeGetTime () returned 0x3cca4 [0169.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.029] Sleep (dwMilliseconds=0xa) [0169.045] timeGetTime () returned 0x3ccb4 [0169.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.045] Sleep (dwMilliseconds=0xa) [0169.061] timeGetTime () returned 0x3ccc3 [0169.061] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.061] Sleep (dwMilliseconds=0xa) [0169.075] timeGetTime () returned 0x3ccd3 [0169.075] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.076] Sleep (dwMilliseconds=0xa) [0169.091] timeGetTime () returned 0x3cce3 [0169.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.091] Sleep (dwMilliseconds=0xa) [0169.107] timeGetTime () returned 0x3ccf2 [0169.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.107] Sleep (dwMilliseconds=0xa) [0169.123] timeGetTime () returned 0x3cd02 [0169.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.123] Sleep (dwMilliseconds=0xa) [0169.138] timeGetTime () returned 0x3cd12 [0169.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.138] Sleep (dwMilliseconds=0xa) [0169.154] timeGetTime () returned 0x3cd21 [0169.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.154] Sleep (dwMilliseconds=0xa) [0169.169] timeGetTime () returned 0x3cd31 [0169.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.169] Sleep (dwMilliseconds=0xa) [0169.185] timeGetTime () returned 0x3cd40 [0169.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.185] Sleep (dwMilliseconds=0xa) [0169.200] timeGetTime () returned 0x3cd50 [0169.200] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.200] Sleep (dwMilliseconds=0xa) [0169.216] timeGetTime () returned 0x3cd60 [0169.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.216] Sleep (dwMilliseconds=0xa) [0169.232] timeGetTime () returned 0x3cd6f [0169.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.232] Sleep (dwMilliseconds=0xa) [0169.247] timeGetTime () returned 0x3cd7f [0169.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.248] Sleep (dwMilliseconds=0xa) [0169.263] timeGetTime () returned 0x3cd8f [0169.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.263] Sleep (dwMilliseconds=0xa) [0169.280] timeGetTime () returned 0x3cd9e [0169.280] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.280] Sleep (dwMilliseconds=0xa) [0169.294] timeGetTime () returned 0x3cdae [0169.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.294] Sleep (dwMilliseconds=0xa) [0169.310] timeGetTime () returned 0x3cdbd [0169.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.310] Sleep (dwMilliseconds=0xa) [0169.325] timeGetTime () returned 0x3cdcd [0169.325] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.325] Sleep (dwMilliseconds=0xa) [0169.341] timeGetTime () returned 0x3cddd [0169.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.341] Sleep (dwMilliseconds=0xa) [0169.366] timeGetTime () returned 0x3cdec [0169.366] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0169.366] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0169.366] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0169.366] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0169.366] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0169.366] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0169.366] RegCloseKey (hKey=0x240) returned 0x0 [0169.366] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0169.366] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0169.366] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0169.366] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0169.366] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0169.366] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0169.367] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0169.367] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0169.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0169.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abf8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0169.367] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0169.367] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0169.452] FreeLibrary (hLibModule=0x77150000) returned 1 [0169.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0169.453] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0169.453] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0169.453] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0169.453] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0169.453] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0169.453] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0169.453] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0169.453] timeGetTime () returned 0x3ce4a [0169.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.453] Sleep (dwMilliseconds=0xa) [0169.537] timeGetTime () returned 0x3ce98 [0169.537] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0169.537] TranslateMessage (lpMsg=0x8bf798) returned 0 [0169.537] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0169.537] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0169.537] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0169.537] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.537] Sleep (dwMilliseconds=0xa) [0169.576] timeGetTime () returned 0x3cec7 [0169.577] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.577] Sleep (dwMilliseconds=0xa) [0169.636] timeGetTime () returned 0x3cef6 [0169.636] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.636] Sleep (dwMilliseconds=0xa) [0169.728] timeGetTime () returned 0x3cf54 [0169.729] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.731] Sleep (dwMilliseconds=0xa) [0169.748] timeGetTime () returned 0x3cf73 [0169.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.748] Sleep (dwMilliseconds=0xa) [0169.764] timeGetTime () returned 0x3cf83 [0169.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.765] Sleep (dwMilliseconds=0xa) [0169.779] timeGetTime () returned 0x3cf92 [0169.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.779] Sleep (dwMilliseconds=0xa) [0169.803] timeGetTime () returned 0x3cfa2 [0169.803] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.803] Sleep (dwMilliseconds=0xa) [0169.835] timeGetTime () returned 0x3cfc1 [0169.835] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.835] Sleep (dwMilliseconds=0xa) [0169.857] timeGetTime () returned 0x3cfe0 [0169.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.857] Sleep (dwMilliseconds=0xa) [0169.884] timeGetTime () returned 0x3cff1 [0169.884] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.884] Sleep (dwMilliseconds=0xa) [0169.904] timeGetTime () returned 0x3d00f [0169.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.904] Sleep (dwMilliseconds=0xa) [0169.934] timeGetTime () returned 0x3d01f [0169.934] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.934] Sleep (dwMilliseconds=0xa) [0169.951] timeGetTime () returned 0x3d03e [0169.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.951] Sleep (dwMilliseconds=0xa) [0169.966] timeGetTime () returned 0x3d04e [0169.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.966] Sleep (dwMilliseconds=0xa) [0169.982] timeGetTime () returned 0x3d05d [0169.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.982] Sleep (dwMilliseconds=0xa) [0169.999] timeGetTime () returned 0x3d06d [0169.999] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0169.999] Sleep (dwMilliseconds=0xa) [0170.013] timeGetTime () returned 0x3d07d [0170.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.013] Sleep (dwMilliseconds=0xa) [0170.029] timeGetTime () returned 0x3d08c [0170.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.029] Sleep (dwMilliseconds=0xa) [0170.050] timeGetTime () returned 0x3d09c [0170.050] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.050] Sleep (dwMilliseconds=0xa) [0170.076] timeGetTime () returned 0x3d0bb [0170.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.076] Sleep (dwMilliseconds=0xa) [0170.091] timeGetTime () returned 0x3d0cb [0170.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.091] Sleep (dwMilliseconds=0xa) [0170.107] timeGetTime () returned 0x3d0da [0170.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.107] Sleep (dwMilliseconds=0xa) [0170.123] timeGetTime () returned 0x3d0ea [0170.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.123] Sleep (dwMilliseconds=0xa) [0170.138] timeGetTime () returned 0x3d0fa [0170.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.138] Sleep (dwMilliseconds=0xa) [0170.154] timeGetTime () returned 0x3d109 [0170.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.154] Sleep (dwMilliseconds=0xa) [0170.169] timeGetTime () returned 0x3d119 [0170.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.169] Sleep (dwMilliseconds=0xa) [0170.185] timeGetTime () returned 0x3d128 [0170.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.185] Sleep (dwMilliseconds=0xa) [0170.200] timeGetTime () returned 0x3d138 [0170.200] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.201] Sleep (dwMilliseconds=0xa) [0170.216] timeGetTime () returned 0x3d148 [0170.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.216] Sleep (dwMilliseconds=0xa) [0170.232] timeGetTime () returned 0x3d157 [0170.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.232] Sleep (dwMilliseconds=0xa) [0170.248] timeGetTime () returned 0x3d167 [0170.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.248] Sleep (dwMilliseconds=0xa) [0170.264] timeGetTime () returned 0x3d177 [0170.264] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.264] Sleep (dwMilliseconds=0xa) [0170.279] timeGetTime () returned 0x3d186 [0170.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.279] Sleep (dwMilliseconds=0xa) [0170.294] timeGetTime () returned 0x3d196 [0170.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0170.294] TranslateMessage (lpMsg=0x8bf798) returned 0 [0170.294] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0170.294] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0170.295] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0170.295] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.295] Sleep (dwMilliseconds=0xa) [0170.311] timeGetTime () returned 0x3d1a5 [0170.311] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.311] Sleep (dwMilliseconds=0xa) [0170.326] timeGetTime () returned 0x3d1b5 [0170.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.326] Sleep (dwMilliseconds=0xa) [0170.341] timeGetTime () returned 0x3d1c5 [0170.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.341] Sleep (dwMilliseconds=0xa) [0170.357] timeGetTime () returned 0x3d1d4 [0170.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.357] Sleep (dwMilliseconds=0xa) [0170.373] timeGetTime () returned 0x3d1e4 [0170.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.373] Sleep (dwMilliseconds=0xa) [0170.388] timeGetTime () returned 0x3d1f4 [0170.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.388] Sleep (dwMilliseconds=0xa) [0170.404] timeGetTime () returned 0x3d203 [0170.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.404] Sleep (dwMilliseconds=0xa) [0170.419] timeGetTime () returned 0x3d213 [0170.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.419] Sleep (dwMilliseconds=0xa) [0170.435] timeGetTime () returned 0x3d222 [0170.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.435] Sleep (dwMilliseconds=0xa) [0170.451] timeGetTime () returned 0x3d232 [0170.451] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0170.451] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0170.451] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0170.451] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0170.451] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0170.451] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0170.451] RegCloseKey (hKey=0x240) returned 0x0 [0170.451] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0170.451] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0170.451] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0170.452] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0170.452] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0170.452] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0170.452] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0170.452] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0170.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0170.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0170.452] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0170.452] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0170.591] FreeLibrary (hLibModule=0x77150000) returned 1 [0170.591] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0170.591] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0170.591] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0170.591] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0170.592] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0170.592] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0170.592] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0170.592] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0170.592] timeGetTime () returned 0x3d2bf [0170.592] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.592] Sleep (dwMilliseconds=0xa) [0170.639] timeGetTime () returned 0x3d2ee [0170.639] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.639] Sleep (dwMilliseconds=0xa) [0170.685] timeGetTime () returned 0x3d31c [0170.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.685] Sleep (dwMilliseconds=0xa) [0170.732] timeGetTime () returned 0x3d34b [0170.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.732] Sleep (dwMilliseconds=0xa) [0170.779] timeGetTime () returned 0x3d37a [0170.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.779] Sleep (dwMilliseconds=0xa) [0170.825] timeGetTime () returned 0x3d3a9 [0170.825] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.825] Sleep (dwMilliseconds=0xa) [0170.844] timeGetTime () returned 0x3d3b9 [0170.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.844] Sleep (dwMilliseconds=0xa) [0170.857] timeGetTime () returned 0x3d3c8 [0170.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.857] Sleep (dwMilliseconds=0xa) [0170.873] timeGetTime () returned 0x3d3d8 [0170.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.873] Sleep (dwMilliseconds=0xa) [0170.888] timeGetTime () returned 0x3d3e8 [0170.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.888] Sleep (dwMilliseconds=0xa) [0170.916] timeGetTime () returned 0x3d3f7 [0170.916] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.916] Sleep (dwMilliseconds=0xa) [0170.935] timeGetTime () returned 0x3d416 [0170.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.935] Sleep (dwMilliseconds=0xa) [0170.951] timeGetTime () returned 0x3d426 [0170.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.951] Sleep (dwMilliseconds=0xa) [0170.967] timeGetTime () returned 0x3d436 [0170.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.967] Sleep (dwMilliseconds=0xa) [0170.986] timeGetTime () returned 0x3d445 [0170.986] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0170.986] Sleep (dwMilliseconds=0xa) [0171.089] timeGetTime () returned 0x3d4a3 [0171.089] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0171.089] TranslateMessage (lpMsg=0x8bf798) returned 0 [0171.089] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0171.089] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0171.089] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0171.089] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.090] Sleep (dwMilliseconds=0xa) [0171.117] timeGetTime () returned 0x3d4c2 [0171.117] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.118] Sleep (dwMilliseconds=0xa) [0171.138] timeGetTime () returned 0x3d4e2 [0171.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.138] Sleep (dwMilliseconds=0xa) [0171.154] timeGetTime () returned 0x3d4f1 [0171.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.154] Sleep (dwMilliseconds=0xa) [0171.171] timeGetTime () returned 0x3d501 [0171.171] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.171] Sleep (dwMilliseconds=0xa) [0171.185] timeGetTime () returned 0x3d510 [0171.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.185] Sleep (dwMilliseconds=0xa) [0171.201] timeGetTime () returned 0x3d520 [0171.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.201] Sleep (dwMilliseconds=0xa) [0171.216] timeGetTime () returned 0x3d530 [0171.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.216] Sleep (dwMilliseconds=0xa) [0171.232] timeGetTime () returned 0x3d53f [0171.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.232] Sleep (dwMilliseconds=0xa) [0171.247] timeGetTime () returned 0x3d54f [0171.247] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.247] Sleep (dwMilliseconds=0xa) [0171.263] timeGetTime () returned 0x3d55f [0171.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.263] Sleep (dwMilliseconds=0xa) [0171.279] timeGetTime () returned 0x3d56e [0171.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.279] Sleep (dwMilliseconds=0xa) [0171.295] timeGetTime () returned 0x3d57e [0171.295] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.295] Sleep (dwMilliseconds=0xa) [0171.310] timeGetTime () returned 0x3d58d [0171.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.310] Sleep (dwMilliseconds=0xa) [0171.326] timeGetTime () returned 0x3d59d [0171.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.326] Sleep (dwMilliseconds=0xa) [0171.342] timeGetTime () returned 0x3d5ad [0171.342] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.342] Sleep (dwMilliseconds=0xa) [0171.357] timeGetTime () returned 0x3d5bc [0171.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.357] Sleep (dwMilliseconds=0xa) [0171.372] timeGetTime () returned 0x3d5cc [0171.372] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.372] Sleep (dwMilliseconds=0xa) [0171.388] timeGetTime () returned 0x3d5dc [0171.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.388] Sleep (dwMilliseconds=0xa) [0171.404] timeGetTime () returned 0x3d5eb [0171.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.404] Sleep (dwMilliseconds=0xa) [0171.419] timeGetTime () returned 0x3d5fb [0171.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.419] Sleep (dwMilliseconds=0xa) [0171.435] timeGetTime () returned 0x3d60a [0171.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.435] Sleep (dwMilliseconds=0xa) [0171.451] timeGetTime () returned 0x3d61a [0171.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.451] Sleep (dwMilliseconds=0xa) [0171.466] timeGetTime () returned 0x3d62a [0171.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.466] Sleep (dwMilliseconds=0xa) [0171.505] timeGetTime () returned 0x3d649 [0171.505] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.505] Sleep (dwMilliseconds=0xa) [0171.534] timeGetTime () returned 0x3d66e [0171.534] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.534] Sleep (dwMilliseconds=0xa) [0171.560] timeGetTime () returned 0x3d687 [0171.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.560] Sleep (dwMilliseconds=0xa) [0171.575] timeGetTime () returned 0x3d697 [0171.575] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.575] Sleep (dwMilliseconds=0xa) [0171.591] timeGetTime () returned 0x3d6a7 [0171.591] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0171.591] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0171.591] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0171.591] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0171.591] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0171.591] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0171.592] RegCloseKey (hKey=0x240) returned 0x0 [0171.592] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0171.592] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0171.592] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0171.592] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0171.592] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0171.592] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0171.592] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0171.592] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0171.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0171.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0171.592] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0171.592] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.685] FreeLibrary (hLibModule=0x77150000) returned 1 [0171.685] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0171.685] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0171.685] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0171.685] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0171.685] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0171.685] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0171.685] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0171.685] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0171.686] timeGetTime () returned 0x3d704 [0171.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.686] Sleep (dwMilliseconds=0xa) [0171.732] timeGetTime () returned 0x3d733 [0171.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.732] Sleep (dwMilliseconds=0xa) [0171.779] timeGetTime () returned 0x3d762 [0171.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.779] Sleep (dwMilliseconds=0xa) [0171.813] timeGetTime () returned 0x3d781 [0171.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.813] Sleep (dwMilliseconds=0xa) [0171.857] timeGetTime () returned 0x3d7b0 [0171.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0171.857] TranslateMessage (lpMsg=0x8bf798) returned 0 [0171.857] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0171.857] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0171.857] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0171.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.857] Sleep (dwMilliseconds=0xa) [0171.906] timeGetTime () returned 0x3d7e1 [0171.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.906] Sleep (dwMilliseconds=0xa) [0171.924] timeGetTime () returned 0x3d7ef [0171.924] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.924] Sleep (dwMilliseconds=0xa) [0171.935] timeGetTime () returned 0x3d7fe [0171.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.935] Sleep (dwMilliseconds=0xa) [0171.958] timeGetTime () returned 0x3d80e [0171.958] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0171.958] Sleep (dwMilliseconds=0xa) [0172.012] timeGetTime () returned 0x3d83d [0172.012] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.012] Sleep (dwMilliseconds=0xa) [0172.035] timeGetTime () returned 0x3d85c [0172.035] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.035] Sleep (dwMilliseconds=0xa) [0172.062] timeGetTime () returned 0x3d87b [0172.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.062] Sleep (dwMilliseconds=0xa) [0172.077] timeGetTime () returned 0x3d88b [0172.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.078] Sleep (dwMilliseconds=0xa) [0172.091] timeGetTime () returned 0x3d89b [0172.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.091] Sleep (dwMilliseconds=0xa) [0172.132] timeGetTime () returned 0x3d8ba [0172.132] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.132] Sleep (dwMilliseconds=0xa) [0172.170] timeGetTime () returned 0x3d8e9 [0172.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.170] Sleep (dwMilliseconds=0xa) [0172.227] timeGetTime () returned 0x3d918 [0172.228] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.228] Sleep (dwMilliseconds=0xa) [0172.301] timeGetTime () returned 0x3d966 [0172.301] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.301] Sleep (dwMilliseconds=0xa) [0172.339] timeGetTime () returned 0x3d985 [0172.339] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.339] Sleep (dwMilliseconds=0xa) [0172.357] timeGetTime () returned 0x3d9a4 [0172.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.357] Sleep (dwMilliseconds=0xa) [0172.378] timeGetTime () returned 0x3d9b4 [0172.378] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.378] Sleep (dwMilliseconds=0xa) [0172.414] timeGetTime () returned 0x3d9d3 [0172.414] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.414] Sleep (dwMilliseconds=0xa) [0172.449] timeGetTime () returned 0x3d9f2 [0172.449] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.449] Sleep (dwMilliseconds=0xa) [0172.554] timeGetTime () returned 0x3da60 [0172.554] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.554] Sleep (dwMilliseconds=0xa) [0172.591] timeGetTime () returned 0x3da8f [0172.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.591] Sleep (dwMilliseconds=0xa) [0172.638] timeGetTime () returned 0x3dabe [0172.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0172.638] TranslateMessage (lpMsg=0x8bf798) returned 0 [0172.638] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0172.638] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0172.638] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0172.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.638] Sleep (dwMilliseconds=0xa) [0172.685] timeGetTime () returned 0x3daec [0172.685] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0172.685] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0172.685] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0172.685] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0172.685] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0172.685] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0172.685] RegCloseKey (hKey=0x240) returned 0x0 [0172.685] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0172.686] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0172.686] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0172.686] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0172.686] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0172.686] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0172.686] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0172.686] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0172.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0172.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abf8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0172.686] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0172.686] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0172.794] FreeLibrary (hLibModule=0x77150000) returned 1 [0172.794] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0172.795] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0172.795] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0172.795] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0172.795] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0172.795] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0172.795] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0172.795] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0172.795] timeGetTime () returned 0x3db5a [0172.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.795] Sleep (dwMilliseconds=0xa) [0172.873] timeGetTime () returned 0x3dba8 [0172.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.873] Sleep (dwMilliseconds=0xa) [0172.920] timeGetTime () returned 0x3dbd7 [0172.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.920] Sleep (dwMilliseconds=0xa) [0172.967] timeGetTime () returned 0x3dc06 [0172.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0172.967] Sleep (dwMilliseconds=0xa) [0173.015] timeGetTime () returned 0x3dc35 [0173.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.015] Sleep (dwMilliseconds=0xa) [0173.062] timeGetTime () returned 0x3dc63 [0173.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.062] Sleep (dwMilliseconds=0xa) [0173.082] timeGetTime () returned 0x3dc73 [0173.082] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.082] Sleep (dwMilliseconds=0xa) [0173.114] timeGetTime () returned 0x3dc92 [0173.114] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.114] Sleep (dwMilliseconds=0xa) [0173.149] timeGetTime () returned 0x3dcb2 [0173.149] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.149] Sleep (dwMilliseconds=0xa) [0173.185] timeGetTime () returned 0x3dce1 [0173.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.185] Sleep (dwMilliseconds=0xa) [0173.216] timeGetTime () returned 0x3dd00 [0173.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.216] Sleep (dwMilliseconds=0xa) [0173.247] timeGetTime () returned 0x3dd1f [0173.247] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.247] Sleep (dwMilliseconds=0xa) [0173.284] timeGetTime () returned 0x3dd3e [0173.284] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.284] Sleep (dwMilliseconds=0xa) [0173.310] timeGetTime () returned 0x3dd5d [0173.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.310] Sleep (dwMilliseconds=0xa) [0173.327] timeGetTime () returned 0x3dd6d [0173.327] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.327] Sleep (dwMilliseconds=0xa) [0173.343] timeGetTime () returned 0x3dd7d [0173.343] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.343] Sleep (dwMilliseconds=0xa) [0173.357] timeGetTime () returned 0x3dd8c [0173.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.357] Sleep (dwMilliseconds=0xa) [0173.374] timeGetTime () returned 0x3dd9c [0173.374] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.374] Sleep (dwMilliseconds=0xa) [0173.388] timeGetTime () returned 0x3ddac [0173.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.388] Sleep (dwMilliseconds=0xa) [0173.404] timeGetTime () returned 0x3ddbb [0173.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0173.404] TranslateMessage (lpMsg=0x8bf798) returned 0 [0173.405] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0173.405] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0173.405] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0173.405] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.405] Sleep (dwMilliseconds=0xa) [0173.426] timeGetTime () returned 0x3ddcb [0173.426] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.426] Sleep (dwMilliseconds=0xa) [0173.452] timeGetTime () returned 0x3ddea [0173.452] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.452] Sleep (dwMilliseconds=0xa) [0173.467] timeGetTime () returned 0x3ddfa [0173.467] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.467] Sleep (dwMilliseconds=0xa) [0173.482] timeGetTime () returned 0x3de09 [0173.482] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.482] Sleep (dwMilliseconds=0xa) [0173.565] timeGetTime () returned 0x3de57 [0173.565] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.565] Sleep (dwMilliseconds=0xa) [0173.591] timeGetTime () returned 0x3de77 [0173.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.591] Sleep (dwMilliseconds=0xa) [0173.607] timeGetTime () returned 0x3de86 [0173.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.607] Sleep (dwMilliseconds=0xa) [0173.635] timeGetTime () returned 0x3de96 [0173.635] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.635] Sleep (dwMilliseconds=0xa) [0173.654] timeGetTime () returned 0x3deb5 [0173.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.654] Sleep (dwMilliseconds=0xa) [0173.671] timeGetTime () returned 0x3dec5 [0173.671] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.671] Sleep (dwMilliseconds=0xa) [0173.686] timeGetTime () returned 0x3ded4 [0173.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.686] Sleep (dwMilliseconds=0xa) [0173.702] timeGetTime () returned 0x3dee4 [0173.702] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.702] Sleep (dwMilliseconds=0xa) [0173.720] timeGetTime () returned 0x3def4 [0173.720] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.720] Sleep (dwMilliseconds=0xa) [0173.744] timeGetTime () returned 0x3df03 [0173.744] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.744] Sleep (dwMilliseconds=0xa) [0173.773] timeGetTime () returned 0x3df23 [0173.773] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.773] Sleep (dwMilliseconds=0xa) [0173.801] timeGetTime () returned 0x3df42 [0173.801] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0173.801] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0173.801] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0173.801] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0173.801] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0173.801] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0173.801] RegCloseKey (hKey=0x240) returned 0x0 [0173.802] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0173.802] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0173.802] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0173.802] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0173.802] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0173.802] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0173.802] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0173.802] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0173.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0173.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a998, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0173.802] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0173.802] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0173.888] FreeLibrary (hLibModule=0x77150000) returned 1 [0173.888] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0173.888] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0173.888] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0173.888] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0173.888] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0173.888] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0173.888] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0173.889] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0173.889] timeGetTime () returned 0x3dfa0 [0173.889] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.889] Sleep (dwMilliseconds=0xa) [0173.936] timeGetTime () returned 0x3dfce [0173.936] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.936] Sleep (dwMilliseconds=0xa) [0173.983] timeGetTime () returned 0x3dffd [0173.983] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0173.983] Sleep (dwMilliseconds=0xa) [0174.033] timeGetTime () returned 0x3e02c [0174.033] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.033] Sleep (dwMilliseconds=0xa) [0174.076] timeGetTime () returned 0x3e05b [0174.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.076] Sleep (dwMilliseconds=0xa) [0174.123] timeGetTime () returned 0x3e08a [0174.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.123] Sleep (dwMilliseconds=0xa) [0174.145] timeGetTime () returned 0x3e09a [0174.145] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.145] Sleep (dwMilliseconds=0xa) [0174.178] timeGetTime () returned 0x3e0b9 [0174.178] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0174.178] TranslateMessage (lpMsg=0x8bf798) returned 0 [0174.178] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0174.178] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0174.178] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0174.178] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.178] Sleep (dwMilliseconds=0xa) [0174.201] timeGetTime () returned 0x3e0d8 [0174.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.201] Sleep (dwMilliseconds=0xa) [0174.225] timeGetTime () returned 0x3e0e8 [0174.225] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.225] Sleep (dwMilliseconds=0xa) [0174.249] timeGetTime () returned 0x3e107 [0174.249] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.249] Sleep (dwMilliseconds=0xa) [0174.263] timeGetTime () returned 0x3e117 [0174.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.263] Sleep (dwMilliseconds=0xa) [0174.280] timeGetTime () returned 0x3e126 [0174.280] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.280] Sleep (dwMilliseconds=0xa) [0174.299] timeGetTime () returned 0x3e136 [0174.300] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.300] Sleep (dwMilliseconds=0xa) [0174.330] timeGetTime () returned 0x3e155 [0174.331] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.331] Sleep (dwMilliseconds=0xa) [0174.351] timeGetTime () returned 0x3e165 [0174.351] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.351] Sleep (dwMilliseconds=0xa) [0174.377] timeGetTime () returned 0x3e184 [0174.377] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.377] Sleep (dwMilliseconds=0xa) [0174.388] timeGetTime () returned 0x3e194 [0174.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.388] Sleep (dwMilliseconds=0xa) [0174.404] timeGetTime () returned 0x3e1a3 [0174.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.404] Sleep (dwMilliseconds=0xa) [0174.420] timeGetTime () returned 0x3e1b3 [0174.420] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.420] Sleep (dwMilliseconds=0xa) [0174.443] timeGetTime () returned 0x3e1c2 [0174.443] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.444] Sleep (dwMilliseconds=0xa) [0174.471] timeGetTime () returned 0x3e1e2 [0174.471] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.472] Sleep (dwMilliseconds=0xa) [0174.569] timeGetTime () returned 0x3e240 [0174.569] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.569] Sleep (dwMilliseconds=0xa) [0174.601] timeGetTime () returned 0x3e25f [0174.601] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.601] Sleep (dwMilliseconds=0xa) [0174.629] timeGetTime () returned 0x3e27e [0174.629] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.629] Sleep (dwMilliseconds=0xa) [0174.663] timeGetTime () returned 0x3e29d [0174.664] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.664] Sleep (dwMilliseconds=0xa) [0174.686] timeGetTime () returned 0x3e2bc [0174.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.686] Sleep (dwMilliseconds=0xa) [0174.704] timeGetTime () returned 0x3e2cc [0174.704] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.704] Sleep (dwMilliseconds=0xa) [0174.718] timeGetTime () returned 0x3e2dc [0174.718] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.718] Sleep (dwMilliseconds=0xa) [0174.745] timeGetTime () returned 0x3e2eb [0174.745] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.745] Sleep (dwMilliseconds=0xa) [0174.765] timeGetTime () returned 0x3e30b [0174.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.765] Sleep (dwMilliseconds=0xa) [0174.781] timeGetTime () returned 0x3e31a [0174.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.781] Sleep (dwMilliseconds=0xa) [0174.801] timeGetTime () returned 0x3e32a [0174.801] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.801] Sleep (dwMilliseconds=0xa) [0174.834] timeGetTime () returned 0x3e349 [0174.834] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.834] Sleep (dwMilliseconds=0xa) [0174.862] timeGetTime () returned 0x3e368 [0174.862] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.862] Sleep (dwMilliseconds=0xa) [0174.889] timeGetTime () returned 0x3e388 [0174.889] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0174.889] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0174.889] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0174.889] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0174.889] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0174.890] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0174.890] RegCloseKey (hKey=0x240) returned 0x0 [0174.890] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0174.890] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0174.890] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0174.890] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0174.890] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0174.890] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0174.890] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0174.890] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0174.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0174.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0174.890] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0174.891] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0174.982] FreeLibrary (hLibModule=0x77150000) returned 1 [0174.982] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0174.982] TranslateMessage (lpMsg=0x8bf708) returned 0 [0174.982] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0174.982] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0174.982] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0174.982] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0174.982] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0174.983] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0174.983] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0174.983] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0174.983] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0174.983] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0174.983] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0174.983] timeGetTime () returned 0x3e3e5 [0174.983] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0174.983] Sleep (dwMilliseconds=0xa) [0175.039] timeGetTime () returned 0x3e414 [0175.039] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.039] Sleep (dwMilliseconds=0xa) [0175.089] timeGetTime () returned 0x3e443 [0175.089] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.089] Sleep (dwMilliseconds=0xa) [0175.151] timeGetTime () returned 0x3e482 [0175.151] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.151] Sleep (dwMilliseconds=0xa) [0175.199] timeGetTime () returned 0x3e4b0 [0175.199] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.199] Sleep (dwMilliseconds=0xa) [0175.258] timeGetTime () returned 0x3e4ef [0175.258] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.258] Sleep (dwMilliseconds=0xa) [0175.292] timeGetTime () returned 0x3e50e [0175.292] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.292] Sleep (dwMilliseconds=0xa) [0175.322] timeGetTime () returned 0x3e52d [0175.322] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.322] Sleep (dwMilliseconds=0xa) [0175.351] timeGetTime () returned 0x3e54d [0175.351] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.351] Sleep (dwMilliseconds=0xa) [0175.373] timeGetTime () returned 0x3e56c [0175.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.373] Sleep (dwMilliseconds=0xa) [0175.390] timeGetTime () returned 0x3e57c [0175.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.390] Sleep (dwMilliseconds=0xa) [0175.405] timeGetTime () returned 0x3e58b [0175.405] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.405] Sleep (dwMilliseconds=0xa) [0175.420] timeGetTime () returned 0x3e59b [0175.420] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.420] Sleep (dwMilliseconds=0xa) [0175.435] timeGetTime () returned 0x3e5aa [0175.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.435] Sleep (dwMilliseconds=0xa) [0175.451] timeGetTime () returned 0x3e5ba [0175.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.451] Sleep (dwMilliseconds=0xa) [0175.466] timeGetTime () returned 0x3e5ca [0175.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.466] Sleep (dwMilliseconds=0xa) [0175.482] timeGetTime () returned 0x3e5d9 [0175.482] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.482] Sleep (dwMilliseconds=0xa) [0175.562] timeGetTime () returned 0x3e627 [0175.562] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.562] Sleep (dwMilliseconds=0xa) [0175.577] timeGetTime () returned 0x3e637 [0175.577] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.577] Sleep (dwMilliseconds=0xa) [0175.594] timeGetTime () returned 0x3e647 [0175.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.594] Sleep (dwMilliseconds=0xa) [0175.607] timeGetTime () returned 0x3e656 [0175.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.607] Sleep (dwMilliseconds=0xa) [0175.623] timeGetTime () returned 0x3e666 [0175.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.623] Sleep (dwMilliseconds=0xa) [0175.639] timeGetTime () returned 0x3e676 [0175.639] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.639] Sleep (dwMilliseconds=0xa) [0175.654] timeGetTime () returned 0x3e685 [0175.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.654] Sleep (dwMilliseconds=0xa) [0175.670] timeGetTime () returned 0x3e695 [0175.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.670] Sleep (dwMilliseconds=0xa) [0175.686] timeGetTime () returned 0x3e6a4 [0175.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.686] Sleep (dwMilliseconds=0xa) [0175.701] timeGetTime () returned 0x3e6b4 [0175.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.701] Sleep (dwMilliseconds=0xa) [0175.719] timeGetTime () returned 0x3e6c4 [0175.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.719] Sleep (dwMilliseconds=0xa) [0175.745] timeGetTime () returned 0x3e6d3 [0175.745] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.745] Sleep (dwMilliseconds=0xa) [0175.766] timeGetTime () returned 0x3e6f3 [0175.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0175.766] TranslateMessage (lpMsg=0x8bf798) returned 0 [0175.766] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0175.766] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0175.766] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0175.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.766] Sleep (dwMilliseconds=0xa) [0175.779] timeGetTime () returned 0x3e702 [0175.779] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.779] Sleep (dwMilliseconds=0xa) [0175.797] timeGetTime () returned 0x3e712 [0175.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.797] Sleep (dwMilliseconds=0xa) [0175.810] timeGetTime () returned 0x3e721 [0175.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.811] Sleep (dwMilliseconds=0xa) [0175.828] timeGetTime () returned 0x3e733 [0175.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.828] Sleep (dwMilliseconds=0xa) [0175.842] timeGetTime () returned 0x3e741 [0175.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.842] Sleep (dwMilliseconds=0xa) [0175.857] timeGetTime () returned 0x3e750 [0175.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.857] Sleep (dwMilliseconds=0xa) [0175.873] timeGetTime () returned 0x3e760 [0175.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.873] Sleep (dwMilliseconds=0xa) [0175.888] timeGetTime () returned 0x3e770 [0175.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.888] Sleep (dwMilliseconds=0xa) [0175.911] timeGetTime () returned 0x3e77f [0175.911] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.911] Sleep (dwMilliseconds=0xa) [0175.936] timeGetTime () returned 0x3e79e [0175.936] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.936] Sleep (dwMilliseconds=0xa) [0175.952] timeGetTime () returned 0x3e7ae [0175.952] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.952] Sleep (dwMilliseconds=0xa) [0175.967] timeGetTime () returned 0x3e7be [0175.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0175.967] Sleep (dwMilliseconds=0xa) [0175.983] timeGetTime () returned 0x3e7cd [0175.983] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0175.983] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0175.983] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0175.983] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0175.983] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0175.984] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0175.984] RegCloseKey (hKey=0x240) returned 0x0 [0175.984] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0175.984] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0175.984] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0175.984] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0175.984] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0175.984] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0175.984] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0175.984] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0175.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0175.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9b8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0175.984] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0175.984] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0176.076] FreeLibrary (hLibModule=0x77150000) returned 1 [0176.076] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0176.076] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0176.076] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0176.076] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0176.076] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0176.076] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0176.076] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0176.076] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0176.076] timeGetTime () returned 0x3e82b [0176.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.076] Sleep (dwMilliseconds=0xa) [0176.186] timeGetTime () returned 0x3e898 [0176.186] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.186] Sleep (dwMilliseconds=0xa) [0176.259] timeGetTime () returned 0x3e8d7 [0176.259] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.259] Sleep (dwMilliseconds=0xa) [0176.345] timeGetTime () returned 0x3e935 [0176.346] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.346] Sleep (dwMilliseconds=0xa) [0176.358] timeGetTime () returned 0x3e944 [0176.358] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.358] Sleep (dwMilliseconds=0xa) [0176.383] timeGetTime () returned 0x3e954 [0176.383] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.383] Sleep (dwMilliseconds=0xa) [0176.405] timeGetTime () returned 0x3e973 [0176.405] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.405] Sleep (dwMilliseconds=0xa) [0176.425] timeGetTime () returned 0x3e983 [0176.425] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.426] Sleep (dwMilliseconds=0xa) [0176.451] timeGetTime () returned 0x3e9a2 [0176.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.451] Sleep (dwMilliseconds=0xa) [0176.474] timeGetTime () returned 0x3e9b2 [0176.474] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.474] Sleep (dwMilliseconds=0xa) [0176.563] timeGetTime () returned 0x3ea0f [0176.563] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0176.563] TranslateMessage (lpMsg=0x8bf798) returned 0 [0176.563] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0176.563] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0176.563] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0176.563] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.563] Sleep (dwMilliseconds=0xa) [0176.587] timeGetTime () returned 0x3ea1f [0176.587] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.587] Sleep (dwMilliseconds=0xa) [0176.620] timeGetTime () returned 0x3ea3e [0176.620] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.620] Sleep (dwMilliseconds=0xa) [0176.639] timeGetTime () returned 0x3ea5e [0176.639] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.639] Sleep (dwMilliseconds=0xa) [0176.662] timeGetTime () returned 0x3ea6d [0176.663] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.663] Sleep (dwMilliseconds=0xa) [0176.687] timeGetTime () returned 0x3ea8c [0176.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.687] Sleep (dwMilliseconds=0xa) [0176.712] timeGetTime () returned 0x3ea9c [0176.712] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.712] Sleep (dwMilliseconds=0xa) [0176.738] timeGetTime () returned 0x3eabb [0176.739] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.739] Sleep (dwMilliseconds=0xa) [0176.763] timeGetTime () returned 0x3eadb [0176.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.763] Sleep (dwMilliseconds=0xa) [0176.780] timeGetTime () returned 0x3eaea [0176.780] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.780] Sleep (dwMilliseconds=0xa) [0176.797] timeGetTime () returned 0x3eafa [0176.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.797] Sleep (dwMilliseconds=0xa) [0176.811] timeGetTime () returned 0x3eb09 [0176.811] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.811] Sleep (dwMilliseconds=0xa) [0176.826] timeGetTime () returned 0x3eb19 [0176.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.826] Sleep (dwMilliseconds=0xa) [0176.847] timeGetTime () returned 0x3eb29 [0176.847] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.847] Sleep (dwMilliseconds=0xa) [0176.872] timeGetTime () returned 0x3eb48 [0176.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.872] Sleep (dwMilliseconds=0xa) [0176.897] timeGetTime () returned 0x3eb58 [0176.897] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.897] Sleep (dwMilliseconds=0xa) [0176.920] timeGetTime () returned 0x3eb77 [0176.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.920] Sleep (dwMilliseconds=0xa) [0176.935] timeGetTime () returned 0x3eb86 [0176.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.935] Sleep (dwMilliseconds=0xa) [0176.957] timeGetTime () returned 0x3eb96 [0176.957] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.957] Sleep (dwMilliseconds=0xa) [0176.989] timeGetTime () returned 0x3ebb5 [0176.989] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0176.989] Sleep (dwMilliseconds=0xa) [0177.014] timeGetTime () returned 0x3ebd5 [0177.014] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.014] Sleep (dwMilliseconds=0xa) [0177.029] timeGetTime () returned 0x3ebe4 [0177.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.030] Sleep (dwMilliseconds=0xa) [0177.057] timeGetTime () returned 0x3ebf4 [0177.057] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.057] Sleep (dwMilliseconds=0xa) [0177.083] timeGetTime () returned 0x3ec13 [0177.083] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0177.083] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0177.083] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0177.083] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0177.083] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0177.084] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0177.084] RegCloseKey (hKey=0x240) returned 0x0 [0177.084] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0177.084] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0177.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0177.084] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0177.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0177.084] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0177.084] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0177.084] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0177.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac98, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0177.084] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0177.084] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0177.169] FreeLibrary (hLibModule=0x77150000) returned 1 [0177.169] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0177.170] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0177.170] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0177.170] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0177.170] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0177.170] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0177.170] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0177.170] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0177.170] timeGetTime () returned 0x3ec71 [0177.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.170] Sleep (dwMilliseconds=0xa) [0177.217] timeGetTime () returned 0x3eca0 [0177.217] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.217] Sleep (dwMilliseconds=0xa) [0177.264] timeGetTime () returned 0x3eccf [0177.264] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.264] Sleep (dwMilliseconds=0xa) [0177.312] timeGetTime () returned 0x3ecfd [0177.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.312] Sleep (dwMilliseconds=0xa) [0177.358] timeGetTime () returned 0x3ed2c [0177.358] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0177.358] TranslateMessage (lpMsg=0x8bf798) returned 0 [0177.358] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0177.358] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0177.358] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0177.358] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.358] Sleep (dwMilliseconds=0xa) [0177.396] timeGetTime () returned 0x3ed4c [0177.397] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.397] Sleep (dwMilliseconds=0xa) [0177.420] timeGetTime () returned 0x3ed6b [0177.420] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.420] Sleep (dwMilliseconds=0xa) [0177.444] timeGetTime () returned 0x3ed7a [0177.444] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.444] Sleep (dwMilliseconds=0xa) [0177.472] timeGetTime () returned 0x3ed9a [0177.472] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.473] Sleep (dwMilliseconds=0xa) [0177.629] timeGetTime () returned 0x3ee36 [0177.629] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.629] Sleep (dwMilliseconds=0xa) [0177.665] timeGetTime () returned 0x3ee55 [0177.665] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.665] Sleep (dwMilliseconds=0xa) [0177.686] timeGetTime () returned 0x3ee74 [0177.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.686] Sleep (dwMilliseconds=0xa) [0177.702] timeGetTime () returned 0x3ee84 [0177.702] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.702] Sleep (dwMilliseconds=0xa) [0177.717] timeGetTime () returned 0x3ee94 [0177.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.717] Sleep (dwMilliseconds=0xa) [0177.732] timeGetTime () returned 0x3eea3 [0177.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.732] Sleep (dwMilliseconds=0xa) [0177.750] timeGetTime () returned 0x3eeb3 [0177.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.750] Sleep (dwMilliseconds=0xa) [0177.774] timeGetTime () returned 0x3eec3 [0177.774] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.774] Sleep (dwMilliseconds=0xa) [0177.802] timeGetTime () returned 0x3eee2 [0177.802] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.802] Sleep (dwMilliseconds=0xa) [0177.830] timeGetTime () returned 0x3ef01 [0177.830] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.830] Sleep (dwMilliseconds=0xa) [0177.850] timeGetTime () returned 0x3ef11 [0177.850] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.850] Sleep (dwMilliseconds=0xa) [0177.874] timeGetTime () returned 0x3ef30 [0177.874] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.874] Sleep (dwMilliseconds=0xa) [0177.892] timeGetTime () returned 0x3ef40 [0177.892] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.892] Sleep (dwMilliseconds=0xa) [0177.915] timeGetTime () returned 0x3ef4f [0177.915] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.915] Sleep (dwMilliseconds=0xa) [0177.945] timeGetTime () returned 0x3ef6e [0177.945] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.945] Sleep (dwMilliseconds=0xa) [0177.968] timeGetTime () returned 0x3ef8e [0177.968] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.968] Sleep (dwMilliseconds=0xa) [0177.989] timeGetTime () returned 0x3ef9d [0177.989] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0177.989] Sleep (dwMilliseconds=0xa) [0178.028] timeGetTime () returned 0x3efcc [0178.028] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.029] Sleep (dwMilliseconds=0xa) [0178.045] timeGetTime () returned 0x3efdc [0178.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.045] Sleep (dwMilliseconds=0xa) [0178.061] timeGetTime () returned 0x3efeb [0178.061] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.061] Sleep (dwMilliseconds=0xa) [0178.089] timeGetTime () returned 0x3effc [0178.089] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.090] Sleep (dwMilliseconds=0xa) [0178.115] timeGetTime () returned 0x3f01a [0178.115] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.115] Sleep (dwMilliseconds=0xa) [0178.141] timeGetTime () returned 0x3f03b [0178.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0178.141] TranslateMessage (lpMsg=0x8bf798) returned 0 [0178.141] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0178.141] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0178.141] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0178.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.141] Sleep (dwMilliseconds=0xa) [0178.153] timeGetTime () returned 0x3f049 [0178.153] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.154] Sleep (dwMilliseconds=0xa) [0178.169] timeGetTime () returned 0x3f059 [0178.169] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0178.170] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0178.170] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0178.170] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0178.170] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0178.170] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0178.170] RegCloseKey (hKey=0x240) returned 0x0 [0178.170] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0178.170] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0178.170] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0178.170] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0178.170] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0178.170] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0178.170] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0178.170] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0178.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0178.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac98, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0178.171] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0178.171] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0178.263] FreeLibrary (hLibModule=0x77150000) returned 1 [0178.263] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0178.263] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0178.263] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0178.264] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0178.264] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0178.264] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0178.264] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0178.264] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0178.264] timeGetTime () returned 0x3f0b7 [0178.264] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.264] Sleep (dwMilliseconds=0xa) [0178.311] timeGetTime () returned 0x3f0e5 [0178.311] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.311] Sleep (dwMilliseconds=0xa) [0178.359] timeGetTime () returned 0x3f114 [0178.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.359] Sleep (dwMilliseconds=0xa) [0178.407] timeGetTime () returned 0x3f143 [0178.407] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.407] Sleep (dwMilliseconds=0xa) [0178.452] timeGetTime () returned 0x3f172 [0178.452] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.452] Sleep (dwMilliseconds=0xa) [0178.490] timeGetTime () returned 0x3f191 [0178.490] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.490] Sleep (dwMilliseconds=0xa) [0178.580] timeGetTime () returned 0x3f1ef [0178.580] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.580] Sleep (dwMilliseconds=0xa) [0178.600] timeGetTime () returned 0x3f1ff [0178.600] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.600] Sleep (dwMilliseconds=0xa) [0178.635] timeGetTime () returned 0x3f21e [0178.635] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.635] Sleep (dwMilliseconds=0xa) [0178.654] timeGetTime () returned 0x3f23d [0178.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.654] Sleep (dwMilliseconds=0xa) [0178.670] timeGetTime () returned 0x3f24d [0178.671] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.671] Sleep (dwMilliseconds=0xa) [0178.685] timeGetTime () returned 0x3f25c [0178.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.685] Sleep (dwMilliseconds=0xa) [0178.707] timeGetTime () returned 0x3f26c [0178.707] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.707] Sleep (dwMilliseconds=0xa) [0178.733] timeGetTime () returned 0x3f28b [0178.733] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.733] Sleep (dwMilliseconds=0xa) [0178.748] timeGetTime () returned 0x3f29b [0178.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.748] Sleep (dwMilliseconds=0xa) [0178.772] timeGetTime () returned 0x3f2ab [0178.772] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.772] Sleep (dwMilliseconds=0xa) [0178.794] timeGetTime () returned 0x3f2ca [0178.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.794] Sleep (dwMilliseconds=0xa) [0178.819] timeGetTime () returned 0x3f2d9 [0178.819] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.819] Sleep (dwMilliseconds=0xa) [0178.842] timeGetTime () returned 0x3f2f9 [0178.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.842] Sleep (dwMilliseconds=0xa) [0178.857] timeGetTime () returned 0x3f308 [0178.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.857] Sleep (dwMilliseconds=0xa) [0178.874] timeGetTime () returned 0x3f318 [0178.874] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.874] Sleep (dwMilliseconds=0xa) [0178.889] timeGetTime () returned 0x3f328 [0178.889] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0178.889] TranslateMessage (lpMsg=0x8bf798) returned 0 [0178.889] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0178.889] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0178.889] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0178.889] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.889] Sleep (dwMilliseconds=0xa) [0178.904] timeGetTime () returned 0x3f337 [0178.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.904] Sleep (dwMilliseconds=0xa) [0178.920] timeGetTime () returned 0x3f347 [0178.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.920] Sleep (dwMilliseconds=0xa) [0178.936] timeGetTime () returned 0x3f356 [0178.936] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.936] Sleep (dwMilliseconds=0xa) [0178.951] timeGetTime () returned 0x3f366 [0178.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.951] Sleep (dwMilliseconds=0xa) [0178.966] timeGetTime () returned 0x3f376 [0178.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.966] Sleep (dwMilliseconds=0xa) [0178.983] timeGetTime () returned 0x3f385 [0178.983] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0178.983] Sleep (dwMilliseconds=0xa) [0179.002] timeGetTime () returned 0x3f395 [0179.002] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.002] Sleep (dwMilliseconds=0xa) [0179.036] timeGetTime () returned 0x3f3b4 [0179.036] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.036] Sleep (dwMilliseconds=0xa) [0179.064] timeGetTime () returned 0x3f3d3 [0179.064] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.064] Sleep (dwMilliseconds=0xa) [0179.077] timeGetTime () returned 0x3f3e3 [0179.077] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.077] Sleep (dwMilliseconds=0xa) [0179.095] timeGetTime () returned 0x3f3f3 [0179.095] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.096] Sleep (dwMilliseconds=0xa) [0179.107] timeGetTime () returned 0x3f402 [0179.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.107] Sleep (dwMilliseconds=0xa) [0179.123] timeGetTime () returned 0x3f412 [0179.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.123] Sleep (dwMilliseconds=0xa) [0179.138] timeGetTime () returned 0x3f422 [0179.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.138] Sleep (dwMilliseconds=0xa) [0179.165] timeGetTime () returned 0x3f431 [0179.165] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.165] Sleep (dwMilliseconds=0xa) [0179.185] timeGetTime () returned 0x3f450 [0179.185] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.185] Sleep (dwMilliseconds=0xa) [0179.201] timeGetTime () returned 0x3f460 [0179.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.201] Sleep (dwMilliseconds=0xa) [0179.218] timeGetTime () returned 0x3f470 [0179.218] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.218] Sleep (dwMilliseconds=0xa) [0179.232] timeGetTime () returned 0x3f47f [0179.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.232] Sleep (dwMilliseconds=0xa) [0179.247] timeGetTime () returned 0x3f48f [0179.247] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.247] Sleep (dwMilliseconds=0xa) [0179.274] timeGetTime () returned 0x3f49f [0179.274] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0179.274] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0179.274] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0179.274] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0179.274] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0179.274] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0179.274] RegCloseKey (hKey=0x240) returned 0x0 [0179.274] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0179.274] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0179.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0179.275] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0179.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0179.275] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0179.275] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0179.275] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0179.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0179.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acf8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0179.275] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0179.275] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0179.357] FreeLibrary (hLibModule=0x77150000) returned 1 [0179.357] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0179.357] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0179.357] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0179.357] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0179.357] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0179.357] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0179.357] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0179.357] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0179.358] timeGetTime () returned 0x3f4fc [0179.358] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.358] Sleep (dwMilliseconds=0xa) [0179.406] timeGetTime () returned 0x3f52b [0179.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.406] Sleep (dwMilliseconds=0xa) [0179.451] timeGetTime () returned 0x3f55a [0179.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.451] Sleep (dwMilliseconds=0xa) [0179.559] timeGetTime () returned 0x3f5b8 [0179.559] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.559] Sleep (dwMilliseconds=0xa) [0179.607] timeGetTime () returned 0x3f5f6 [0179.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.607] Sleep (dwMilliseconds=0xa) [0179.655] timeGetTime () returned 0x3f625 [0179.655] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0179.656] TranslateMessage (lpMsg=0x8bf798) returned 0 [0179.657] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0179.657] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0179.659] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.715] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.715] Sleep (dwMilliseconds=0xa) [0179.739] timeGetTime () returned 0x3f673 [0179.739] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.739] Sleep (dwMilliseconds=0xa) [0179.770] timeGetTime () returned 0x3f693 [0179.770] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.770] Sleep (dwMilliseconds=0xa) [0179.798] timeGetTime () returned 0x3f6b2 [0179.798] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.798] Sleep (dwMilliseconds=0xa) [0179.813] timeGetTime () returned 0x3f6c1 [0179.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.813] Sleep (dwMilliseconds=0xa) [0179.827] timeGetTime () returned 0x3f6d1 [0179.827] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.827] Sleep (dwMilliseconds=0xa) [0179.845] timeGetTime () returned 0x3f6e1 [0179.845] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.845] Sleep (dwMilliseconds=0xa) [0179.857] timeGetTime () returned 0x3f6f0 [0179.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.857] Sleep (dwMilliseconds=0xa) [0179.873] timeGetTime () returned 0x3f700 [0179.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.873] Sleep (dwMilliseconds=0xa) [0179.892] timeGetTime () returned 0x3f710 [0179.892] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.892] Sleep (dwMilliseconds=0xa) [0179.905] timeGetTime () returned 0x3f71f [0179.905] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.905] Sleep (dwMilliseconds=0xa) [0179.921] timeGetTime () returned 0x3f72f [0179.921] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.921] Sleep (dwMilliseconds=0xa) [0179.935] timeGetTime () returned 0x3f73e [0179.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.935] Sleep (dwMilliseconds=0xa) [0179.953] timeGetTime () returned 0x3f74e [0179.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.953] Sleep (dwMilliseconds=0xa) [0179.970] timeGetTime () returned 0x3f75e [0179.970] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.970] Sleep (dwMilliseconds=0xa) [0179.983] timeGetTime () returned 0x3f76d [0179.983] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0179.983] Sleep (dwMilliseconds=0xa) [0180.000] timeGetTime () returned 0x3f77d [0180.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.000] Sleep (dwMilliseconds=0xa) [0180.014] timeGetTime () returned 0x3f78d [0180.014] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.014] Sleep (dwMilliseconds=0xa) [0180.032] timeGetTime () returned 0x3f79c [0180.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.032] Sleep (dwMilliseconds=0xa) [0180.044] timeGetTime () returned 0x3f7ac [0180.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.044] Sleep (dwMilliseconds=0xa) [0180.060] timeGetTime () returned 0x3f7bb [0180.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.060] Sleep (dwMilliseconds=0xa) [0180.077] timeGetTime () returned 0x3f7cb [0180.077] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.077] Sleep (dwMilliseconds=0xa) [0180.092] timeGetTime () returned 0x3f7db [0180.092] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.092] Sleep (dwMilliseconds=0xa) [0180.111] timeGetTime () returned 0x3f7ea [0180.111] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.111] Sleep (dwMilliseconds=0xa) [0180.125] timeGetTime () returned 0x3f7fa [0180.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.125] Sleep (dwMilliseconds=0xa) [0180.138] timeGetTime () returned 0x3f80a [0180.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.138] Sleep (dwMilliseconds=0xa) [0180.156] timeGetTime () returned 0x3f819 [0180.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.156] Sleep (dwMilliseconds=0xa) [0180.170] timeGetTime () returned 0x3f829 [0180.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.170] Sleep (dwMilliseconds=0xa) [0180.188] timeGetTime () returned 0x3f838 [0180.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.188] Sleep (dwMilliseconds=0xa) [0180.203] timeGetTime () returned 0x3f848 [0180.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.203] Sleep (dwMilliseconds=0xa) [0180.218] timeGetTime () returned 0x3f859 [0180.218] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.218] Sleep (dwMilliseconds=0xa) [0180.234] timeGetTime () returned 0x3f867 [0180.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.234] Sleep (dwMilliseconds=0xa) [0180.248] timeGetTime () returned 0x3f877 [0180.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.248] Sleep (dwMilliseconds=0xa) [0180.265] timeGetTime () returned 0x3f887 [0180.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.265] Sleep (dwMilliseconds=0xa) [0180.280] timeGetTime () returned 0x3f896 [0180.280] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.280] Sleep (dwMilliseconds=0xa) [0180.294] timeGetTime () returned 0x3f8a6 [0180.294] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.294] Sleep (dwMilliseconds=0xa) [0180.311] timeGetTime () returned 0x3f8b5 [0180.311] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.311] Sleep (dwMilliseconds=0xa) [0180.328] timeGetTime () returned 0x3f8c5 [0180.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.328] Sleep (dwMilliseconds=0xa) [0180.344] timeGetTime () returned 0x3f8d5 [0180.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.344] Sleep (dwMilliseconds=0xa) [0180.358] timeGetTime () returned 0x3f8e4 [0180.358] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0180.358] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0180.358] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0180.358] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0180.359] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0180.359] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0180.359] RegCloseKey (hKey=0x240) returned 0x0 [0180.359] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0180.359] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0180.359] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0180.359] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0180.359] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0180.359] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0180.359] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0180.359] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0180.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0180.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aab8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0180.360] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0180.360] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0180.451] FreeLibrary (hLibModule=0x77150000) returned 1 [0180.451] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0180.451] TranslateMessage (lpMsg=0x8bf708) returned 0 [0180.451] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0180.451] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0180.451] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.451] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0180.451] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0180.451] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0180.451] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0180.451] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0180.451] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0180.451] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0180.451] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0180.451] timeGetTime () returned 0x3f942 [0180.452] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.452] Sleep (dwMilliseconds=0xa) [0180.551] timeGetTime () returned 0x3f9a0 [0180.551] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.551] Sleep (dwMilliseconds=0xa) [0180.623] timeGetTime () returned 0x3f9ef [0180.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.623] Sleep (dwMilliseconds=0xa) [0180.685] timeGetTime () returned 0x3fa2c [0180.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.685] Sleep (dwMilliseconds=0xa) [0180.739] timeGetTime () returned 0x3fa5b [0180.739] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.739] Sleep (dwMilliseconds=0xa) [0180.780] timeGetTime () returned 0x3fa8a [0180.780] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.780] Sleep (dwMilliseconds=0xa) [0180.818] timeGetTime () returned 0x3faa9 [0180.818] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.818] Sleep (dwMilliseconds=0xa) [0180.841] timeGetTime () returned 0x3fac9 [0180.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.841] Sleep (dwMilliseconds=0xa) [0180.865] timeGetTime () returned 0x3fad8 [0180.865] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.865] Sleep (dwMilliseconds=0xa) [0180.899] timeGetTime () returned 0x3faf8 [0180.899] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.899] Sleep (dwMilliseconds=0xa) [0180.919] timeGetTime () returned 0x3fb17 [0180.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.919] Sleep (dwMilliseconds=0xa) [0180.941] timeGetTime () returned 0x3fb26 [0180.941] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.941] Sleep (dwMilliseconds=0xa) [0180.970] timeGetTime () returned 0x3fb46 [0180.970] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.970] Sleep (dwMilliseconds=0xa) [0180.984] timeGetTime () returned 0x3fb55 [0180.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.984] Sleep (dwMilliseconds=0xa) [0180.999] timeGetTime () returned 0x3fb65 [0180.999] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0180.999] Sleep (dwMilliseconds=0xa) [0181.016] timeGetTime () returned 0x3fb75 [0181.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.016] Sleep (dwMilliseconds=0xa) [0181.033] timeGetTime () returned 0x3fb84 [0181.033] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.033] Sleep (dwMilliseconds=0xa) [0181.049] timeGetTime () returned 0x3fb94 [0181.049] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.049] Sleep (dwMilliseconds=0xa) [0181.061] timeGetTime () returned 0x3fba3 [0181.061] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.061] Sleep (dwMilliseconds=0xa) [0181.081] timeGetTime () returned 0x3fbb3 [0181.081] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.081] Sleep (dwMilliseconds=0xa) [0181.108] timeGetTime () returned 0x3fbd2 [0181.108] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.108] Sleep (dwMilliseconds=0xa) [0181.124] timeGetTime () returned 0x3fbe2 [0181.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.125] Sleep (dwMilliseconds=0xa) [0181.138] timeGetTime () returned 0x3fbf2 [0181.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.138] Sleep (dwMilliseconds=0xa) [0181.157] timeGetTime () returned 0x3fc01 [0181.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.157] Sleep (dwMilliseconds=0xa) [0181.170] timeGetTime () returned 0x3fc11 [0181.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.170] Sleep (dwMilliseconds=0xa) [0181.186] timeGetTime () returned 0x3fc20 [0181.186] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.186] Sleep (dwMilliseconds=0xa) [0181.204] timeGetTime () returned 0x3fc30 [0181.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0181.204] TranslateMessage (lpMsg=0x8bf798) returned 0 [0181.204] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0181.204] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0181.204] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.204] Sleep (dwMilliseconds=0xa) [0181.221] timeGetTime () returned 0x3fc40 [0181.221] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.221] Sleep (dwMilliseconds=0xa) [0181.232] timeGetTime () returned 0x3fc4f [0181.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.232] Sleep (dwMilliseconds=0xa) [0181.251] timeGetTime () returned 0x3fc60 [0181.252] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.252] Sleep (dwMilliseconds=0xa) [0181.308] timeGetTime () returned 0x3fc8e [0181.308] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.308] Sleep (dwMilliseconds=0xa) [0181.334] timeGetTime () returned 0x3fcad [0181.334] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.334] Sleep (dwMilliseconds=0xa) [0181.363] timeGetTime () returned 0x3fccc [0181.364] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.364] Sleep (dwMilliseconds=0xa) [0181.394] timeGetTime () returned 0x3fcec [0181.394] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.394] Sleep (dwMilliseconds=0xa) [0181.422] timeGetTime () returned 0x3fd0b [0181.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.422] Sleep (dwMilliseconds=0xa) [0181.439] timeGetTime () returned 0x3fd1a [0181.439] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.439] Sleep (dwMilliseconds=0xa) [0181.453] timeGetTime () returned 0x3fd2a [0181.453] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0181.453] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0181.453] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0181.453] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0181.453] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0181.453] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0181.454] RegCloseKey (hKey=0x240) returned 0x0 [0181.454] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0181.454] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0181.454] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0181.454] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0181.454] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0181.454] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0181.454] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0181.454] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0181.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0181.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0181.454] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0181.455] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0181.591] FreeLibrary (hLibModule=0x77150000) returned 1 [0181.591] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0181.591] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0181.591] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0181.591] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0181.591] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0181.591] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0181.592] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0181.592] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0181.592] timeGetTime () returned 0x3fdb7 [0181.592] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.592] Sleep (dwMilliseconds=0xa) [0181.626] timeGetTime () returned 0x3fdd6 [0181.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.626] Sleep (dwMilliseconds=0xa) [0181.639] timeGetTime () returned 0x3fde6 [0181.639] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.639] Sleep (dwMilliseconds=0xa) [0181.691] timeGetTime () returned 0x3fe14 [0181.691] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.691] Sleep (dwMilliseconds=0xa) [0181.737] timeGetTime () returned 0x3fe43 [0181.737] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.738] Sleep (dwMilliseconds=0xa) [0181.783] timeGetTime () returned 0x3fe72 [0181.783] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.783] Sleep (dwMilliseconds=0xa) [0181.826] timeGetTime () returned 0x3fea1 [0181.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.826] Sleep (dwMilliseconds=0xa) [0181.845] timeGetTime () returned 0x3feb2 [0181.845] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.845] Sleep (dwMilliseconds=0xa) [0181.859] timeGetTime () returned 0x3fec0 [0181.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.859] Sleep (dwMilliseconds=0xa) [0181.887] timeGetTime () returned 0x3fed0 [0181.887] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.887] Sleep (dwMilliseconds=0xa) [0181.924] timeGetTime () returned 0x3feff [0181.924] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.924] Sleep (dwMilliseconds=0xa) [0181.936] timeGetTime () returned 0x3ff0e [0181.936] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.936] Sleep (dwMilliseconds=0xa) [0181.953] timeGetTime () returned 0x3ff1e [0181.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0181.953] TranslateMessage (lpMsg=0x8bf798) returned 0 [0181.953] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0181.954] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0181.954] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.954] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.954] Sleep (dwMilliseconds=0xa) [0181.967] timeGetTime () returned 0x3ff2e [0181.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.967] Sleep (dwMilliseconds=0xa) [0181.985] timeGetTime () returned 0x3ff3d [0181.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.985] Sleep (dwMilliseconds=0xa) [0181.999] timeGetTime () returned 0x3ff4d [0181.999] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0181.999] Sleep (dwMilliseconds=0xa) [0182.014] timeGetTime () returned 0x3ff5d [0182.014] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.014] Sleep (dwMilliseconds=0xa) [0182.031] timeGetTime () returned 0x3ff6c [0182.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.031] Sleep (dwMilliseconds=0xa) [0182.046] timeGetTime () returned 0x3ff7c [0182.046] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.046] Sleep (dwMilliseconds=0xa) [0182.070] timeGetTime () returned 0x3ff8b [0182.070] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.070] Sleep (dwMilliseconds=0xa) [0182.094] timeGetTime () returned 0x3ffab [0182.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.094] Sleep (dwMilliseconds=0xa) [0182.107] timeGetTime () returned 0x3ffba [0182.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.107] Sleep (dwMilliseconds=0xa) [0182.123] timeGetTime () returned 0x3ffca [0182.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.123] Sleep (dwMilliseconds=0xa) [0182.144] timeGetTime () returned 0x3ffda [0182.144] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.144] Sleep (dwMilliseconds=0xa) [0182.170] timeGetTime () returned 0x3fff9 [0182.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.170] Sleep (dwMilliseconds=0xa) [0182.187] timeGetTime () returned 0x40008 [0182.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.187] Sleep (dwMilliseconds=0xa) [0182.204] timeGetTime () returned 0x40018 [0182.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.204] Sleep (dwMilliseconds=0xa) [0182.216] timeGetTime () returned 0x40028 [0182.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.216] Sleep (dwMilliseconds=0xa) [0182.236] timeGetTime () returned 0x40037 [0182.236] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.236] Sleep (dwMilliseconds=0xa) [0182.247] timeGetTime () returned 0x40047 [0182.247] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.247] Sleep (dwMilliseconds=0xa) [0182.263] timeGetTime () returned 0x40057 [0182.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.263] Sleep (dwMilliseconds=0xa) [0182.279] timeGetTime () returned 0x40066 [0182.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.279] Sleep (dwMilliseconds=0xa) [0182.297] timeGetTime () returned 0x40076 [0182.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.297] Sleep (dwMilliseconds=0xa) [0182.310] timeGetTime () returned 0x40085 [0182.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.310] Sleep (dwMilliseconds=0xa) [0182.329] timeGetTime () returned 0x40095 [0182.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.329] Sleep (dwMilliseconds=0xa) [0182.344] timeGetTime () returned 0x400a5 [0182.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.344] Sleep (dwMilliseconds=0xa) [0182.363] timeGetTime () returned 0x400b4 [0182.363] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.364] Sleep (dwMilliseconds=0xa) [0182.390] timeGetTime () returned 0x400d4 [0182.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.390] Sleep (dwMilliseconds=0xa) [0182.413] timeGetTime () returned 0x400e3 [0182.413] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.413] Sleep (dwMilliseconds=0xa) [0182.437] timeGetTime () returned 0x40102 [0182.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.437] Sleep (dwMilliseconds=0xa) [0182.452] timeGetTime () returned 0x40112 [0182.452] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.452] Sleep (dwMilliseconds=0xa) [0182.466] timeGetTime () returned 0x40122 [0182.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.466] Sleep (dwMilliseconds=0xa) [0182.487] timeGetTime () returned 0x40131 [0182.487] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.487] Sleep (dwMilliseconds=0xa) [0182.573] timeGetTime () returned 0x4017f [0182.573] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.574] Sleep (dwMilliseconds=0xa) [0182.594] timeGetTime () returned 0x4019f [0182.594] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0182.594] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0182.594] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0182.594] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0182.594] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0182.594] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0182.594] RegCloseKey (hKey=0x240) returned 0x0 [0182.595] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0182.595] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0182.595] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0182.595] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0182.595] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0182.595] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0182.595] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0182.595] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0182.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0182.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac98, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0182.595] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0182.595] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0182.701] FreeLibrary (hLibModule=0x77150000) returned 1 [0182.701] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0182.701] TranslateMessage (lpMsg=0x8bf708) returned 0 [0182.701] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0182.701] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0182.701] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.701] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0182.701] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0182.701] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0182.701] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0182.701] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0182.701] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0182.702] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0182.702] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0182.702] timeGetTime () returned 0x4020c [0182.702] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.702] Sleep (dwMilliseconds=0xa) [0182.752] timeGetTime () returned 0x4023b [0182.752] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.752] Sleep (dwMilliseconds=0xa) [0182.797] timeGetTime () returned 0x4026c [0182.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.797] Sleep (dwMilliseconds=0xa) [0182.955] timeGetTime () returned 0x40306 [0182.955] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.955] Sleep (dwMilliseconds=0xa) [0182.984] timeGetTime () returned 0x40325 [0182.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0182.984] Sleep (dwMilliseconds=0xa) [0183.035] timeGetTime () returned 0x40354 [0183.035] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.035] Sleep (dwMilliseconds=0xa) [0183.076] timeGetTime () returned 0x40383 [0183.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.077] Sleep (dwMilliseconds=0xa) [0183.093] timeGetTime () returned 0x40393 [0183.093] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.093] Sleep (dwMilliseconds=0xa) [0183.108] timeGetTime () returned 0x403a2 [0183.108] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.108] Sleep (dwMilliseconds=0xa) [0183.132] timeGetTime () returned 0x403b2 [0183.132] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.132] Sleep (dwMilliseconds=0xa) [0183.167] timeGetTime () returned 0x403d1 [0183.167] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.167] Sleep (dwMilliseconds=0xa) [0183.186] timeGetTime () returned 0x403f0 [0183.186] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.186] Sleep (dwMilliseconds=0xa) [0183.203] timeGetTime () returned 0x40400 [0183.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.203] Sleep (dwMilliseconds=0xa) [0183.216] timeGetTime () returned 0x40410 [0183.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.216] Sleep (dwMilliseconds=0xa) [0183.233] timeGetTime () returned 0x4041f [0183.233] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.233] Sleep (dwMilliseconds=0xa) [0183.251] timeGetTime () returned 0x4042f [0183.251] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.251] Sleep (dwMilliseconds=0xa) [0183.263] timeGetTime () returned 0x4043f [0183.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.263] Sleep (dwMilliseconds=0xa) [0183.279] timeGetTime () returned 0x4044e [0183.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.279] Sleep (dwMilliseconds=0xa) [0183.296] timeGetTime () returned 0x4045e [0183.296] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.296] Sleep (dwMilliseconds=0xa) [0183.311] timeGetTime () returned 0x4046d [0183.311] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.311] Sleep (dwMilliseconds=0xa) [0183.328] timeGetTime () returned 0x4047d [0183.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.328] Sleep (dwMilliseconds=0xa) [0183.346] timeGetTime () returned 0x4048d [0183.346] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.346] Sleep (dwMilliseconds=0xa) [0183.357] timeGetTime () returned 0x4049c [0183.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.357] Sleep (dwMilliseconds=0xa) [0183.376] timeGetTime () returned 0x404ac [0183.376] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.376] Sleep (dwMilliseconds=0xa) [0183.393] timeGetTime () returned 0x404bc [0183.394] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.394] Sleep (dwMilliseconds=0xa) [0183.423] timeGetTime () returned 0x404db [0183.423] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.423] Sleep (dwMilliseconds=0xa) [0183.435] timeGetTime () returned 0x404ea [0183.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.435] Sleep (dwMilliseconds=0xa) [0183.451] timeGetTime () returned 0x404fa [0183.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.451] Sleep (dwMilliseconds=0xa) [0183.470] timeGetTime () returned 0x4050a [0183.470] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0183.470] TranslateMessage (lpMsg=0x8bf798) returned 0 [0183.470] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0183.470] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0183.470] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.470] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.470] Sleep (dwMilliseconds=0xa) [0183.488] timeGetTime () returned 0x40519 [0183.488] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.488] Sleep (dwMilliseconds=0xa) [0183.539] timeGetTime () returned 0x40548 [0183.539] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.539] Sleep (dwMilliseconds=0xa) [0183.572] timeGetTime () returned 0x40567 [0183.572] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.572] Sleep (dwMilliseconds=0xa) [0183.594] timeGetTime () returned 0x40587 [0183.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.594] Sleep (dwMilliseconds=0xa) [0183.607] timeGetTime () returned 0x40596 [0183.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.607] Sleep (dwMilliseconds=0xa) [0183.625] timeGetTime () returned 0x405a6 [0183.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.625] Sleep (dwMilliseconds=0xa) [0183.640] timeGetTime () returned 0x405b6 [0183.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.640] Sleep (dwMilliseconds=0xa) [0183.658] timeGetTime () returned 0x405c5 [0183.658] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.658] Sleep (dwMilliseconds=0xa) [0183.672] timeGetTime () returned 0x405d5 [0183.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.672] Sleep (dwMilliseconds=0xa) [0183.688] timeGetTime () returned 0x405e4 [0183.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.688] Sleep (dwMilliseconds=0xa) [0183.701] timeGetTime () returned 0x405f4 [0183.701] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0183.701] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0183.701] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0183.701] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0183.701] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0183.702] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0183.702] RegCloseKey (hKey=0x240) returned 0x0 [0183.702] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0183.702] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0183.702] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0183.702] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0183.702] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0183.702] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0183.702] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0183.702] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0183.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0183.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0183.703] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0183.703] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0183.810] FreeLibrary (hLibModule=0x77150000) returned 1 [0183.810] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0183.810] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0183.810] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0183.810] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0183.810] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0183.810] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0183.810] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0183.811] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0183.811] timeGetTime () returned 0x40661 [0183.811] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.811] Sleep (dwMilliseconds=0xa) [0183.872] timeGetTime () returned 0x406a0 [0183.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.872] Sleep (dwMilliseconds=0xa) [0183.923] timeGetTime () returned 0x406cf [0183.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.923] Sleep (dwMilliseconds=0xa) [0183.967] timeGetTime () returned 0x406fe [0183.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0183.967] Sleep (dwMilliseconds=0xa) [0184.049] timeGetTime () returned 0x4074c [0184.049] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.049] Sleep (dwMilliseconds=0xa) [0184.092] timeGetTime () returned 0x4077b [0184.092] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.092] Sleep (dwMilliseconds=0xa) [0184.111] timeGetTime () returned 0x4078a [0184.111] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.112] Sleep (dwMilliseconds=0xa) [0184.123] timeGetTime () returned 0x4079a [0184.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.123] Sleep (dwMilliseconds=0xa) [0184.149] timeGetTime () returned 0x407aa [0184.149] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.149] Sleep (dwMilliseconds=0xa) [0184.173] timeGetTime () returned 0x407c9 [0184.173] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.173] Sleep (dwMilliseconds=0xa) [0184.189] timeGetTime () returned 0x407d8 [0184.189] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.189] Sleep (dwMilliseconds=0xa) [0184.203] timeGetTime () returned 0x407e8 [0184.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.203] Sleep (dwMilliseconds=0xa) [0184.224] timeGetTime () returned 0x407f8 [0184.224] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.224] Sleep (dwMilliseconds=0xa) [0184.248] timeGetTime () returned 0x40817 [0184.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0184.249] TranslateMessage (lpMsg=0x8bf798) returned 0 [0184.249] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0184.249] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0184.249] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0184.249] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.249] Sleep (dwMilliseconds=0xa) [0184.264] timeGetTime () returned 0x40827 [0184.264] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.264] Sleep (dwMilliseconds=0xa) [0184.282] timeGetTime () returned 0x40836 [0184.282] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.283] Sleep (dwMilliseconds=0xa) [0184.299] timeGetTime () returned 0x40846 [0184.299] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.299] Sleep (dwMilliseconds=0xa) [0184.310] timeGetTime () returned 0x40855 [0184.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.310] Sleep (dwMilliseconds=0xa) [0184.328] timeGetTime () returned 0x40865 [0184.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.328] Sleep (dwMilliseconds=0xa) [0184.342] timeGetTime () returned 0x40875 [0184.342] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.342] Sleep (dwMilliseconds=0xa) [0184.358] timeGetTime () returned 0x40884 [0184.358] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.358] Sleep (dwMilliseconds=0xa) [0184.377] timeGetTime () returned 0x40894 [0184.377] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.378] Sleep (dwMilliseconds=0xa) [0184.389] timeGetTime () returned 0x408a4 [0184.389] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.389] Sleep (dwMilliseconds=0xa) [0184.406] timeGetTime () returned 0x408b3 [0184.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.406] Sleep (dwMilliseconds=0xa) [0184.425] timeGetTime () returned 0x408c3 [0184.425] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.425] Sleep (dwMilliseconds=0xa) [0184.453] timeGetTime () returned 0x408e2 [0184.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.453] Sleep (dwMilliseconds=0xa) [0184.466] timeGetTime () returned 0x408f2 [0184.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.466] Sleep (dwMilliseconds=0xa) [0184.486] timeGetTime () returned 0x40901 [0184.486] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.486] Sleep (dwMilliseconds=0xa) [0184.575] timeGetTime () returned 0x4095f [0184.575] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.575] Sleep (dwMilliseconds=0xa) [0184.593] timeGetTime () returned 0x4096f [0184.593] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.593] Sleep (dwMilliseconds=0xa) [0184.607] timeGetTime () returned 0x4097e [0184.607] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.607] Sleep (dwMilliseconds=0xa) [0184.623] timeGetTime () returned 0x4098e [0184.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.623] Sleep (dwMilliseconds=0xa) [0184.644] timeGetTime () returned 0x4099e [0184.644] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.644] Sleep (dwMilliseconds=0xa) [0184.671] timeGetTime () returned 0x409bd [0184.671] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.671] Sleep (dwMilliseconds=0xa) [0184.688] timeGetTime () returned 0x409cc [0184.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.688] Sleep (dwMilliseconds=0xa) [0184.702] timeGetTime () returned 0x409dc [0184.702] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.702] Sleep (dwMilliseconds=0xa) [0184.716] timeGetTime () returned 0x409ec [0184.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.716] Sleep (dwMilliseconds=0xa) [0184.733] timeGetTime () returned 0x409fb [0184.733] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.733] Sleep (dwMilliseconds=0xa) [0184.753] timeGetTime () returned 0x40a0b [0184.753] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.753] Sleep (dwMilliseconds=0xa) [0184.782] timeGetTime () returned 0x40a2a [0184.782] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.782] Sleep (dwMilliseconds=0xa) [0184.795] timeGetTime () returned 0x40a3a [0184.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.795] Sleep (dwMilliseconds=0xa) [0184.813] timeGetTime () returned 0x40a49 [0184.813] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0184.813] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0184.813] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0184.813] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0184.813] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0184.813] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0184.813] RegCloseKey (hKey=0x240) returned 0x0 [0184.813] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0184.813] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0184.813] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0184.813] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0184.813] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0184.814] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0184.814] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0184.814] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0184.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0184.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9f8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0184.814] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0184.814] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0184.904] FreeLibrary (hLibModule=0x77150000) returned 1 [0184.904] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0184.904] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0184.904] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0184.904] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0184.904] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0184.904] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0184.904] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0184.905] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0184.905] timeGetTime () returned 0x40aa7 [0184.905] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.905] Sleep (dwMilliseconds=0xa) [0184.966] timeGetTime () returned 0x40ae6 [0184.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0184.966] Sleep (dwMilliseconds=0xa) [0185.017] timeGetTime () returned 0x40b15 [0185.017] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0185.017] TranslateMessage (lpMsg=0x8bf798) returned 0 [0185.017] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0185.017] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0185.017] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0185.018] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.018] Sleep (dwMilliseconds=0xa) [0185.061] timeGetTime () returned 0x40b43 [0185.061] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.061] Sleep (dwMilliseconds=0xa) [0185.115] timeGetTime () returned 0x40b72 [0185.115] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.115] Sleep (dwMilliseconds=0xa) [0185.155] timeGetTime () returned 0x40ba1 [0185.155] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.155] Sleep (dwMilliseconds=0xa) [0185.205] timeGetTime () returned 0x40bd0 [0185.205] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.205] Sleep (dwMilliseconds=0xa) [0185.218] timeGetTime () returned 0x40be0 [0185.218] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.219] Sleep (dwMilliseconds=0xa) [0185.234] timeGetTime () returned 0x40bef [0185.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.234] Sleep (dwMilliseconds=0xa) [0185.256] timeGetTime () returned 0x40bff [0185.256] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.256] Sleep (dwMilliseconds=0xa) [0185.290] timeGetTime () returned 0x40c1e [0185.290] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.290] Sleep (dwMilliseconds=0xa) [0185.310] timeGetTime () returned 0x40c3d [0185.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.311] Sleep (dwMilliseconds=0xa) [0185.326] timeGetTime () returned 0x40c4d [0185.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.326] Sleep (dwMilliseconds=0xa) [0185.342] timeGetTime () returned 0x40c5d [0185.342] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.342] Sleep (dwMilliseconds=0xa) [0185.358] timeGetTime () returned 0x40c6c [0185.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.359] Sleep (dwMilliseconds=0xa) [0185.373] timeGetTime () returned 0x40c7c [0185.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.373] Sleep (dwMilliseconds=0xa) [0185.389] timeGetTime () returned 0x40c8c [0185.389] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.389] Sleep (dwMilliseconds=0xa) [0185.404] timeGetTime () returned 0x40c9b [0185.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.404] Sleep (dwMilliseconds=0xa) [0185.422] timeGetTime () returned 0x40cab [0185.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.422] Sleep (dwMilliseconds=0xa) [0185.435] timeGetTime () returned 0x40cba [0185.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.435] Sleep (dwMilliseconds=0xa) [0185.451] timeGetTime () returned 0x40cca [0185.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.451] Sleep (dwMilliseconds=0xa) [0185.466] timeGetTime () returned 0x40cda [0185.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.466] Sleep (dwMilliseconds=0xa) [0185.483] timeGetTime () returned 0x40ce9 [0185.483] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.483] Sleep (dwMilliseconds=0xa) [0185.569] timeGetTime () returned 0x40d37 [0185.569] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.569] Sleep (dwMilliseconds=0xa) [0185.594] timeGetTime () returned 0x40d57 [0185.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.594] Sleep (dwMilliseconds=0xa) [0185.615] timeGetTime () returned 0x40d66 [0185.615] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.615] Sleep (dwMilliseconds=0xa) [0185.640] timeGetTime () returned 0x40d86 [0185.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.641] Sleep (dwMilliseconds=0xa) [0185.656] timeGetTime () returned 0x40d95 [0185.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.657] Sleep (dwMilliseconds=0xa) [0185.670] timeGetTime () returned 0x40da5 [0185.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.670] Sleep (dwMilliseconds=0xa) [0185.688] timeGetTime () returned 0x40db4 [0185.689] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.689] Sleep (dwMilliseconds=0xa) [0185.703] timeGetTime () returned 0x40dc4 [0185.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.703] Sleep (dwMilliseconds=0xa) [0185.716] timeGetTime () returned 0x40dd4 [0185.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.716] Sleep (dwMilliseconds=0xa) [0185.732] timeGetTime () returned 0x40de3 [0185.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.732] Sleep (dwMilliseconds=0xa) [0185.751] timeGetTime () returned 0x40df3 [0185.751] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.751] Sleep (dwMilliseconds=0xa) [0185.768] timeGetTime () returned 0x40e03 [0185.768] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.768] Sleep (dwMilliseconds=0xa) [0185.781] timeGetTime () returned 0x40e12 [0185.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0185.781] TranslateMessage (lpMsg=0x8bf798) returned 0 [0185.781] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0185.781] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0185.781] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0185.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.781] Sleep (dwMilliseconds=0xa) [0185.796] timeGetTime () returned 0x40e22 [0185.796] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.796] Sleep (dwMilliseconds=0xa) [0185.816] timeGetTime () returned 0x40e31 [0185.816] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.816] Sleep (dwMilliseconds=0xa) [0185.841] timeGetTime () returned 0x40e51 [0185.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.841] Sleep (dwMilliseconds=0xa) [0185.858] timeGetTime () returned 0x40e61 [0185.858] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.858] Sleep (dwMilliseconds=0xa) [0185.880] timeGetTime () returned 0x40e70 [0185.880] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.880] Sleep (dwMilliseconds=0xa) [0185.904] timeGetTime () returned 0x40e8f [0185.904] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0185.904] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0185.904] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0185.904] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0185.904] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0185.904] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0185.905] RegCloseKey (hKey=0x240) returned 0x0 [0185.905] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0185.905] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0185.905] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0185.905] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0185.905] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0185.905] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0185.905] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0185.905] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0185.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0185.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0185.905] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0185.906] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0185.998] FreeLibrary (hLibModule=0x77150000) returned 1 [0185.998] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0185.998] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0185.998] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0185.998] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0185.998] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0185.998] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0185.998] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0185.998] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0185.998] timeGetTime () returned 0x40eed [0185.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0185.998] Sleep (dwMilliseconds=0xa) [0186.107] timeGetTime () returned 0x40f5a [0186.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.107] Sleep (dwMilliseconds=0xa) [0186.157] timeGetTime () returned 0x40f89 [0186.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.157] Sleep (dwMilliseconds=0xa) [0186.204] timeGetTime () returned 0x40fb8 [0186.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.204] Sleep (dwMilliseconds=0xa) [0186.266] timeGetTime () returned 0x40ff7 [0186.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.266] Sleep (dwMilliseconds=0xa) [0186.304] timeGetTime () returned 0x41016 [0186.304] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.304] Sleep (dwMilliseconds=0xa) [0186.326] timeGetTime () returned 0x41035 [0186.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.326] Sleep (dwMilliseconds=0xa) [0186.341] timeGetTime () returned 0x41045 [0186.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.341] Sleep (dwMilliseconds=0xa) [0186.372] timeGetTime () returned 0x41064 [0186.372] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.373] Sleep (dwMilliseconds=0xa) [0186.404] timeGetTime () returned 0x41084 [0186.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.404] Sleep (dwMilliseconds=0xa) [0186.422] timeGetTime () returned 0x41093 [0186.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.422] Sleep (dwMilliseconds=0xa) [0186.453] timeGetTime () returned 0x410b2 [0186.454] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.454] Sleep (dwMilliseconds=0xa) [0186.583] timeGetTime () returned 0x4112f [0186.583] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0186.583] TranslateMessage (lpMsg=0x8bf798) returned 0 [0186.583] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0186.583] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0186.583] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0186.583] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.583] Sleep (dwMilliseconds=0xa) [0186.610] timeGetTime () returned 0x4114e [0186.610] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.610] Sleep (dwMilliseconds=0xa) [0186.623] timeGetTime () returned 0x4115e [0186.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.623] Sleep (dwMilliseconds=0xa) [0186.640] timeGetTime () returned 0x4116e [0186.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.640] Sleep (dwMilliseconds=0xa) [0186.658] timeGetTime () returned 0x4117d [0186.658] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.658] Sleep (dwMilliseconds=0xa) [0186.671] timeGetTime () returned 0x4118d [0186.671] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.671] Sleep (dwMilliseconds=0xa) [0186.685] timeGetTime () returned 0x4119c [0186.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.685] Sleep (dwMilliseconds=0xa) [0186.702] timeGetTime () returned 0x411ac [0186.702] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.702] Sleep (dwMilliseconds=0xa) [0186.717] timeGetTime () returned 0x411bc [0186.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.717] Sleep (dwMilliseconds=0xa) [0186.735] timeGetTime () returned 0x411cb [0186.735] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.735] Sleep (dwMilliseconds=0xa) [0186.747] timeGetTime () returned 0x411db [0186.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.747] Sleep (dwMilliseconds=0xa) [0186.766] timeGetTime () returned 0x411eb [0186.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.766] Sleep (dwMilliseconds=0xa) [0186.787] timeGetTime () returned 0x411fa [0186.787] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.787] Sleep (dwMilliseconds=0xa) [0186.815] timeGetTime () returned 0x41219 [0186.815] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.815] Sleep (dwMilliseconds=0xa) [0186.846] timeGetTime () returned 0x41239 [0186.846] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.846] Sleep (dwMilliseconds=0xa) [0186.859] timeGetTime () returned 0x41248 [0186.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.859] Sleep (dwMilliseconds=0xa) [0186.878] timeGetTime () returned 0x41258 [0186.878] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.878] Sleep (dwMilliseconds=0xa) [0186.908] timeGetTime () returned 0x41277 [0186.908] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.908] Sleep (dwMilliseconds=0xa) [0186.923] timeGetTime () returned 0x41287 [0186.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.923] Sleep (dwMilliseconds=0xa) [0186.938] timeGetTime () returned 0x41296 [0186.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.938] Sleep (dwMilliseconds=0xa) [0186.952] timeGetTime () returned 0x412a6 [0186.952] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.952] Sleep (dwMilliseconds=0xa) [0186.966] timeGetTime () returned 0x412b6 [0186.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.966] Sleep (dwMilliseconds=0xa) [0186.983] timeGetTime () returned 0x412c5 [0186.983] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0186.983] Sleep (dwMilliseconds=0xa) [0187.001] timeGetTime () returned 0x412d5 [0187.001] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0187.001] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0187.001] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0187.001] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0187.001] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0187.002] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0187.002] RegCloseKey (hKey=0x240) returned 0x0 [0187.002] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0187.002] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0187.002] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0187.002] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0187.002] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0187.002] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0187.002] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0187.002] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0187.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0187.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aab8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0187.003] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0187.003] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0187.091] FreeLibrary (hLibModule=0x77150000) returned 1 [0187.091] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0187.091] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0187.091] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0187.091] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0187.091] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0187.091] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0187.092] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0187.092] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0187.092] timeGetTime () returned 0x41333 [0187.092] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.092] Sleep (dwMilliseconds=0xa) [0187.153] timeGetTime () returned 0x41371 [0187.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.154] Sleep (dwMilliseconds=0xa) [0187.216] timeGetTime () returned 0x413b0 [0187.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.216] Sleep (dwMilliseconds=0xa) [0187.264] timeGetTime () returned 0x413df [0187.264] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.264] Sleep (dwMilliseconds=0xa) [0187.315] timeGetTime () returned 0x4140d [0187.315] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.315] Sleep (dwMilliseconds=0xa) [0187.358] timeGetTime () returned 0x4143c [0187.358] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0187.358] TranslateMessage (lpMsg=0x8bf798) returned 0 [0187.358] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0187.358] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0187.358] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.358] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.358] Sleep (dwMilliseconds=0xa) [0187.390] timeGetTime () returned 0x4145c [0187.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.390] Sleep (dwMilliseconds=0xa) [0187.406] timeGetTime () returned 0x4146b [0187.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.406] Sleep (dwMilliseconds=0xa) [0187.428] timeGetTime () returned 0x4147b [0187.428] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.428] Sleep (dwMilliseconds=0xa) [0187.459] timeGetTime () returned 0x4149a [0187.459] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.459] Sleep (dwMilliseconds=0xa) [0187.482] timeGetTime () returned 0x414b9 [0187.482] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.482] Sleep (dwMilliseconds=0xa) [0187.500] timeGetTime () returned 0x414c9 [0187.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.500] Sleep (dwMilliseconds=0xa) [0187.611] timeGetTime () returned 0x41536 [0187.611] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.611] Sleep (dwMilliseconds=0xa) [0187.625] timeGetTime () returned 0x41546 [0187.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.625] Sleep (dwMilliseconds=0xa) [0187.638] timeGetTime () returned 0x41556 [0187.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.638] Sleep (dwMilliseconds=0xa) [0187.656] timeGetTime () returned 0x41565 [0187.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.656] Sleep (dwMilliseconds=0xa) [0187.674] timeGetTime () returned 0x41575 [0187.674] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.674] Sleep (dwMilliseconds=0xa) [0187.688] timeGetTime () returned 0x41584 [0187.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.688] Sleep (dwMilliseconds=0xa) [0187.706] timeGetTime () returned 0x41594 [0187.706] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.706] Sleep (dwMilliseconds=0xa) [0187.734] timeGetTime () returned 0x415b3 [0187.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.734] Sleep (dwMilliseconds=0xa) [0187.752] timeGetTime () returned 0x415c3 [0187.752] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.752] Sleep (dwMilliseconds=0xa) [0187.764] timeGetTime () returned 0x415d3 [0187.764] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.764] Sleep (dwMilliseconds=0xa) [0187.783] timeGetTime () returned 0x415e2 [0187.783] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.783] Sleep (dwMilliseconds=0xa) [0187.795] timeGetTime () returned 0x415f2 [0187.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.795] Sleep (dwMilliseconds=0xa) [0187.811] timeGetTime () returned 0x41602 [0187.811] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.812] Sleep (dwMilliseconds=0xa) [0187.829] timeGetTime () returned 0x41611 [0187.829] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.829] Sleep (dwMilliseconds=0xa) [0187.842] timeGetTime () returned 0x41621 [0187.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.842] Sleep (dwMilliseconds=0xa) [0187.859] timeGetTime () returned 0x41630 [0187.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.859] Sleep (dwMilliseconds=0xa) [0187.879] timeGetTime () returned 0x41640 [0187.879] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.879] Sleep (dwMilliseconds=0xa) [0187.912] timeGetTime () returned 0x4165f [0187.912] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.912] Sleep (dwMilliseconds=0xa) [0187.942] timeGetTime () returned 0x4167e [0187.942] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.942] Sleep (dwMilliseconds=0xa) [0187.969] timeGetTime () returned 0x4169f [0187.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.969] Sleep (dwMilliseconds=0xa) [0187.982] timeGetTime () returned 0x416ad [0187.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0187.982] Sleep (dwMilliseconds=0xa) [0188.001] timeGetTime () returned 0x416bd [0188.001] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.001] Sleep (dwMilliseconds=0xa) [0188.015] timeGetTime () returned 0x416cd [0188.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.015] Sleep (dwMilliseconds=0xa) [0188.032] timeGetTime () returned 0x416dc [0188.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.032] Sleep (dwMilliseconds=0xa) [0188.047] timeGetTime () returned 0x416ec [0188.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.047] Sleep (dwMilliseconds=0xa) [0188.061] timeGetTime () returned 0x416fb [0188.061] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.061] Sleep (dwMilliseconds=0xa) [0188.076] timeGetTime () returned 0x4170b [0188.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.076] Sleep (dwMilliseconds=0xa) [0188.095] timeGetTime () returned 0x4171b [0188.095] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0188.095] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0188.095] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0188.095] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0188.095] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0188.095] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0188.095] RegCloseKey (hKey=0x240) returned 0x0 [0188.095] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0188.096] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0188.096] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0188.096] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0188.096] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0188.096] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0188.096] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0188.096] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0188.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0188.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0188.096] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0188.096] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0188.185] FreeLibrary (hLibModule=0x77150000) returned 1 [0188.185] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0188.185] TranslateMessage (lpMsg=0x8bf708) returned 0 [0188.185] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0188.185] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0188.185] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0188.185] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0188.185] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0188.185] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0188.185] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0188.186] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0188.186] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0188.186] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0188.186] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0188.186] timeGetTime () returned 0x41778 [0188.186] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.186] Sleep (dwMilliseconds=0xa) [0188.269] timeGetTime () returned 0x417c7 [0188.269] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.269] Sleep (dwMilliseconds=0xa) [0188.311] timeGetTime () returned 0x417f5 [0188.311] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.311] Sleep (dwMilliseconds=0xa) [0188.363] timeGetTime () returned 0x41824 [0188.363] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.363] Sleep (dwMilliseconds=0xa) [0188.405] timeGetTime () returned 0x41853 [0188.405] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.405] Sleep (dwMilliseconds=0xa) [0188.455] timeGetTime () returned 0x41882 [0188.455] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.455] Sleep (dwMilliseconds=0xa) [0188.467] timeGetTime () returned 0x41892 [0188.467] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.467] Sleep (dwMilliseconds=0xa) [0188.482] timeGetTime () returned 0x418a1 [0188.482] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.482] Sleep (dwMilliseconds=0xa) [0188.506] timeGetTime () returned 0x418b1 [0188.506] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.506] Sleep (dwMilliseconds=0xa) [0188.605] timeGetTime () returned 0x4190f [0188.605] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.605] Sleep (dwMilliseconds=0xa) [0188.634] timeGetTime () returned 0x4192e [0188.634] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.634] Sleep (dwMilliseconds=0xa) [0188.657] timeGetTime () returned 0x4194d [0188.657] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.657] Sleep (dwMilliseconds=0xa) [0188.673] timeGetTime () returned 0x4195d [0188.673] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.673] Sleep (dwMilliseconds=0xa) [0188.691] timeGetTime () returned 0x4196c [0188.691] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.691] Sleep (dwMilliseconds=0xa) [0188.718] timeGetTime () returned 0x4198c [0188.718] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.718] Sleep (dwMilliseconds=0xa) [0188.739] timeGetTime () returned 0x4199b [0188.739] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.739] Sleep (dwMilliseconds=0xa) [0188.821] timeGetTime () returned 0x419e9 [0188.821] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.821] Sleep (dwMilliseconds=0xa) [0188.842] timeGetTime () returned 0x41a09 [0188.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.842] Sleep (dwMilliseconds=0xa) [0188.857] timeGetTime () returned 0x41a18 [0188.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.857] Sleep (dwMilliseconds=0xa) [0188.878] timeGetTime () returned 0x41a28 [0188.878] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.878] Sleep (dwMilliseconds=0xa) [0188.906] timeGetTime () returned 0x41a47 [0188.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.906] Sleep (dwMilliseconds=0xa) [0188.921] timeGetTime () returned 0x41a57 [0188.921] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.921] Sleep (dwMilliseconds=0xa) [0188.941] timeGetTime () returned 0x41a66 [0188.941] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.941] Sleep (dwMilliseconds=0xa) [0188.992] timeGetTime () returned 0x41a95 [0188.992] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0188.992] TranslateMessage (lpMsg=0x8bf798) returned 0 [0188.992] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0188.992] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0188.992] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0188.992] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0188.992] Sleep (dwMilliseconds=0xa) [0189.017] timeGetTime () returned 0x41ab5 [0189.017] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.017] Sleep (dwMilliseconds=0xa) [0189.030] timeGetTime () returned 0x41ac4 [0189.030] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.030] Sleep (dwMilliseconds=0xa) [0189.047] timeGetTime () returned 0x41ad4 [0189.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.047] Sleep (dwMilliseconds=0xa) [0189.064] timeGetTime () returned 0x41ae3 [0189.064] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.064] Sleep (dwMilliseconds=0xa) [0189.079] timeGetTime () returned 0x41af3 [0189.079] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.079] Sleep (dwMilliseconds=0xa) [0189.091] timeGetTime () returned 0x41b03 [0189.091] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.091] Sleep (dwMilliseconds=0xa) [0189.108] timeGetTime () returned 0x41b12 [0189.108] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.108] Sleep (dwMilliseconds=0xa) [0189.131] timeGetTime () returned 0x41b22 [0189.131] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.131] Sleep (dwMilliseconds=0xa) [0189.157] timeGetTime () returned 0x41b41 [0189.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.157] Sleep (dwMilliseconds=0xa) [0189.172] timeGetTime () returned 0x41b51 [0189.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.172] Sleep (dwMilliseconds=0xa) [0189.186] timeGetTime () returned 0x41b60 [0189.186] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0189.186] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0189.186] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.186] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0189.186] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0189.186] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0189.186] RegCloseKey (hKey=0x240) returned 0x0 [0189.186] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0189.186] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0189.186] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0189.186] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0189.187] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0189.187] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0189.187] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0189.187] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0189.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0189.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0189.187] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0189.187] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0189.294] FreeLibrary (hLibModule=0x77150000) returned 1 [0189.294] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0189.294] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0189.294] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0189.295] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0189.295] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0189.295] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.295] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0189.295] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0189.295] timeGetTime () returned 0x41bce [0189.295] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.295] Sleep (dwMilliseconds=0xa) [0189.358] timeGetTime () returned 0x41c0d [0189.358] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.358] Sleep (dwMilliseconds=0xa) [0189.421] timeGetTime () returned 0x41c4c [0189.421] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.421] Sleep (dwMilliseconds=0xa) [0189.470] timeGetTime () returned 0x41c7a [0189.470] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.470] Sleep (dwMilliseconds=0xa) [0189.586] timeGetTime () returned 0x41ce7 [0189.586] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.586] Sleep (dwMilliseconds=0xa) [0189.647] timeGetTime () returned 0x41d26 [0189.647] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.647] Sleep (dwMilliseconds=0xa) [0189.670] timeGetTime () returned 0x41d45 [0189.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.670] Sleep (dwMilliseconds=0xa) [0189.694] timeGetTime () returned 0x41d54 [0189.694] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.694] Sleep (dwMilliseconds=0xa) [0189.720] timeGetTime () returned 0x41d74 [0189.720] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.720] Sleep (dwMilliseconds=0xa) [0189.732] timeGetTime () returned 0x41d83 [0189.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.732] Sleep (dwMilliseconds=0xa) [0189.751] timeGetTime () returned 0x41d93 [0189.751] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0189.751] TranslateMessage (lpMsg=0x8bf798) returned 0 [0189.751] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0189.751] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0189.751] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0189.751] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.751] Sleep (dwMilliseconds=0xa) [0189.766] timeGetTime () returned 0x41da3 [0189.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.766] Sleep (dwMilliseconds=0xa) [0189.782] timeGetTime () returned 0x41db2 [0189.782] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.782] Sleep (dwMilliseconds=0xa) [0189.795] timeGetTime () returned 0x41dc3 [0189.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.795] Sleep (dwMilliseconds=0xa) [0189.811] timeGetTime () returned 0x41dd1 [0189.811] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.811] Sleep (dwMilliseconds=0xa) [0189.828] timeGetTime () returned 0x41de1 [0189.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.828] Sleep (dwMilliseconds=0xa) [0189.844] timeGetTime () returned 0x41df1 [0189.845] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.845] Sleep (dwMilliseconds=0xa) [0189.859] timeGetTime () returned 0x41e00 [0189.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.859] Sleep (dwMilliseconds=0xa) [0189.874] timeGetTime () returned 0x41e10 [0189.874] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.874] Sleep (dwMilliseconds=0xa) [0189.889] timeGetTime () returned 0x41e20 [0189.889] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.889] Sleep (dwMilliseconds=0xa) [0189.911] timeGetTime () returned 0x41e2f [0189.911] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.911] Sleep (dwMilliseconds=0xa) [0189.948] timeGetTime () returned 0x41e4e [0189.948] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.948] Sleep (dwMilliseconds=0xa) [0189.968] timeGetTime () returned 0x41e6e [0189.968] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.968] Sleep (dwMilliseconds=0xa) [0189.984] timeGetTime () returned 0x41e7d [0189.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.984] Sleep (dwMilliseconds=0xa) [0189.999] timeGetTime () returned 0x41e8d [0189.999] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0189.999] Sleep (dwMilliseconds=0xa) [0190.016] timeGetTime () returned 0x41e9d [0190.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.016] Sleep (dwMilliseconds=0xa) [0190.031] timeGetTime () returned 0x41eac [0190.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.031] Sleep (dwMilliseconds=0xa) [0190.051] timeGetTime () returned 0x41ebc [0190.051] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.051] Sleep (dwMilliseconds=0xa) [0190.076] timeGetTime () returned 0x41edb [0190.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.076] Sleep (dwMilliseconds=0xa) [0190.093] timeGetTime () returned 0x41eeb [0190.093] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.093] Sleep (dwMilliseconds=0xa) [0190.115] timeGetTime () returned 0x41efa [0190.115] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.115] Sleep (dwMilliseconds=0xa) [0190.140] timeGetTime () returned 0x41f1a [0190.140] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.140] Sleep (dwMilliseconds=0xa) [0190.158] timeGetTime () returned 0x41f29 [0190.158] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.158] Sleep (dwMilliseconds=0xa) [0190.172] timeGetTime () returned 0x41f39 [0190.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.172] Sleep (dwMilliseconds=0xa) [0190.188] timeGetTime () returned 0x41f48 [0190.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.188] Sleep (dwMilliseconds=0xa) [0190.202] timeGetTime () returned 0x41f58 [0190.202] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.202] Sleep (dwMilliseconds=0xa) [0190.219] timeGetTime () returned 0x41f68 [0190.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.219] Sleep (dwMilliseconds=0xa) [0190.232] timeGetTime () returned 0x41f77 [0190.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.232] Sleep (dwMilliseconds=0xa) [0190.252] timeGetTime () returned 0x41f87 [0190.252] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.252] Sleep (dwMilliseconds=0xa) [0190.265] timeGetTime () returned 0x41f97 [0190.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.265] Sleep (dwMilliseconds=0xa) [0190.283] timeGetTime () returned 0x41fa6 [0190.283] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.283] Sleep (dwMilliseconds=0xa) [0190.298] timeGetTime () returned 0x41fb6 [0190.298] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0190.299] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0190.299] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.299] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0190.299] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0190.299] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0190.299] RegCloseKey (hKey=0x240) returned 0x0 [0190.299] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0190.299] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0190.299] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0190.299] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0190.299] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0190.299] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0190.299] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0190.300] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0190.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0190.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0190.300] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0190.300] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0190.388] FreeLibrary (hLibModule=0x77150000) returned 1 [0190.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0190.388] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0190.388] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0190.388] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0190.389] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0190.389] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.389] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0190.389] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0190.389] timeGetTime () returned 0x42014 [0190.389] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.389] Sleep (dwMilliseconds=0xa) [0190.450] timeGetTime () returned 0x42052 [0190.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.451] Sleep (dwMilliseconds=0xa) [0190.573] timeGetTime () returned 0x420bf [0190.573] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0190.573] TranslateMessage (lpMsg=0x8bf798) returned 0 [0190.573] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0190.573] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0190.573] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0190.573] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.573] Sleep (dwMilliseconds=0xa) [0190.638] timeGetTime () returned 0x4210e [0190.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.639] Sleep (dwMilliseconds=0xa) [0190.690] timeGetTime () returned 0x4213c [0190.690] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.690] Sleep (dwMilliseconds=0xa) [0190.733] timeGetTime () returned 0x4216b [0190.733] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.733] Sleep (dwMilliseconds=0xa) [0190.770] timeGetTime () returned 0x4218b [0190.770] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.770] Sleep (dwMilliseconds=0xa) [0190.799] timeGetTime () returned 0x421aa [0190.799] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.799] Sleep (dwMilliseconds=0xa) [0190.822] timeGetTime () returned 0x421b9 [0190.822] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.822] Sleep (dwMilliseconds=0xa) [0190.874] timeGetTime () returned 0x421f8 [0190.874] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.874] Sleep (dwMilliseconds=0xa) [0190.892] timeGetTime () returned 0x42208 [0190.892] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.892] Sleep (dwMilliseconds=0xa) [0190.906] timeGetTime () returned 0x42217 [0190.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.906] Sleep (dwMilliseconds=0xa) [0190.922] timeGetTime () returned 0x42227 [0190.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.922] Sleep (dwMilliseconds=0xa) [0190.938] timeGetTime () returned 0x42236 [0190.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.938] Sleep (dwMilliseconds=0xa) [0190.950] timeGetTime () returned 0x42246 [0190.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.951] Sleep (dwMilliseconds=0xa) [0190.967] timeGetTime () returned 0x42256 [0190.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.967] Sleep (dwMilliseconds=0xa) [0190.985] timeGetTime () returned 0x42265 [0190.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.985] Sleep (dwMilliseconds=0xa) [0190.998] timeGetTime () returned 0x42275 [0190.998] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0190.998] Sleep (dwMilliseconds=0xa) [0191.020] timeGetTime () returned 0x42285 [0191.020] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.020] Sleep (dwMilliseconds=0xa) [0191.048] timeGetTime () returned 0x422a4 [0191.048] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.048] Sleep (dwMilliseconds=0xa) [0191.061] timeGetTime () returned 0x422b3 [0191.061] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.061] Sleep (dwMilliseconds=0xa) [0191.078] timeGetTime () returned 0x422c5 [0191.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.078] Sleep (dwMilliseconds=0xa) [0191.092] timeGetTime () returned 0x422d3 [0191.092] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.092] Sleep (dwMilliseconds=0xa) [0191.109] timeGetTime () returned 0x422e2 [0191.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.109] Sleep (dwMilliseconds=0xa) [0191.122] timeGetTime () returned 0x422f2 [0191.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.122] Sleep (dwMilliseconds=0xa) [0191.139] timeGetTime () returned 0x42302 [0191.139] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.139] Sleep (dwMilliseconds=0xa) [0191.154] timeGetTime () returned 0x42311 [0191.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.154] Sleep (dwMilliseconds=0xa) [0191.170] timeGetTime () returned 0x42321 [0191.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.170] Sleep (dwMilliseconds=0xa) [0191.189] timeGetTime () returned 0x42330 [0191.189] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.189] Sleep (dwMilliseconds=0xa) [0191.204] timeGetTime () returned 0x42340 [0191.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.204] Sleep (dwMilliseconds=0xa) [0191.224] timeGetTime () returned 0x42350 [0191.224] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.224] Sleep (dwMilliseconds=0xa) [0191.248] timeGetTime () returned 0x4236f [0191.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.248] Sleep (dwMilliseconds=0xa) [0191.268] timeGetTime () returned 0x4237f [0191.268] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.268] Sleep (dwMilliseconds=0xa) [0191.284] timeGetTime () returned 0x4238e [0191.285] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.285] Sleep (dwMilliseconds=0xa) [0191.311] timeGetTime () returned 0x423ad [0191.311] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0191.311] TranslateMessage (lpMsg=0x8bf798) returned 0 [0191.311] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0191.311] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0191.311] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0191.311] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.311] Sleep (dwMilliseconds=0xa) [0191.326] timeGetTime () returned 0x423bd [0191.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.326] Sleep (dwMilliseconds=0xa) [0191.341] timeGetTime () returned 0x423cd [0191.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.341] Sleep (dwMilliseconds=0xa) [0191.359] timeGetTime () returned 0x423dc [0191.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.359] Sleep (dwMilliseconds=0xa) [0191.374] timeGetTime () returned 0x423ec [0191.374] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.374] Sleep (dwMilliseconds=0xa) [0191.388] timeGetTime () returned 0x423fc [0191.388] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0191.388] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0191.388] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0191.388] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0191.388] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0191.389] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0191.389] RegCloseKey (hKey=0x240) returned 0x0 [0191.389] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0191.389] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0191.389] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0191.389] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0191.389] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0191.389] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0191.389] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0191.389] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0191.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0191.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0191.389] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0191.390] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0191.495] FreeLibrary (hLibModule=0x77150000) returned 1 [0191.495] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0191.495] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0191.495] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0191.496] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0191.496] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0191.496] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0191.496] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0191.496] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0191.496] timeGetTime () returned 0x42459 [0191.496] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.496] Sleep (dwMilliseconds=0xa) [0191.638] timeGetTime () returned 0x424f6 [0191.638] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.638] Sleep (dwMilliseconds=0xa) [0191.706] timeGetTime () returned 0x42534 [0191.706] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.706] Sleep (dwMilliseconds=0xa) [0191.748] timeGetTime () returned 0x42563 [0191.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.748] Sleep (dwMilliseconds=0xa) [0191.799] timeGetTime () returned 0x42592 [0191.799] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.799] Sleep (dwMilliseconds=0xa) [0191.843] timeGetTime () returned 0x425c1 [0191.843] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.843] Sleep (dwMilliseconds=0xa) [0191.888] timeGetTime () returned 0x425f0 [0191.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.888] Sleep (dwMilliseconds=0xa) [0191.917] timeGetTime () returned 0x425ff [0191.917] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.917] Sleep (dwMilliseconds=0xa) [0191.938] timeGetTime () returned 0x4261e [0191.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.938] Sleep (dwMilliseconds=0xa) [0191.952] timeGetTime () returned 0x4262e [0191.952] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.952] Sleep (dwMilliseconds=0xa) [0191.969] timeGetTime () returned 0x4263e [0191.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.969] Sleep (dwMilliseconds=0xa) [0191.982] timeGetTime () returned 0x4264d [0191.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.982] Sleep (dwMilliseconds=0xa) [0191.999] timeGetTime () returned 0x4265d [0191.999] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0191.999] Sleep (dwMilliseconds=0xa) [0192.017] timeGetTime () returned 0x4266d [0192.017] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.017] Sleep (dwMilliseconds=0xa) [0192.029] timeGetTime () returned 0x4267c [0192.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.029] Sleep (dwMilliseconds=0xa) [0192.044] timeGetTime () returned 0x4268c [0192.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.044] Sleep (dwMilliseconds=0xa) [0192.064] timeGetTime () returned 0x4269b [0192.064] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.064] Sleep (dwMilliseconds=0xa) [0192.079] timeGetTime () returned 0x426ab [0192.079] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0192.079] TranslateMessage (lpMsg=0x8bf798) returned 0 [0192.080] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0192.080] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0192.080] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0192.080] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.080] Sleep (dwMilliseconds=0xa) [0192.094] timeGetTime () returned 0x426bb [0192.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.094] Sleep (dwMilliseconds=0xa) [0192.112] timeGetTime () returned 0x426ca [0192.112] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.112] Sleep (dwMilliseconds=0xa) [0192.125] timeGetTime () returned 0x426db [0192.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.125] Sleep (dwMilliseconds=0xa) [0192.144] timeGetTime () returned 0x426ea [0192.144] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.144] Sleep (dwMilliseconds=0xa) [0192.173] timeGetTime () returned 0x42709 [0192.173] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.173] Sleep (dwMilliseconds=0xa) [0192.190] timeGetTime () returned 0x42718 [0192.191] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.191] Sleep (dwMilliseconds=0xa) [0192.220] timeGetTime () returned 0x42738 [0192.220] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.220] Sleep (dwMilliseconds=0xa) [0192.232] timeGetTime () returned 0x42747 [0192.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.232] Sleep (dwMilliseconds=0xa) [0192.251] timeGetTime () returned 0x42757 [0192.251] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.251] Sleep (dwMilliseconds=0xa) [0192.265] timeGetTime () returned 0x42767 [0192.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.265] Sleep (dwMilliseconds=0xa) [0192.279] timeGetTime () returned 0x42776 [0192.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.279] Sleep (dwMilliseconds=0xa) [0192.298] timeGetTime () returned 0x42786 [0192.298] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.298] Sleep (dwMilliseconds=0xa) [0192.357] timeGetTime () returned 0x427c4 [0192.357] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.357] Sleep (dwMilliseconds=0xa) [0192.379] timeGetTime () returned 0x427d4 [0192.380] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.380] Sleep (dwMilliseconds=0xa) [0192.405] timeGetTime () returned 0x427f3 [0192.405] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.405] Sleep (dwMilliseconds=0xa) [0192.421] timeGetTime () returned 0x42803 [0192.421] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.421] Sleep (dwMilliseconds=0xa) [0192.436] timeGetTime () returned 0x42812 [0192.436] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.436] Sleep (dwMilliseconds=0xa) [0192.451] timeGetTime () returned 0x42822 [0192.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.451] Sleep (dwMilliseconds=0xa) [0192.467] timeGetTime () returned 0x42832 [0192.468] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.468] Sleep (dwMilliseconds=0xa) [0192.482] timeGetTime () returned 0x42841 [0192.482] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0192.482] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0192.482] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.482] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0192.482] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0192.482] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0192.483] RegCloseKey (hKey=0x240) returned 0x0 [0192.483] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0192.483] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0192.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0192.483] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0192.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0192.483] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0192.483] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0192.483] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0192.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0192.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0192.483] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0192.483] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0192.654] FreeLibrary (hLibModule=0x77150000) returned 1 [0192.654] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0192.654] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0192.654] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0192.654] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0192.654] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0192.654] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.654] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0192.654] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0192.654] timeGetTime () returned 0x428ed [0192.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.654] Sleep (dwMilliseconds=0xa) [0192.716] timeGetTime () returned 0x4292c [0192.716] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.716] Sleep (dwMilliseconds=0xa) [0192.768] timeGetTime () returned 0x4295b [0192.768] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.768] Sleep (dwMilliseconds=0xa) [0192.814] timeGetTime () returned 0x42989 [0192.814] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.814] Sleep (dwMilliseconds=0xa) [0192.863] timeGetTime () returned 0x429b8 [0192.863] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0192.863] TranslateMessage (lpMsg=0x8bf798) returned 0 [0192.863] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0192.863] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0192.863] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0192.863] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.863] Sleep (dwMilliseconds=0xa) [0192.904] timeGetTime () returned 0x429e7 [0192.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.904] Sleep (dwMilliseconds=0xa) [0192.920] timeGetTime () returned 0x429f7 [0192.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.920] Sleep (dwMilliseconds=0xa) [0192.935] timeGetTime () returned 0x42a06 [0192.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.935] Sleep (dwMilliseconds=0xa) [0192.953] timeGetTime () returned 0x42a16 [0192.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.953] Sleep (dwMilliseconds=0xa) [0192.976] timeGetTime () returned 0x42a26 [0192.976] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0192.976] Sleep (dwMilliseconds=0xa) [0193.000] timeGetTime () returned 0x42a45 [0193.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.000] Sleep (dwMilliseconds=0xa) [0193.017] timeGetTime () returned 0x42a55 [0193.018] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.018] Sleep (dwMilliseconds=0xa) [0193.029] timeGetTime () returned 0x42a64 [0193.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.029] Sleep (dwMilliseconds=0xa) [0193.044] timeGetTime () returned 0x42a74 [0193.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.044] Sleep (dwMilliseconds=0xa) [0193.060] timeGetTime () returned 0x42a83 [0193.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.060] Sleep (dwMilliseconds=0xa) [0193.076] timeGetTime () returned 0x42a93 [0193.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.076] Sleep (dwMilliseconds=0xa) [0193.094] timeGetTime () returned 0x42aa3 [0193.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.094] Sleep (dwMilliseconds=0xa) [0193.107] timeGetTime () returned 0x42ab2 [0193.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.107] Sleep (dwMilliseconds=0xa) [0193.126] timeGetTime () returned 0x42ac4 [0193.126] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.126] Sleep (dwMilliseconds=0xa) [0193.138] timeGetTime () returned 0x42ad2 [0193.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.138] Sleep (dwMilliseconds=0xa) [0193.157] timeGetTime () returned 0x42ae1 [0193.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.157] Sleep (dwMilliseconds=0xa) [0193.172] timeGetTime () returned 0x42af1 [0193.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.172] Sleep (dwMilliseconds=0xa) [0193.187] timeGetTime () returned 0x42b00 [0193.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.187] Sleep (dwMilliseconds=0xa) [0193.202] timeGetTime () returned 0x42b10 [0193.202] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.202] Sleep (dwMilliseconds=0xa) [0193.219] timeGetTime () returned 0x42b20 [0193.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.219] Sleep (dwMilliseconds=0xa) [0193.234] timeGetTime () returned 0x42b2f [0193.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.234] Sleep (dwMilliseconds=0xa) [0193.249] timeGetTime () returned 0x42b3f [0193.249] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.249] Sleep (dwMilliseconds=0xa) [0193.264] timeGetTime () returned 0x42b4f [0193.264] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.264] Sleep (dwMilliseconds=0xa) [0193.282] timeGetTime () returned 0x42b5e [0193.282] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.282] Sleep (dwMilliseconds=0xa) [0193.295] timeGetTime () returned 0x42b6e [0193.295] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.295] Sleep (dwMilliseconds=0xa) [0193.311] timeGetTime () returned 0x42b7d [0193.311] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.311] Sleep (dwMilliseconds=0xa) [0193.329] timeGetTime () returned 0x42b8d [0193.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.329] Sleep (dwMilliseconds=0xa) [0193.343] timeGetTime () returned 0x42b9d [0193.343] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.343] Sleep (dwMilliseconds=0xa) [0193.361] timeGetTime () returned 0x42bac [0193.361] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.361] Sleep (dwMilliseconds=0xa) [0193.373] timeGetTime () returned 0x42bbc [0193.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.373] Sleep (dwMilliseconds=0xa) [0193.390] timeGetTime () returned 0x42bcc [0193.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.390] Sleep (dwMilliseconds=0xa) [0193.405] timeGetTime () returned 0x42bdb [0193.405] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.405] Sleep (dwMilliseconds=0xa) [0193.453] timeGetTime () returned 0x42c0a [0193.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.453] Sleep (dwMilliseconds=0xa) [0193.601] timeGetTime () returned 0x42c97 [0193.601] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.601] Sleep (dwMilliseconds=0xa) [0193.658] timeGetTime () returned 0x42cd5 [0193.658] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 1 [0193.658] TranslateMessage (lpMsg=0x8bf968) returned 0 [0193.658] DispatchMessageW (lpMsg=0x8bf968) returned 0x0 [0193.658] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0193.658] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0193.658] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0193.658] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0193.658] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.658] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0193.658] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0193.658] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0193.659] RegCloseKey (hKey=0x240) returned 0x0 [0193.659] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0193.659] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0193.659] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0193.659] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0193.659] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0193.659] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0193.659] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0193.659] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0193.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0193.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0193.659] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0193.659] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0193.763] FreeLibrary (hLibModule=0x77150000) returned 1 [0193.763] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0193.763] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0193.763] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0193.763] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0193.763] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0193.763] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.764] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0193.764] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0193.764] timeGetTime () returned 0x42d43 [0193.764] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.764] Sleep (dwMilliseconds=0xa) [0193.857] timeGetTime () returned 0x42da0 [0193.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.857] Sleep (dwMilliseconds=0xa) [0193.950] timeGetTime () returned 0x42dfe [0193.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0193.951] Sleep (dwMilliseconds=0xa) [0194.044] timeGetTime () returned 0x42e5c [0194.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.044] Sleep (dwMilliseconds=0xa) [0194.095] timeGetTime () returned 0x42e8b [0194.095] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.095] Sleep (dwMilliseconds=0xa) [0194.141] timeGetTime () returned 0x42eba [0194.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.141] Sleep (dwMilliseconds=0xa) [0194.155] timeGetTime () returned 0x42ec9 [0194.155] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.155] Sleep (dwMilliseconds=0xa) [0194.170] timeGetTime () returned 0x42ed9 [0194.170] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.170] Sleep (dwMilliseconds=0xa) [0194.194] timeGetTime () returned 0x42ee8 [0194.194] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.194] Sleep (dwMilliseconds=0xa) [0194.230] timeGetTime () returned 0x42f08 [0194.230] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.230] Sleep (dwMilliseconds=0xa) [0194.249] timeGetTime () returned 0x42f27 [0194.249] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.249] Sleep (dwMilliseconds=0xa) [0194.263] timeGetTime () returned 0x42f37 [0194.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.263] Sleep (dwMilliseconds=0xa) [0194.279] timeGetTime () returned 0x42f46 [0194.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.279] Sleep (dwMilliseconds=0xa) [0194.295] timeGetTime () returned 0x42f56 [0194.295] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.295] Sleep (dwMilliseconds=0xa) [0194.310] timeGetTime () returned 0x42f65 [0194.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.310] Sleep (dwMilliseconds=0xa) [0194.326] timeGetTime () returned 0x42f75 [0194.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.326] Sleep (dwMilliseconds=0xa) [0194.346] timeGetTime () returned 0x42f85 [0194.346] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.346] Sleep (dwMilliseconds=0xa) [0194.358] timeGetTime () returned 0x42f94 [0194.358] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.358] Sleep (dwMilliseconds=0xa) [0194.375] timeGetTime () returned 0x42fa4 [0194.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.375] Sleep (dwMilliseconds=0xa) [0194.389] timeGetTime () returned 0x42fb4 [0194.389] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.389] Sleep (dwMilliseconds=0xa) [0194.405] timeGetTime () returned 0x42fc3 [0194.405] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.405] Sleep (dwMilliseconds=0xa) [0194.420] timeGetTime () returned 0x42fd3 [0194.420] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0194.420] TranslateMessage (lpMsg=0x8bf798) returned 0 [0194.420] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0194.420] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0194.420] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0194.420] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.420] Sleep (dwMilliseconds=0xa) [0194.437] timeGetTime () returned 0x42fe2 [0194.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.437] Sleep (dwMilliseconds=0xa) [0194.452] timeGetTime () returned 0x42ff2 [0194.452] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.452] Sleep (dwMilliseconds=0xa) [0194.467] timeGetTime () returned 0x43002 [0194.467] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.467] Sleep (dwMilliseconds=0xa) [0194.485] timeGetTime () returned 0x43011 [0194.485] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.485] Sleep (dwMilliseconds=0xa) [0194.499] timeGetTime () returned 0x43021 [0194.499] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.499] Sleep (dwMilliseconds=0xa) [0194.593] timeGetTime () returned 0x4307f [0194.593] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.593] Sleep (dwMilliseconds=0xa) [0194.608] timeGetTime () returned 0x4308e [0194.608] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.608] Sleep (dwMilliseconds=0xa) [0194.624] timeGetTime () returned 0x4309e [0194.624] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.625] Sleep (dwMilliseconds=0xa) [0194.640] timeGetTime () returned 0x430ae [0194.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.640] Sleep (dwMilliseconds=0xa) [0194.655] timeGetTime () returned 0x430bd [0194.655] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.655] Sleep (dwMilliseconds=0xa) [0194.670] timeGetTime () returned 0x430cd [0194.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.670] Sleep (dwMilliseconds=0xa) [0194.687] timeGetTime () returned 0x430dc [0194.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.687] Sleep (dwMilliseconds=0xa) [0194.701] timeGetTime () returned 0x430ec [0194.701] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.701] Sleep (dwMilliseconds=0xa) [0194.718] timeGetTime () returned 0x430fc [0194.718] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.718] Sleep (dwMilliseconds=0xa) [0194.734] timeGetTime () returned 0x4310b [0194.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.734] Sleep (dwMilliseconds=0xa) [0194.748] timeGetTime () returned 0x4311b [0194.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.749] Sleep (dwMilliseconds=0xa) [0194.764] timeGetTime () returned 0x4312b [0194.764] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0194.765] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0194.765] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0194.765] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0194.765] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0194.765] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0194.765] RegCloseKey (hKey=0x240) returned 0x0 [0194.765] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0194.765] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0194.765] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0194.765] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0194.765] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0194.765] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0194.765] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0194.765] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0194.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0194.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a998, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0194.766] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0194.766] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0194.857] FreeLibrary (hLibModule=0x77150000) returned 1 [0194.857] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0194.857] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0194.857] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0194.857] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0194.857] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0194.857] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0194.857] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0194.857] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0194.857] timeGetTime () returned 0x43188 [0194.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.857] Sleep (dwMilliseconds=0xa) [0194.919] timeGetTime () returned 0x431c7 [0194.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.919] Sleep (dwMilliseconds=0xa) [0194.966] timeGetTime () returned 0x431f6 [0194.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0194.967] Sleep (dwMilliseconds=0xa) [0195.018] timeGetTime () returned 0x43225 [0195.018] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.018] Sleep (dwMilliseconds=0xa) [0195.063] timeGetTime () returned 0x43253 [0195.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.063] Sleep (dwMilliseconds=0xa) [0195.107] timeGetTime () returned 0x43282 [0195.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.107] Sleep (dwMilliseconds=0xa) [0195.125] timeGetTime () returned 0x43292 [0195.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.125] Sleep (dwMilliseconds=0xa) [0195.141] timeGetTime () returned 0x432a2 [0195.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.141] Sleep (dwMilliseconds=0xa) [0195.165] timeGetTime () returned 0x432b1 [0195.165] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.165] Sleep (dwMilliseconds=0xa) [0195.187] timeGetTime () returned 0x432d0 [0195.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0195.187] TranslateMessage (lpMsg=0x8bf798) returned 0 [0195.188] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0195.188] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0195.188] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0195.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.188] Sleep (dwMilliseconds=0xa) [0195.200] timeGetTime () returned 0x432e0 [0195.200] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.200] Sleep (dwMilliseconds=0xa) [0195.216] timeGetTime () returned 0x432f0 [0195.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.216] Sleep (dwMilliseconds=0xa) [0195.232] timeGetTime () returned 0x432ff [0195.232] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.232] Sleep (dwMilliseconds=0xa) [0195.248] timeGetTime () returned 0x4330f [0195.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.248] Sleep (dwMilliseconds=0xa) [0195.264] timeGetTime () returned 0x4331f [0195.264] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.264] Sleep (dwMilliseconds=0xa) [0195.280] timeGetTime () returned 0x4332e [0195.280] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.280] Sleep (dwMilliseconds=0xa) [0195.295] timeGetTime () returned 0x4333e [0195.295] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.295] Sleep (dwMilliseconds=0xa) [0195.310] timeGetTime () returned 0x4334d [0195.310] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.310] Sleep (dwMilliseconds=0xa) [0195.326] timeGetTime () returned 0x4335d [0195.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.326] Sleep (dwMilliseconds=0xa) [0195.342] timeGetTime () returned 0x4336d [0195.342] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.342] Sleep (dwMilliseconds=0xa) [0195.359] timeGetTime () returned 0x4337c [0195.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.359] Sleep (dwMilliseconds=0xa) [0195.373] timeGetTime () returned 0x4338c [0195.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.373] Sleep (dwMilliseconds=0xa) [0195.389] timeGetTime () returned 0x4339c [0195.389] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.389] Sleep (dwMilliseconds=0xa) [0195.404] timeGetTime () returned 0x433ab [0195.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.404] Sleep (dwMilliseconds=0xa) [0195.420] timeGetTime () returned 0x433bb [0195.420] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.420] Sleep (dwMilliseconds=0xa) [0195.435] timeGetTime () returned 0x433ca [0195.435] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.435] Sleep (dwMilliseconds=0xa) [0195.451] timeGetTime () returned 0x433da [0195.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.451] Sleep (dwMilliseconds=0xa) [0195.466] timeGetTime () returned 0x433ea [0195.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.466] Sleep (dwMilliseconds=0xa) [0195.500] timeGetTime () returned 0x43409 [0195.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.500] Sleep (dwMilliseconds=0xa) [0195.571] timeGetTime () returned 0x43447 [0195.572] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.572] Sleep (dwMilliseconds=0xa) [0195.591] timeGetTime () returned 0x43467 [0195.591] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.591] Sleep (dwMilliseconds=0xa) [0195.608] timeGetTime () returned 0x43476 [0195.608] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.608] Sleep (dwMilliseconds=0xa) [0195.625] timeGetTime () returned 0x43486 [0195.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.625] Sleep (dwMilliseconds=0xa) [0195.639] timeGetTime () returned 0x43496 [0195.639] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.639] Sleep (dwMilliseconds=0xa) [0195.656] timeGetTime () returned 0x434a6 [0195.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.656] Sleep (dwMilliseconds=0xa) [0195.671] timeGetTime () returned 0x434b5 [0195.671] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.671] Sleep (dwMilliseconds=0xa) [0195.687] timeGetTime () returned 0x434c4 [0195.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.687] Sleep (dwMilliseconds=0xa) [0195.702] timeGetTime () returned 0x434d4 [0195.702] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.702] Sleep (dwMilliseconds=0xa) [0195.717] timeGetTime () returned 0x434e4 [0195.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.717] Sleep (dwMilliseconds=0xa) [0195.732] timeGetTime () returned 0x434f3 [0195.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.732] Sleep (dwMilliseconds=0xa) [0195.750] timeGetTime () returned 0x43503 [0195.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.750] Sleep (dwMilliseconds=0xa) [0195.764] timeGetTime () returned 0x43513 [0195.764] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.764] Sleep (dwMilliseconds=0xa) [0195.781] timeGetTime () returned 0x43522 [0195.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.781] Sleep (dwMilliseconds=0xa) [0195.795] timeGetTime () returned 0x43532 [0195.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.795] Sleep (dwMilliseconds=0xa) [0195.810] timeGetTime () returned 0x43541 [0195.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.810] Sleep (dwMilliseconds=0xa) [0195.840] timeGetTime () returned 0x43552 [0195.840] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.840] Sleep (dwMilliseconds=0xa) [0195.858] timeGetTime () returned 0x43570 [0195.858] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0195.858] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0195.858] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.858] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0195.858] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0195.858] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0195.859] RegCloseKey (hKey=0x240) returned 0x0 [0195.859] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0195.859] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0195.859] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0195.859] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0195.859] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0195.859] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0195.859] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0195.859] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0195.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0195.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9f8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0195.860] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0195.860] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0195.951] FreeLibrary (hLibModule=0x77150000) returned 1 [0195.951] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0195.951] TranslateMessage (lpMsg=0x8bf708) returned 0 [0195.951] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0195.951] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0195.951] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0195.951] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0195.951] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0195.951] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0195.951] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0195.951] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0195.951] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.951] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0195.951] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0195.952] timeGetTime () returned 0x435ce [0195.952] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0195.952] Sleep (dwMilliseconds=0xa) [0196.013] timeGetTime () returned 0x4360d [0196.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.013] Sleep (dwMilliseconds=0xa) [0196.060] timeGetTime () returned 0x4363c [0196.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.060] Sleep (dwMilliseconds=0xa) [0196.112] timeGetTime () returned 0x4366a [0196.112] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.112] Sleep (dwMilliseconds=0xa) [0196.157] timeGetTime () returned 0x43699 [0196.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.157] Sleep (dwMilliseconds=0xa) [0196.201] timeGetTime () returned 0x436c8 [0196.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.201] Sleep (dwMilliseconds=0xa) [0196.217] timeGetTime () returned 0x436d8 [0196.217] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.217] Sleep (dwMilliseconds=0xa) [0196.233] timeGetTime () returned 0x436e7 [0196.233] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.233] Sleep (dwMilliseconds=0xa) [0196.248] timeGetTime () returned 0x436f7 [0196.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.248] Sleep (dwMilliseconds=0xa) [0196.273] timeGetTime () returned 0x43707 [0196.273] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.274] Sleep (dwMilliseconds=0xa) [0196.306] timeGetTime () returned 0x43726 [0196.307] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.307] Sleep (dwMilliseconds=0xa) [0196.326] timeGetTime () returned 0x43745 [0196.326] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.326] Sleep (dwMilliseconds=0xa) [0196.341] timeGetTime () returned 0x43755 [0196.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.341] Sleep (dwMilliseconds=0xa) [0196.358] timeGetTime () returned 0x43764 [0196.358] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.358] Sleep (dwMilliseconds=0xa) [0196.374] timeGetTime () returned 0x43774 [0196.374] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.374] Sleep (dwMilliseconds=0xa) [0196.388] timeGetTime () returned 0x43784 [0196.388] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.388] Sleep (dwMilliseconds=0xa) [0196.405] timeGetTime () returned 0x43793 [0196.405] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.405] Sleep (dwMilliseconds=0xa) [0196.420] timeGetTime () returned 0x437a3 [0196.420] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.420] Sleep (dwMilliseconds=0xa) [0196.437] timeGetTime () returned 0x437b3 [0196.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.437] Sleep (dwMilliseconds=0xa) [0196.451] timeGetTime () returned 0x437c2 [0196.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.451] Sleep (dwMilliseconds=0xa) [0196.486] timeGetTime () returned 0x437e1 [0196.486] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.486] Sleep (dwMilliseconds=0xa) [0196.498] timeGetTime () returned 0x437f1 [0196.499] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.499] Sleep (dwMilliseconds=0xa) [0196.631] timeGetTime () returned 0x4386e [0196.631] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.631] Sleep (dwMilliseconds=0xa) [0196.678] timeGetTime () returned 0x4389d [0196.678] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.678] Sleep (dwMilliseconds=0xa) [0196.706] timeGetTime () returned 0x438bc [0196.706] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0196.707] TranslateMessage (lpMsg=0x8bf798) returned 0 [0196.707] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0196.707] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0196.707] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0196.707] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.707] Sleep (dwMilliseconds=0xa) [0196.734] timeGetTime () returned 0x438db [0196.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.734] Sleep (dwMilliseconds=0xa) [0196.750] timeGetTime () returned 0x438eb [0196.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.750] Sleep (dwMilliseconds=0xa) [0196.765] timeGetTime () returned 0x438fb [0196.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.765] Sleep (dwMilliseconds=0xa) [0196.780] timeGetTime () returned 0x4390a [0196.780] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.780] Sleep (dwMilliseconds=0xa) [0196.796] timeGetTime () returned 0x4391a [0196.796] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.796] Sleep (dwMilliseconds=0xa) [0196.810] timeGetTime () returned 0x43929 [0196.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.810] Sleep (dwMilliseconds=0xa) [0196.826] timeGetTime () returned 0x4393a [0196.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.826] Sleep (dwMilliseconds=0xa) [0196.842] timeGetTime () returned 0x43949 [0196.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.842] Sleep (dwMilliseconds=0xa) [0196.859] timeGetTime () returned 0x43958 [0196.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.859] Sleep (dwMilliseconds=0xa) [0196.872] timeGetTime () returned 0x43968 [0196.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.873] Sleep (dwMilliseconds=0xa) [0196.889] timeGetTime () returned 0x43978 [0196.889] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.889] Sleep (dwMilliseconds=0xa) [0196.904] timeGetTime () returned 0x43987 [0196.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.904] Sleep (dwMilliseconds=0xa) [0196.919] timeGetTime () returned 0x43997 [0196.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.919] Sleep (dwMilliseconds=0xa) [0196.936] timeGetTime () returned 0x439a7 [0196.936] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0196.936] Sleep (dwMilliseconds=0xa) [0196.952] timeGetTime () returned 0x439b6 [0196.952] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0196.952] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0196.952] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.952] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0196.953] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0196.953] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0196.953] RegCloseKey (hKey=0x240) returned 0x0 [0196.953] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0196.953] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0196.953] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0196.953] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0196.953] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0196.953] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0196.953] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0196.953] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0196.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0196.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9f8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0196.954] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0196.954] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0197.108] FreeLibrary (hLibModule=0x77150000) returned 1 [0197.109] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0197.109] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0197.109] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0197.109] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0197.109] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0197.109] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0197.109] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0197.109] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0197.109] timeGetTime () returned 0x43a53 [0197.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.109] Sleep (dwMilliseconds=0xa) [0197.174] timeGetTime () returned 0x43a91 [0197.174] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.174] Sleep (dwMilliseconds=0xa) [0197.217] timeGetTime () returned 0x43ac0 [0197.217] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.217] Sleep (dwMilliseconds=0xa) [0197.252] timeGetTime () returned 0x43adf [0197.252] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.252] Sleep (dwMilliseconds=0xa) [0197.297] timeGetTime () returned 0x43b0e [0197.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.297] Sleep (dwMilliseconds=0xa) [0197.341] timeGetTime () returned 0x43b3d [0197.341] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.341] Sleep (dwMilliseconds=0xa) [0197.373] timeGetTime () returned 0x43b5c [0197.373] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.373] Sleep (dwMilliseconds=0xa) [0197.389] timeGetTime () returned 0x43b6c [0197.389] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.389] Sleep (dwMilliseconds=0xa) [0197.413] timeGetTime () returned 0x43b7b [0197.413] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.414] Sleep (dwMilliseconds=0xa) [0197.441] timeGetTime () returned 0x43b9b [0197.441] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.441] Sleep (dwMilliseconds=0xa) [0197.467] timeGetTime () returned 0x43bba [0197.467] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0197.467] TranslateMessage (lpMsg=0x8bf798) returned 0 [0197.467] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0197.467] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0197.467] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0197.467] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.467] Sleep (dwMilliseconds=0xa) [0197.484] timeGetTime () returned 0x43bc9 [0197.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.484] Sleep (dwMilliseconds=0xa) [0197.500] timeGetTime () returned 0x43bd9 [0197.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.500] Sleep (dwMilliseconds=0xa) [0197.589] timeGetTime () returned 0x43c27 [0197.589] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.589] Sleep (dwMilliseconds=0xa) [0197.608] timeGetTime () returned 0x43c46 [0197.608] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.608] Sleep (dwMilliseconds=0xa) [0197.624] timeGetTime () returned 0x43c56 [0197.624] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.624] Sleep (dwMilliseconds=0xa) [0197.640] timeGetTime () returned 0x43c66 [0197.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.640] Sleep (dwMilliseconds=0xa) [0197.656] timeGetTime () returned 0x43c77 [0197.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.656] Sleep (dwMilliseconds=0xa) [0197.671] timeGetTime () returned 0x43c85 [0197.671] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.671] Sleep (dwMilliseconds=0xa) [0197.685] timeGetTime () returned 0x43c94 [0197.685] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.685] Sleep (dwMilliseconds=0xa) [0197.702] timeGetTime () returned 0x43ca6 [0197.702] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.702] Sleep (dwMilliseconds=0xa) [0197.717] timeGetTime () returned 0x43cb4 [0197.717] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.717] Sleep (dwMilliseconds=0xa) [0197.733] timeGetTime () returned 0x43cc3 [0197.733] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.733] Sleep (dwMilliseconds=0xa) [0197.748] timeGetTime () returned 0x43cd3 [0197.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.748] Sleep (dwMilliseconds=0xa) [0197.764] timeGetTime () returned 0x43ce3 [0197.764] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.764] Sleep (dwMilliseconds=0xa) [0197.794] timeGetTime () returned 0x43cf2 [0197.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.794] Sleep (dwMilliseconds=0xa) [0197.812] timeGetTime () returned 0x43d11 [0197.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.812] Sleep (dwMilliseconds=0xa) [0197.827] timeGetTime () returned 0x43d21 [0197.827] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.828] Sleep (dwMilliseconds=0xa) [0197.842] timeGetTime () returned 0x43d31 [0197.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.842] Sleep (dwMilliseconds=0xa) [0197.857] timeGetTime () returned 0x43d40 [0197.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.857] Sleep (dwMilliseconds=0xa) [0197.873] timeGetTime () returned 0x43d50 [0197.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.873] Sleep (dwMilliseconds=0xa) [0197.892] timeGetTime () returned 0x43d60 [0197.892] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.892] Sleep (dwMilliseconds=0xa) [0197.904] timeGetTime () returned 0x43d6f [0197.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.904] Sleep (dwMilliseconds=0xa) [0197.919] timeGetTime () returned 0x43d7f [0197.919] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.919] Sleep (dwMilliseconds=0xa) [0197.938] timeGetTime () returned 0x43d8e [0197.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.938] Sleep (dwMilliseconds=0xa) [0197.951] timeGetTime () returned 0x43d9e [0197.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.951] Sleep (dwMilliseconds=0xa) [0197.969] timeGetTime () returned 0x43dae [0197.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.969] Sleep (dwMilliseconds=0xa) [0197.984] timeGetTime () returned 0x43dbd [0197.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.984] Sleep (dwMilliseconds=0xa) [0197.999] timeGetTime () returned 0x43dcd [0197.999] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0197.999] Sleep (dwMilliseconds=0xa) [0198.015] timeGetTime () returned 0x43ddd [0198.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.015] Sleep (dwMilliseconds=0xa) [0198.032] timeGetTime () returned 0x43dec [0198.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.032] Sleep (dwMilliseconds=0xa) [0198.047] timeGetTime () returned 0x43dfc [0198.048] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.048] Sleep (dwMilliseconds=0xa) [0198.061] timeGetTime () returned 0x43e0c [0198.061] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.061] Sleep (dwMilliseconds=0xa) [0198.076] timeGetTime () returned 0x43e1b [0198.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.076] Sleep (dwMilliseconds=0xa) [0198.092] timeGetTime () returned 0x43e2b [0198.092] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.092] Sleep (dwMilliseconds=0xa) [0198.107] timeGetTime () returned 0x43e3a [0198.107] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.107] Sleep (dwMilliseconds=0xa) [0198.122] timeGetTime () returned 0x43e4a [0198.122] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0198.122] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0198.122] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0198.123] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0198.123] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0198.123] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0198.123] RegCloseKey (hKey=0x240) returned 0x0 [0198.123] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0198.123] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0198.123] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0198.123] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0198.123] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0198.123] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0198.123] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0198.123] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0198.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0198.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0198.124] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0198.124] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0198.216] FreeLibrary (hLibModule=0x77150000) returned 1 [0198.216] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0198.216] TranslateMessage (lpMsg=0x8bf708) returned 0 [0198.216] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0198.216] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0198.217] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0198.217] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0198.217] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0198.217] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0198.217] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0198.217] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0198.217] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0198.217] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0198.217] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0198.217] timeGetTime () returned 0x43ea8 [0198.217] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.217] Sleep (dwMilliseconds=0xa) [0198.279] timeGetTime () returned 0x43ee6 [0198.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.279] Sleep (dwMilliseconds=0xa) [0198.329] timeGetTime () returned 0x43f15 [0198.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.329] Sleep (dwMilliseconds=0xa) [0198.374] timeGetTime () returned 0x43f44 [0198.374] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.374] Sleep (dwMilliseconds=0xa) [0198.421] timeGetTime () returned 0x43f73 [0198.421] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.421] Sleep (dwMilliseconds=0xa) [0198.466] timeGetTime () returned 0x43f92 [0198.466] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.466] Sleep (dwMilliseconds=0xa) [0198.483] timeGetTime () returned 0x43fb1 [0198.483] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.483] Sleep (dwMilliseconds=0xa) [0198.510] timeGetTime () returned 0x43fc1 [0198.510] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.510] Sleep (dwMilliseconds=0xa) [0198.573] timeGetTime () returned 0x43fff [0198.573] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.574] Sleep (dwMilliseconds=0xa) [0198.597] timeGetTime () returned 0x4401f [0198.597] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.597] Sleep (dwMilliseconds=0xa) [0198.623] timeGetTime () returned 0x4403e [0198.623] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.623] Sleep (dwMilliseconds=0xa) [0198.639] timeGetTime () returned 0x4404e [0198.639] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.639] Sleep (dwMilliseconds=0xa) [0198.654] timeGetTime () returned 0x4405d [0198.654] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.654] Sleep (dwMilliseconds=0xa) [0198.669] timeGetTime () returned 0x4406d [0198.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.670] Sleep (dwMilliseconds=0xa) [0198.687] timeGetTime () returned 0x4407c [0198.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.687] Sleep (dwMilliseconds=0xa) [0198.703] timeGetTime () returned 0x4408c [0198.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.703] Sleep (dwMilliseconds=0xa) [0198.718] timeGetTime () returned 0x4409c [0198.718] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.718] Sleep (dwMilliseconds=0xa) [0198.732] timeGetTime () returned 0x440ab [0198.732] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.732] Sleep (dwMilliseconds=0xa) [0198.749] timeGetTime () returned 0x440bb [0198.749] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.749] Sleep (dwMilliseconds=0xa) [0198.763] timeGetTime () returned 0x440cb [0198.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.764] Sleep (dwMilliseconds=0xa) [0198.782] timeGetTime () returned 0x440da [0198.782] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.782] Sleep (dwMilliseconds=0xa) [0198.794] timeGetTime () returned 0x440ea [0198.794] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.794] Sleep (dwMilliseconds=0xa) [0198.812] timeGetTime () returned 0x440f9 [0198.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.812] Sleep (dwMilliseconds=0xa) [0198.826] timeGetTime () returned 0x44109 [0198.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.826] Sleep (dwMilliseconds=0xa) [0198.842] timeGetTime () returned 0x44119 [0198.842] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.842] Sleep (dwMilliseconds=0xa) [0198.858] timeGetTime () returned 0x44128 [0198.858] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.858] Sleep (dwMilliseconds=0xa) [0198.874] timeGetTime () returned 0x44138 [0198.874] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.874] Sleep (dwMilliseconds=0xa) [0198.888] timeGetTime () returned 0x44148 [0198.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.888] Sleep (dwMilliseconds=0xa) [0198.906] timeGetTime () returned 0x44157 [0198.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.906] Sleep (dwMilliseconds=0xa) [0198.920] timeGetTime () returned 0x44167 [0198.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.920] Sleep (dwMilliseconds=0xa) [0198.935] timeGetTime () returned 0x44177 [0198.935] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.935] Sleep (dwMilliseconds=0xa) [0198.951] timeGetTime () returned 0x44186 [0198.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.951] Sleep (dwMilliseconds=0xa) [0198.969] timeGetTime () returned 0x44196 [0198.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.969] Sleep (dwMilliseconds=0xa) [0198.983] timeGetTime () returned 0x441a5 [0198.983] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0198.983] TranslateMessage (lpMsg=0x8bf798) returned 0 [0198.983] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0198.983] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0198.983] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0198.983] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0198.983] Sleep (dwMilliseconds=0xa) [0199.029] timeGetTime () returned 0x441d4 [0199.029] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.029] Sleep (dwMilliseconds=0xa) [0199.076] timeGetTime () returned 0x44203 [0199.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.076] Sleep (dwMilliseconds=0xa) [0199.122] timeGetTime () returned 0x44232 [0199.122] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.122] Sleep (dwMilliseconds=0xa) [0199.148] timeGetTime () returned 0x44242 [0199.148] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.148] Sleep (dwMilliseconds=0xa) [0199.176] timeGetTime () returned 0x44261 [0199.176] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.176] Sleep (dwMilliseconds=0xa) [0199.204] timeGetTime () returned 0x44280 [0199.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.204] Sleep (dwMilliseconds=0xa) [0199.217] timeGetTime () returned 0x44290 [0199.217] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0199.217] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0199.217] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0199.217] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0199.217] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0199.217] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0199.217] RegCloseKey (hKey=0x240) returned 0x0 [0199.218] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0199.218] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0199.218] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0199.218] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0199.218] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0199.218] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0199.218] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0199.218] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0199.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0199.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab18, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0199.218] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0199.218] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0199.310] FreeLibrary (hLibModule=0x77150000) returned 1 [0199.310] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0199.310] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0199.311] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0199.311] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0199.311] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0199.311] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0199.311] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0199.311] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0199.311] timeGetTime () returned 0x442ed [0199.311] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.311] Sleep (dwMilliseconds=0xa) [0199.358] timeGetTime () returned 0x4431c [0199.358] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.358] Sleep (dwMilliseconds=0xa) [0199.404] timeGetTime () returned 0x4434b [0199.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.404] Sleep (dwMilliseconds=0xa) [0199.554] timeGetTime () returned 0x443d8 [0199.554] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.554] Sleep (dwMilliseconds=0xa) [0199.593] timeGetTime () returned 0x44407 [0199.593] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.593] Sleep (dwMilliseconds=0xa) [0199.639] timeGetTime () returned 0x44436 [0199.639] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.639] Sleep (dwMilliseconds=0xa) [0199.658] timeGetTime () returned 0x44445 [0199.658] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.658] Sleep (dwMilliseconds=0xa) [0199.670] timeGetTime () returned 0x44455 [0199.670] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.670] Sleep (dwMilliseconds=0xa) [0199.687] timeGetTime () returned 0x44464 [0199.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.687] Sleep (dwMilliseconds=0xa) [0199.716] timeGetTime () returned 0x44474 [0199.726] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.726] Sleep (dwMilliseconds=0xa) [0199.753] timeGetTime () returned 0x444a3 [0199.753] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0199.753] TranslateMessage (lpMsg=0x8bf798) returned 0 [0199.753] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0199.753] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0199.754] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0199.754] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.754] Sleep (dwMilliseconds=0xa) [0199.781] timeGetTime () returned 0x444c2 [0199.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.781] Sleep (dwMilliseconds=0xa) [0199.795] timeGetTime () returned 0x444d2 [0199.795] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.795] Sleep (dwMilliseconds=0xa) [0199.810] timeGetTime () returned 0x444e2 [0199.810] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.810] Sleep (dwMilliseconds=0xa) [0199.825] timeGetTime () returned 0x444f1 [0199.825] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.825] Sleep (dwMilliseconds=0xa) [0199.841] timeGetTime () returned 0x44501 [0199.841] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.841] Sleep (dwMilliseconds=0xa) [0199.859] timeGetTime () returned 0x44510 [0199.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.859] Sleep (dwMilliseconds=0xa) [0199.873] timeGetTime () returned 0x44520 [0199.873] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.874] Sleep (dwMilliseconds=0xa) [0199.888] timeGetTime () returned 0x44530 [0199.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.888] Sleep (dwMilliseconds=0xa) [0199.904] timeGetTime () returned 0x4453f [0199.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.904] Sleep (dwMilliseconds=0xa) [0199.920] timeGetTime () returned 0x4454f [0199.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.920] Sleep (dwMilliseconds=0xa) [0199.936] timeGetTime () returned 0x4455e [0199.936] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.936] Sleep (dwMilliseconds=0xa) [0199.951] timeGetTime () returned 0x4456e [0199.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.951] Sleep (dwMilliseconds=0xa) [0199.968] timeGetTime () returned 0x4457e [0199.968] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.968] Sleep (dwMilliseconds=0xa) [0199.982] timeGetTime () returned 0x4458d [0199.982] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.982] Sleep (dwMilliseconds=0xa) [0199.997] timeGetTime () returned 0x4459d [0199.997] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0199.997] Sleep (dwMilliseconds=0xa) [0200.014] timeGetTime () returned 0x445ad [0200.014] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.014] Sleep (dwMilliseconds=0xa) [0200.030] timeGetTime () returned 0x445bc [0200.030] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.030] Sleep (dwMilliseconds=0xa) [0200.045] timeGetTime () returned 0x445cc [0200.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.045] Sleep (dwMilliseconds=0xa) [0200.061] timeGetTime () returned 0x445db [0200.061] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.061] Sleep (dwMilliseconds=0xa) [0200.076] timeGetTime () returned 0x445eb [0200.076] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.076] Sleep (dwMilliseconds=0xa) [0200.093] timeGetTime () returned 0x445fb [0200.093] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.093] Sleep (dwMilliseconds=0xa) [0200.108] timeGetTime () returned 0x4460a [0200.108] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.108] Sleep (dwMilliseconds=0xa) [0200.123] timeGetTime () returned 0x4461a [0200.123] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.123] Sleep (dwMilliseconds=0xa) [0200.138] timeGetTime () returned 0x4462a [0200.138] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.139] Sleep (dwMilliseconds=0xa) [0200.156] timeGetTime () returned 0x44639 [0200.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.156] Sleep (dwMilliseconds=0xa) [0200.169] timeGetTime () returned 0x44649 [0200.169] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.169] Sleep (dwMilliseconds=0xa) [0200.186] timeGetTime () returned 0x44658 [0200.186] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.186] Sleep (dwMilliseconds=0xa) [0200.201] timeGetTime () returned 0x44668 [0200.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.201] Sleep (dwMilliseconds=0xa) [0200.217] timeGetTime () returned 0x44678 [0200.217] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.217] Sleep (dwMilliseconds=0xa) [0200.234] timeGetTime () returned 0x44687 [0200.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.234] Sleep (dwMilliseconds=0xa) [0200.249] timeGetTime () returned 0x44697 [0200.249] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.249] Sleep (dwMilliseconds=0xa) [0200.263] timeGetTime () returned 0x446a7 [0200.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.263] Sleep (dwMilliseconds=0xa) [0200.279] timeGetTime () returned 0x446b6 [0200.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.279] Sleep (dwMilliseconds=0xa) [0200.295] timeGetTime () returned 0x446c6 [0200.295] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.295] Sleep (dwMilliseconds=0xa) [0200.311] timeGetTime () returned 0x446d5 [0200.311] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0200.311] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0200.311] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0200.311] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0200.311] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0200.311] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0200.312] RegCloseKey (hKey=0x240) returned 0x0 [0200.312] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0200.312] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0200.312] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0200.312] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0200.312] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0200.312] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0200.312] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0200.312] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0200.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0200.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac98, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0200.312] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0200.312] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0200.404] FreeLibrary (hLibModule=0x77150000) returned 1 [0200.404] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0200.404] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0200.404] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0200.404] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0200.404] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0200.404] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0200.404] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0200.404] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0200.404] timeGetTime () returned 0x44733 [0200.404] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.404] Sleep (dwMilliseconds=0xa) [0200.460] timeGetTime () returned 0x44762 [0200.460] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.460] Sleep (dwMilliseconds=0xa) [0200.500] timeGetTime () returned 0x44791 [0200.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.500] Sleep (dwMilliseconds=0xa) [0200.592] timeGetTime () returned 0x447ef [0200.592] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0200.592] TranslateMessage (lpMsg=0x8bf798) returned 0 [0200.592] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0200.592] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0200.592] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0200.592] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.592] Sleep (dwMilliseconds=0xa) [0200.639] timeGetTime () returned 0x4481e [0200.639] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.640] Sleep (dwMilliseconds=0xa) [0200.686] timeGetTime () returned 0x4484c [0200.686] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.686] Sleep (dwMilliseconds=0xa) [0200.726] timeGetTime () returned 0x4486c [0200.726] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.726] Sleep (dwMilliseconds=0xa) [0200.748] timeGetTime () returned 0x4488b [0200.748] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.748] Sleep (dwMilliseconds=0xa) [0200.763] timeGetTime () returned 0x4489b [0200.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.763] Sleep (dwMilliseconds=0xa) [0200.788] timeGetTime () returned 0x448aa [0200.788] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.788] Sleep (dwMilliseconds=0xa) [0200.811] timeGetTime () returned 0x448ca [0200.811] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.811] Sleep (dwMilliseconds=0xa) [0200.826] timeGetTime () returned 0x448d9 [0200.826] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.826] Sleep (dwMilliseconds=0xa) [0200.844] timeGetTime () returned 0x448e9 [0200.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.844] Sleep (dwMilliseconds=0xa) [0200.857] timeGetTime () returned 0x448f8 [0200.857] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.857] Sleep (dwMilliseconds=0xa) [0200.874] timeGetTime () returned 0x44908 [0200.874] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.874] Sleep (dwMilliseconds=0xa) [0200.888] timeGetTime () returned 0x44918 [0200.888] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.888] Sleep (dwMilliseconds=0xa) [0200.904] timeGetTime () returned 0x44927 [0200.904] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.904] Sleep (dwMilliseconds=0xa) [0200.921] timeGetTime () returned 0x44938 [0200.921] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.921] Sleep (dwMilliseconds=0xa) [0200.936] timeGetTime () returned 0x44946 [0200.936] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.936] Sleep (dwMilliseconds=0xa) [0200.951] timeGetTime () returned 0x44956 [0200.951] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.951] Sleep (dwMilliseconds=0xa) [0200.967] timeGetTime () returned 0x44966 [0200.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.967] Sleep (dwMilliseconds=0xa) [0200.993] timeGetTime () returned 0x44975 [0200.993] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0200.993] Sleep (dwMilliseconds=0xa) [0201.014] timeGetTime () returned 0x44995 [0201.014] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.014] Sleep (dwMilliseconds=0xa) [0201.037] timeGetTime () returned 0x449a4 [0201.037] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.037] Sleep (dwMilliseconds=0xa) [0201.062] timeGetTime () returned 0x449c3 [0201.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.062] Sleep (dwMilliseconds=0xa) [0201.084] timeGetTime () returned 0x449d3 [0201.084] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.084] Sleep (dwMilliseconds=0xa) [0201.108] timeGetTime () returned 0x449f2 [0201.108] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.108] Sleep (dwMilliseconds=0xa) [0201.130] timeGetTime () returned 0x44a02 [0201.130] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.130] Sleep (dwMilliseconds=0xa) [0201.154] timeGetTime () returned 0x44a21 [0201.154] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.154] Sleep (dwMilliseconds=0xa) [0201.175] timeGetTime () returned 0x44a31 [0201.175] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.175] Sleep (dwMilliseconds=0xa) [0201.201] timeGetTime () returned 0x44a50 [0201.201] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.201] Sleep (dwMilliseconds=0xa) [0201.216] timeGetTime () returned 0x44a60 [0201.216] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.216] Sleep (dwMilliseconds=0xa) [0201.235] timeGetTime () returned 0x44a6f [0201.235] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.235] Sleep (dwMilliseconds=0xa) [0201.248] timeGetTime () returned 0x44a7f [0201.248] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.248] Sleep (dwMilliseconds=0xa) [0201.263] timeGetTime () returned 0x44a8f [0201.263] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.263] Sleep (dwMilliseconds=0xa) [0201.289] timeGetTime () returned 0x44a9f [0201.289] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.289] Sleep (dwMilliseconds=0xa) [0201.311] timeGetTime () returned 0x44abd [0201.311] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.311] Sleep (dwMilliseconds=0xa) [0201.327] timeGetTime () returned 0x44acd [0201.327] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.327] Sleep (dwMilliseconds=0xa) [0201.342] timeGetTime () returned 0x44add [0201.342] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.342] Sleep (dwMilliseconds=0xa) [0201.359] timeGetTime () returned 0x44aec [0201.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0201.359] TranslateMessage (lpMsg=0x8bf798) returned 0 [0201.359] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0201.359] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0201.359] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0201.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.359] Sleep (dwMilliseconds=0xa) [0201.374] timeGetTime () returned 0x44afc [0201.374] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.374] Sleep (dwMilliseconds=0xa) [0201.397] timeGetTime () returned 0x44b0c [0201.397] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.397] Sleep (dwMilliseconds=0xa) [0201.419] timeGetTime () returned 0x44b2b [0201.419] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0201.420] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0201.420] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0201.420] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0201.420] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0201.420] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0201.420] RegCloseKey (hKey=0x240) returned 0x0 [0201.420] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0201.420] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0201.420] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0201.420] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0201.420] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0201.421] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0201.421] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0201.421] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0201.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0201.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac98, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0201.421] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0201.421] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0201.571] FreeLibrary (hLibModule=0x77150000) returned 1 [0201.572] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0201.572] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0201.572] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0201.572] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0201.572] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0201.572] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0201.572] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0201.572] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0201.572] timeGetTime () returned 0x44bc4 [0201.572] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.572] Sleep (dwMilliseconds=0xa) [0201.644] timeGetTime () returned 0x44c08 [0201.644] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.644] Sleep (dwMilliseconds=0xa) [0201.699] timeGetTime () returned 0x44c37 [0201.699] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.699] Sleep (dwMilliseconds=0xa) [0201.747] timeGetTime () returned 0x44c66 [0201.747] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.747] Sleep (dwMilliseconds=0xa) [0201.793] timeGetTime () returned 0x44c95 [0201.793] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.793] Sleep (dwMilliseconds=0xa) [0201.871] timeGetTime () returned 0x44ce3 [0201.871] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.871] Sleep (dwMilliseconds=0xa) [0201.902] timeGetTime () returned 0x44d02 [0201.902] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.902] Sleep (dwMilliseconds=0xa) [0201.947] timeGetTime () returned 0x44d31 [0201.947] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.947] Sleep (dwMilliseconds=0xa) [0201.996] timeGetTime () returned 0x44d60 [0201.996] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0201.996] Sleep (dwMilliseconds=0xa) [0202.031] timeGetTime () returned 0x44d8f [0202.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.031] Sleep (dwMilliseconds=0xa) [0202.057] timeGetTime () returned 0x44d9e [0202.057] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.057] Sleep (dwMilliseconds=0xa) [0202.089] timeGetTime () returned 0x44dbd [0202.089] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.089] Sleep (dwMilliseconds=0xa) [0202.110] timeGetTime () returned 0x44ddd [0202.110] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.110] Sleep (dwMilliseconds=0xa) [0202.128] timeGetTime () returned 0x44dec [0202.128] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0202.128] TranslateMessage (lpMsg=0x8bf798) returned 0 [0202.128] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0202.128] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0202.128] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0202.128] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.128] Sleep (dwMilliseconds=0xa) [0202.144] timeGetTime () returned 0x44dfc [0202.144] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.144] Sleep (dwMilliseconds=0xa) [0202.157] timeGetTime () returned 0x44e0c [0202.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.157] Sleep (dwMilliseconds=0xa) [0202.172] timeGetTime () returned 0x44e1b [0202.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.172] Sleep (dwMilliseconds=0xa) [0202.194] timeGetTime () returned 0x44e2b [0202.194] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.194] Sleep (dwMilliseconds=0xa) [0202.219] timeGetTime () returned 0x44e4a [0202.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.219] Sleep (dwMilliseconds=0xa) [0202.235] timeGetTime () returned 0x44e5a [0202.235] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.235] Sleep (dwMilliseconds=0xa) [0202.252] timeGetTime () returned 0x44e69 [0202.252] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.252] Sleep (dwMilliseconds=0xa) [0202.266] timeGetTime () returned 0x44e79 [0202.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.266] Sleep (dwMilliseconds=0xa) [0202.282] timeGetTime () returned 0x44e89 [0202.282] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.282] Sleep (dwMilliseconds=0xa) [0202.306] timeGetTime () returned 0x44e98 [0202.306] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.306] Sleep (dwMilliseconds=0xa) [0202.330] timeGetTime () returned 0x44eb7 [0202.330] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.330] Sleep (dwMilliseconds=0xa) [0202.353] timeGetTime () returned 0x44ec7 [0202.353] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.353] Sleep (dwMilliseconds=0xa) [0202.375] timeGetTime () returned 0x44ee6 [0202.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.375] Sleep (dwMilliseconds=0xa) [0202.392] timeGetTime () returned 0x44ef7 [0202.392] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.392] Sleep (dwMilliseconds=0xa) [0202.406] timeGetTime () returned 0x44f06 [0202.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.406] Sleep (dwMilliseconds=0xa) [0202.423] timeGetTime () returned 0x44f15 [0202.423] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.423] Sleep (dwMilliseconds=0xa) [0202.437] timeGetTime () returned 0x44f25 [0202.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.437] Sleep (dwMilliseconds=0xa) [0202.453] timeGetTime () returned 0x44f34 [0202.454] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.454] Sleep (dwMilliseconds=0xa) [0202.469] timeGetTime () returned 0x44f44 [0202.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.469] Sleep (dwMilliseconds=0xa) [0202.484] timeGetTime () returned 0x44f54 [0202.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.484] Sleep (dwMilliseconds=0xa) [0202.500] timeGetTime () returned 0x44f63 [0202.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.500] Sleep (dwMilliseconds=0xa) [0202.607] timeGetTime () returned 0x44fc1 [0202.607] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0202.607] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0202.607] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0202.607] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0202.607] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0202.607] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0202.608] RegCloseKey (hKey=0x240) returned 0x0 [0202.608] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0202.608] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0202.608] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0202.608] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0202.608] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0202.608] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0202.608] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0202.608] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0202.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0202.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a998, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0202.608] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0202.609] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0202.703] FreeLibrary (hLibModule=0x77150000) returned 1 [0202.703] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0202.703] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0202.703] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0202.704] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0202.704] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0202.704] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0202.704] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0202.704] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0202.704] timeGetTime () returned 0x4502e [0202.704] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.704] Sleep (dwMilliseconds=0xa) [0202.765] timeGetTime () returned 0x4506d [0202.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.766] Sleep (dwMilliseconds=0xa) [0202.814] timeGetTime () returned 0x4509c [0202.814] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.814] Sleep (dwMilliseconds=0xa) [0202.861] timeGetTime () returned 0x450cb [0202.861] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.861] Sleep (dwMilliseconds=0xa) [0202.917] timeGetTime () returned 0x450fa [0202.917] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0202.918] TranslateMessage (lpMsg=0x8bf798) returned 0 [0202.918] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0202.918] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0202.918] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0202.918] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.918] Sleep (dwMilliseconds=0xa) [0202.966] timeGetTime () returned 0x45128 [0202.966] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.966] Sleep (dwMilliseconds=0xa) [0202.985] timeGetTime () returned 0x45148 [0202.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0202.985] Sleep (dwMilliseconds=0xa) [0203.003] timeGetTime () returned 0x45157 [0203.003] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.003] Sleep (dwMilliseconds=0xa) [0203.016] timeGetTime () returned 0x45167 [0203.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.016] Sleep (dwMilliseconds=0xa) [0203.044] timeGetTime () returned 0x45177 [0203.044] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.044] Sleep (dwMilliseconds=0xa) [0203.064] timeGetTime () returned 0x45196 [0203.064] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.064] Sleep (dwMilliseconds=0xa) [0203.080] timeGetTime () returned 0x451a5 [0203.080] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.080] Sleep (dwMilliseconds=0xa) [0203.094] timeGetTime () returned 0x451b5 [0203.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.094] Sleep (dwMilliseconds=0xa) [0203.116] timeGetTime () returned 0x451c5 [0203.116] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.116] Sleep (dwMilliseconds=0xa) [0203.141] timeGetTime () returned 0x451e4 [0203.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.141] Sleep (dwMilliseconds=0xa) [0203.157] timeGetTime () returned 0x451f4 [0203.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.157] Sleep (dwMilliseconds=0xa) [0203.172] timeGetTime () returned 0x45203 [0203.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.172] Sleep (dwMilliseconds=0xa) [0203.191] timeGetTime () returned 0x45213 [0203.191] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.191] Sleep (dwMilliseconds=0xa) [0203.207] timeGetTime () returned 0x45223 [0203.207] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.207] Sleep (dwMilliseconds=0xa) [0203.219] timeGetTime () returned 0x45232 [0203.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.219] Sleep (dwMilliseconds=0xa) [0203.235] timeGetTime () returned 0x45242 [0203.235] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.235] Sleep (dwMilliseconds=0xa) [0203.250] timeGetTime () returned 0x45251 [0203.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.250] Sleep (dwMilliseconds=0xa) [0203.266] timeGetTime () returned 0x45261 [0203.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.266] Sleep (dwMilliseconds=0xa) [0203.282] timeGetTime () returned 0x45271 [0203.282] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.282] Sleep (dwMilliseconds=0xa) [0203.304] timeGetTime () returned 0x45280 [0203.304] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.304] Sleep (dwMilliseconds=0xa) [0203.333] timeGetTime () returned 0x4529f [0203.333] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.333] Sleep (dwMilliseconds=0xa) [0203.345] timeGetTime () returned 0x452af [0203.345] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.345] Sleep (dwMilliseconds=0xa) [0203.361] timeGetTime () returned 0x452bf [0203.361] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.361] Sleep (dwMilliseconds=0xa) [0203.375] timeGetTime () returned 0x452ce [0203.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.375] Sleep (dwMilliseconds=0xa) [0203.390] timeGetTime () returned 0x452de [0203.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.390] Sleep (dwMilliseconds=0xa) [0203.406] timeGetTime () returned 0x452ee [0203.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.406] Sleep (dwMilliseconds=0xa) [0203.422] timeGetTime () returned 0x452fd [0203.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.422] Sleep (dwMilliseconds=0xa) [0203.438] timeGetTime () returned 0x4530d [0203.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.438] Sleep (dwMilliseconds=0xa) [0203.453] timeGetTime () returned 0x4531c [0203.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.453] Sleep (dwMilliseconds=0xa) [0203.469] timeGetTime () returned 0x4532c [0203.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.469] Sleep (dwMilliseconds=0xa) [0203.485] timeGetTime () returned 0x4533c [0203.485] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.485] Sleep (dwMilliseconds=0xa) [0203.500] timeGetTime () returned 0x4534b [0203.501] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.501] Sleep (dwMilliseconds=0xa) [0203.585] timeGetTime () returned 0x45399 [0203.585] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.585] Sleep (dwMilliseconds=0xa) [0203.609] timeGetTime () returned 0x453b9 [0203.610] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.610] Sleep (dwMilliseconds=0xa) [0203.633] timeGetTime () returned 0x453c8 [0203.633] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.633] Sleep (dwMilliseconds=0xa) [0203.665] timeGetTime () returned 0x453e8 [0203.665] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.665] Sleep (dwMilliseconds=0xa) [0203.690] timeGetTime () returned 0x45407 [0203.690] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0203.690] TranslateMessage (lpMsg=0x8bf798) returned 0 [0203.690] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0203.690] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0203.690] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0203.690] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.690] Sleep (dwMilliseconds=0xa) [0203.704] timeGetTime () returned 0x45416 [0203.704] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0203.705] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0203.705] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0203.705] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0203.705] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0203.705] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0203.705] RegCloseKey (hKey=0x240) returned 0x0 [0203.705] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0203.705] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0203.705] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0203.705] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0203.705] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0203.705] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0203.706] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0203.706] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0203.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0203.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9b8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0203.706] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0203.706] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0203.800] FreeLibrary (hLibModule=0x77150000) returned 1 [0203.800] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0203.800] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0203.800] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0203.800] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0203.800] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0203.800] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0203.800] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0203.800] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0203.800] timeGetTime () returned 0x45474 [0203.800] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.800] Sleep (dwMilliseconds=0xa) [0203.847] timeGetTime () returned 0x454a3 [0203.847] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.847] Sleep (dwMilliseconds=0xa) [0203.891] timeGetTime () returned 0x454d2 [0203.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.891] Sleep (dwMilliseconds=0xa) [0203.940] timeGetTime () returned 0x45501 [0203.940] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.940] Sleep (dwMilliseconds=0xa) [0203.986] timeGetTime () returned 0x45530 [0203.986] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0203.986] Sleep (dwMilliseconds=0xa) [0204.032] timeGetTime () returned 0x4555f [0204.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.033] Sleep (dwMilliseconds=0xa) [0204.079] timeGetTime () returned 0x4558d [0204.079] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.079] Sleep (dwMilliseconds=0xa) [0204.124] timeGetTime () returned 0x455ad [0204.124] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.124] Sleep (dwMilliseconds=0xa) [0204.142] timeGetTime () returned 0x455cc [0204.142] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.142] Sleep (dwMilliseconds=0xa) [0204.157] timeGetTime () returned 0x455dc [0204.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.157] Sleep (dwMilliseconds=0xa) [0204.184] timeGetTime () returned 0x455eb [0204.184] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.184] Sleep (dwMilliseconds=0xa) [0204.259] timeGetTime () returned 0x45639 [0204.259] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.259] Sleep (dwMilliseconds=0xa) [0204.289] timeGetTime () returned 0x45659 [0204.289] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.289] Sleep (dwMilliseconds=0xa) [0204.313] timeGetTime () returned 0x45678 [0204.313] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.313] Sleep (dwMilliseconds=0xa) [0204.329] timeGetTime () returned 0x45687 [0204.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.329] Sleep (dwMilliseconds=0xa) [0204.344] timeGetTime () returned 0x45697 [0204.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.344] Sleep (dwMilliseconds=0xa) [0204.359] timeGetTime () returned 0x456a7 [0204.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.359] Sleep (dwMilliseconds=0xa) [0204.376] timeGetTime () returned 0x456b7 [0204.376] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.376] Sleep (dwMilliseconds=0xa) [0204.391] timeGetTime () returned 0x456c6 [0204.391] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.391] Sleep (dwMilliseconds=0xa) [0204.406] timeGetTime () returned 0x456d6 [0204.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.406] Sleep (dwMilliseconds=0xa) [0204.422] timeGetTime () returned 0x456e5 [0204.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.422] Sleep (dwMilliseconds=0xa) [0204.438] timeGetTime () returned 0x456f5 [0204.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.438] Sleep (dwMilliseconds=0xa) [0204.454] timeGetTime () returned 0x45704 [0204.454] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0204.454] TranslateMessage (lpMsg=0x8bf798) returned 0 [0204.454] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0204.454] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0204.454] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0204.454] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.454] Sleep (dwMilliseconds=0xa) [0204.477] timeGetTime () returned 0x45714 [0204.477] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.477] Sleep (dwMilliseconds=0xa) [0204.504] timeGetTime () returned 0x45733 [0204.504] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.504] Sleep (dwMilliseconds=0xa) [0204.586] timeGetTime () returned 0x45781 [0204.586] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.586] Sleep (dwMilliseconds=0xa) [0204.610] timeGetTime () returned 0x457a1 [0204.610] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.610] Sleep (dwMilliseconds=0xa) [0204.625] timeGetTime () returned 0x457b0 [0204.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.625] Sleep (dwMilliseconds=0xa) [0204.642] timeGetTime () returned 0x457c0 [0204.642] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.642] Sleep (dwMilliseconds=0xa) [0204.659] timeGetTime () returned 0x457d0 [0204.659] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.659] Sleep (dwMilliseconds=0xa) [0204.672] timeGetTime () returned 0x457df [0204.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.672] Sleep (dwMilliseconds=0xa) [0204.698] timeGetTime () returned 0x457ef [0204.698] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.698] Sleep (dwMilliseconds=0xa) [0204.720] timeGetTime () returned 0x4580e [0204.720] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.720] Sleep (dwMilliseconds=0xa) [0204.735] timeGetTime () returned 0x4581e [0204.735] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.735] Sleep (dwMilliseconds=0xa) [0204.751] timeGetTime () returned 0x4582d [0204.752] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.752] Sleep (dwMilliseconds=0xa) [0204.768] timeGetTime () returned 0x4583d [0204.768] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.768] Sleep (dwMilliseconds=0xa) [0204.781] timeGetTime () returned 0x4584d [0204.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.781] Sleep (dwMilliseconds=0xa) [0204.797] timeGetTime () returned 0x4585c [0204.797] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0204.797] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0204.797] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0204.797] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0204.797] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0204.797] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0204.797] RegCloseKey (hKey=0x240) returned 0x0 [0204.797] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0204.797] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0204.797] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0204.798] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0204.798] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0204.798] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0204.798] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0204.798] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0204.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0204.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0204.798] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0204.798] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0204.893] FreeLibrary (hLibModule=0x77150000) returned 1 [0204.893] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0204.894] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0204.894] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0204.894] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0204.894] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0204.894] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0204.894] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0204.894] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0204.894] timeGetTime () returned 0x458bd [0204.894] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.894] Sleep (dwMilliseconds=0xa) [0204.939] timeGetTime () returned 0x458e9 [0204.939] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.939] Sleep (dwMilliseconds=0xa) [0204.985] timeGetTime () returned 0x45918 [0204.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0204.986] Sleep (dwMilliseconds=0xa) [0205.034] timeGetTime () returned 0x45947 [0205.034] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.034] Sleep (dwMilliseconds=0xa) [0205.084] timeGetTime () returned 0x45975 [0205.084] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.084] Sleep (dwMilliseconds=0xa) [0205.142] timeGetTime () returned 0x459b4 [0205.142] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.142] Sleep (dwMilliseconds=0xa) [0205.189] timeGetTime () returned 0x459e3 [0205.189] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.189] Sleep (dwMilliseconds=0xa) [0205.210] timeGetTime () returned 0x459f2 [0205.210] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0205.210] TranslateMessage (lpMsg=0x8bf798) returned 0 [0205.210] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0205.210] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0205.211] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0205.211] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.211] Sleep (dwMilliseconds=0xa) [0205.235] timeGetTime () returned 0x45a12 [0205.235] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.235] Sleep (dwMilliseconds=0xa) [0205.261] timeGetTime () returned 0x45a21 [0205.261] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.262] Sleep (dwMilliseconds=0xa) [0205.282] timeGetTime () returned 0x45a41 [0205.282] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.282] Sleep (dwMilliseconds=0xa) [0205.297] timeGetTime () returned 0x45a50 [0205.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.297] Sleep (dwMilliseconds=0xa) [0205.313] timeGetTime () returned 0x45a60 [0205.313] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.313] Sleep (dwMilliseconds=0xa) [0205.331] timeGetTime () returned 0x45a70 [0205.331] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.331] Sleep (dwMilliseconds=0xa) [0205.344] timeGetTime () returned 0x45a7f [0205.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.344] Sleep (dwMilliseconds=0xa) [0205.361] timeGetTime () returned 0x45a8f [0205.361] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.361] Sleep (dwMilliseconds=0xa) [0205.390] timeGetTime () returned 0x45a9e [0205.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.390] Sleep (dwMilliseconds=0xa) [0205.420] timeGetTime () returned 0x45abe [0205.420] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.420] Sleep (dwMilliseconds=0xa) [0205.438] timeGetTime () returned 0x45add [0205.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.438] Sleep (dwMilliseconds=0xa) [0205.454] timeGetTime () returned 0x45aec [0205.454] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.454] Sleep (dwMilliseconds=0xa) [0205.469] timeGetTime () returned 0x45afc [0205.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.469] Sleep (dwMilliseconds=0xa) [0205.485] timeGetTime () returned 0x45b0c [0205.485] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.485] Sleep (dwMilliseconds=0xa) [0205.501] timeGetTime () returned 0x45b1b [0205.501] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.501] Sleep (dwMilliseconds=0xa) [0205.516] timeGetTime () returned 0x45b2b [0205.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.516] Sleep (dwMilliseconds=0xa) [0205.608] timeGetTime () returned 0x45b79 [0205.608] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.608] Sleep (dwMilliseconds=0xa) [0205.626] timeGetTime () returned 0x45b98 [0205.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.626] Sleep (dwMilliseconds=0xa) [0205.641] timeGetTime () returned 0x45ba8 [0205.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.641] Sleep (dwMilliseconds=0xa) [0205.657] timeGetTime () returned 0x45bb8 [0205.657] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.657] Sleep (dwMilliseconds=0xa) [0205.679] timeGetTime () returned 0x45bc7 [0205.679] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.679] Sleep (dwMilliseconds=0xa) [0205.710] timeGetTime () returned 0x45be6 [0205.710] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.710] Sleep (dwMilliseconds=0xa) [0205.734] timeGetTime () returned 0x45c06 [0205.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.734] Sleep (dwMilliseconds=0xa) [0205.750] timeGetTime () returned 0x45c15 [0205.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.750] Sleep (dwMilliseconds=0xa) [0205.766] timeGetTime () returned 0x45c25 [0205.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.766] Sleep (dwMilliseconds=0xa) [0205.781] timeGetTime () returned 0x45c35 [0205.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.781] Sleep (dwMilliseconds=0xa) [0205.812] timeGetTime () returned 0x45c44 [0205.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.812] Sleep (dwMilliseconds=0xa) [0205.829] timeGetTime () returned 0x45c63 [0205.829] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.829] Sleep (dwMilliseconds=0xa) [0205.845] timeGetTime () returned 0x45c73 [0205.845] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.845] Sleep (dwMilliseconds=0xa) [0205.859] timeGetTime () returned 0x45c83 [0205.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.859] Sleep (dwMilliseconds=0xa) [0205.876] timeGetTime () returned 0x45c92 [0205.876] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.876] Sleep (dwMilliseconds=0xa) [0205.891] timeGetTime () returned 0x45ca3 [0205.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0205.891] Sleep (dwMilliseconds=0xa) [0205.906] timeGetTime () returned 0x45cb2 [0205.906] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0205.907] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0205.907] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0205.907] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0205.907] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0205.907] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0205.907] RegCloseKey (hKey=0x240) returned 0x0 [0205.907] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0205.907] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0205.907] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0205.907] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0205.907] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0205.907] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0205.907] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0205.908] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0205.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0205.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0205.908] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0205.908] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0206.016] FreeLibrary (hLibModule=0x77150000) returned 1 [0206.016] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0206.016] TranslateMessage (lpMsg=0x8bf708) returned 0 [0206.016] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0206.016] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0206.016] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0206.017] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0206.017] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0206.017] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0206.017] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0206.017] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0206.017] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0206.017] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0206.017] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0206.017] timeGetTime () returned 0x45d1f [0206.017] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.017] Sleep (dwMilliseconds=0xa) [0206.071] timeGetTime () returned 0x45d4e [0206.072] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.072] Sleep (dwMilliseconds=0xa) [0206.117] timeGetTime () returned 0x45d7d [0206.117] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.117] Sleep (dwMilliseconds=0xa) [0206.172] timeGetTime () returned 0x45dbb [0206.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.172] Sleep (dwMilliseconds=0xa) [0206.207] timeGetTime () returned 0x45dda [0206.207] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.207] Sleep (dwMilliseconds=0xa) [0206.251] timeGetTime () returned 0x45e09 [0206.251] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.251] Sleep (dwMilliseconds=0xa) [0206.299] timeGetTime () returned 0x45e38 [0206.299] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.300] Sleep (dwMilliseconds=0xa) [0206.320] timeGetTime () returned 0x45e48 [0206.320] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.321] Sleep (dwMilliseconds=0xa) [0206.345] timeGetTime () returned 0x45e67 [0206.345] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.345] Sleep (dwMilliseconds=0xa) [0206.361] timeGetTime () returned 0x45e77 [0206.361] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.361] Sleep (dwMilliseconds=0xa) [0206.386] timeGetTime () returned 0x45e86 [0206.386] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.386] Sleep (dwMilliseconds=0xa) [0206.407] timeGetTime () returned 0x45ea6 [0206.407] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.407] Sleep (dwMilliseconds=0xa) [0206.423] timeGetTime () returned 0x45eb5 [0206.423] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.423] Sleep (dwMilliseconds=0xa) [0206.439] timeGetTime () returned 0x45ec5 [0206.439] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.439] Sleep (dwMilliseconds=0xa) [0206.455] timeGetTime () returned 0x45ed4 [0206.455] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.455] Sleep (dwMilliseconds=0xa) [0206.470] timeGetTime () returned 0x45ee4 [0206.470] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.470] Sleep (dwMilliseconds=0xa) [0206.486] timeGetTime () returned 0x45ef4 [0206.486] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.486] Sleep (dwMilliseconds=0xa) [0206.502] timeGetTime () returned 0x45f03 [0206.502] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.502] Sleep (dwMilliseconds=0xa) [0206.516] timeGetTime () returned 0x45f13 [0206.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.516] Sleep (dwMilliseconds=0xa) [0206.608] timeGetTime () returned 0x45f61 [0206.608] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.608] Sleep (dwMilliseconds=0xa) [0206.627] timeGetTime () returned 0x45f80 [0206.628] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.628] Sleep (dwMilliseconds=0xa) [0206.640] timeGetTime () returned 0x45f90 [0206.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.640] Sleep (dwMilliseconds=0xa) [0206.662] timeGetTime () returned 0x45fa0 [0206.662] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.662] Sleep (dwMilliseconds=0xa) [0206.688] timeGetTime () returned 0x45fbf [0206.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.688] Sleep (dwMilliseconds=0xa) [0206.719] timeGetTime () returned 0x45fde [0206.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.719] Sleep (dwMilliseconds=0xa) [0206.739] timeGetTime () returned 0x45fee [0206.739] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.739] Sleep (dwMilliseconds=0xa) [0206.750] timeGetTime () returned 0x45ffd [0206.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.750] Sleep (dwMilliseconds=0xa) [0206.768] timeGetTime () returned 0x4600d [0206.768] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0206.768] TranslateMessage (lpMsg=0x8bf798) returned 0 [0206.768] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0206.768] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0206.768] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0206.768] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.768] Sleep (dwMilliseconds=0xa) [0206.781] timeGetTime () returned 0x4601d [0206.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.781] Sleep (dwMilliseconds=0xa) [0206.799] timeGetTime () returned 0x4602d [0206.799] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.799] Sleep (dwMilliseconds=0xa) [0206.814] timeGetTime () returned 0x4603c [0206.814] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.814] Sleep (dwMilliseconds=0xa) [0206.831] timeGetTime () returned 0x4604c [0206.831] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.831] Sleep (dwMilliseconds=0xa) [0206.847] timeGetTime () returned 0x4605b [0206.847] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.847] Sleep (dwMilliseconds=0xa) [0206.870] timeGetTime () returned 0x4606b [0206.870] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.870] Sleep (dwMilliseconds=0xa) [0206.895] timeGetTime () returned 0x4608a [0206.895] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.895] Sleep (dwMilliseconds=0xa) [0206.936] timeGetTime () returned 0x460a9 [0206.936] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.936] Sleep (dwMilliseconds=0xa) [0206.956] timeGetTime () returned 0x460c8 [0206.956] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.956] Sleep (dwMilliseconds=0xa) [0206.970] timeGetTime () returned 0x460d8 [0206.970] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.970] Sleep (dwMilliseconds=0xa) [0206.988] timeGetTime () returned 0x460e8 [0206.988] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0206.988] Sleep (dwMilliseconds=0xa) [0207.000] timeGetTime () returned 0x460f7 [0207.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.000] Sleep (dwMilliseconds=0xa) [0207.021] timeGetTime () returned 0x46107 [0207.021] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0207.021] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0207.021] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0207.021] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0207.021] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0207.021] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0207.021] RegCloseKey (hKey=0x240) returned 0x0 [0207.021] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0207.021] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0207.021] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0207.021] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0207.021] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0207.021] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0207.022] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0207.022] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0207.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0207.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9f8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0207.022] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0207.022] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0207.109] FreeLibrary (hLibModule=0x77150000) returned 1 [0207.109] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0207.109] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0207.109] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0207.110] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0207.110] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0207.110] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0207.110] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0207.110] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0207.110] timeGetTime () returned 0x46165 [0207.110] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.110] Sleep (dwMilliseconds=0xa) [0207.163] timeGetTime () returned 0x46194 [0207.163] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.163] Sleep (dwMilliseconds=0xa) [0207.204] timeGetTime () returned 0x461c2 [0207.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.204] Sleep (dwMilliseconds=0xa) [0207.255] timeGetTime () returned 0x461f1 [0207.255] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.255] Sleep (dwMilliseconds=0xa) [0207.300] timeGetTime () returned 0x46220 [0207.300] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.300] Sleep (dwMilliseconds=0xa) [0207.363] timeGetTime () returned 0x4625f [0207.363] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.363] Sleep (dwMilliseconds=0xa) [0207.398] timeGetTime () returned 0x4627e [0207.398] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.398] Sleep (dwMilliseconds=0xa) [0207.424] timeGetTime () returned 0x4629d [0207.424] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.424] Sleep (dwMilliseconds=0xa) [0207.451] timeGetTime () returned 0x462ad [0207.451] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.451] Sleep (dwMilliseconds=0xa) [0207.469] timeGetTime () returned 0x462cc [0207.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.469] Sleep (dwMilliseconds=0xa) [0207.489] timeGetTime () returned 0x462dc [0207.489] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.489] Sleep (dwMilliseconds=0xa) [0207.501] timeGetTime () returned 0x462eb [0207.501] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.501] Sleep (dwMilliseconds=0xa) [0207.516] timeGetTime () returned 0x462fb [0207.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.516] Sleep (dwMilliseconds=0xa) [0207.531] timeGetTime () returned 0x4630b [0207.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0207.531] TranslateMessage (lpMsg=0x8bf798) returned 0 [0207.531] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0207.531] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0207.531] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0207.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.531] Sleep (dwMilliseconds=0xa) [0207.629] timeGetTime () returned 0x46368 [0207.629] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.629] Sleep (dwMilliseconds=0xa) [0207.645] timeGetTime () returned 0x46378 [0207.645] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.645] Sleep (dwMilliseconds=0xa) [0207.656] timeGetTime () returned 0x46388 [0207.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.656] Sleep (dwMilliseconds=0xa) [0207.673] timeGetTime () returned 0x46397 [0207.673] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.673] Sleep (dwMilliseconds=0xa) [0207.690] timeGetTime () returned 0x463a7 [0207.690] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.690] Sleep (dwMilliseconds=0xa) [0207.705] timeGetTime () returned 0x463b7 [0207.705] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.705] Sleep (dwMilliseconds=0xa) [0207.720] timeGetTime () returned 0x463c6 [0207.720] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.720] Sleep (dwMilliseconds=0xa) [0207.736] timeGetTime () returned 0x463d6 [0207.736] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.736] Sleep (dwMilliseconds=0xa) [0207.750] timeGetTime () returned 0x463e5 [0207.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.750] Sleep (dwMilliseconds=0xa) [0207.766] timeGetTime () returned 0x463f5 [0207.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.766] Sleep (dwMilliseconds=0xa) [0207.781] timeGetTime () returned 0x46405 [0207.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.781] Sleep (dwMilliseconds=0xa) [0207.800] timeGetTime () returned 0x46414 [0207.800] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.800] Sleep (dwMilliseconds=0xa) [0207.815] timeGetTime () returned 0x46424 [0207.815] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.815] Sleep (dwMilliseconds=0xa) [0207.830] timeGetTime () returned 0x46433 [0207.830] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.830] Sleep (dwMilliseconds=0xa) [0207.846] timeGetTime () returned 0x46443 [0207.846] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.846] Sleep (dwMilliseconds=0xa) [0207.862] timeGetTime () returned 0x46453 [0207.862] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.862] Sleep (dwMilliseconds=0xa) [0207.877] timeGetTime () returned 0x46462 [0207.877] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.877] Sleep (dwMilliseconds=0xa) [0207.893] timeGetTime () returned 0x46472 [0207.893] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.893] Sleep (dwMilliseconds=0xa) [0207.906] timeGetTime () returned 0x46482 [0207.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.906] Sleep (dwMilliseconds=0xa) [0207.923] timeGetTime () returned 0x46491 [0207.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.923] Sleep (dwMilliseconds=0xa) [0207.938] timeGetTime () returned 0x464a1 [0207.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.938] Sleep (dwMilliseconds=0xa) [0207.953] timeGetTime () returned 0x464b0 [0207.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.953] Sleep (dwMilliseconds=0xa) [0207.971] timeGetTime () returned 0x464c0 [0207.971] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.971] Sleep (dwMilliseconds=0xa) [0207.987] timeGetTime () returned 0x464d0 [0207.987] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0207.987] Sleep (dwMilliseconds=0xa) [0208.004] timeGetTime () returned 0x464df [0208.004] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.004] Sleep (dwMilliseconds=0xa) [0208.018] timeGetTime () returned 0x464ef [0208.018] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.018] Sleep (dwMilliseconds=0xa) [0208.032] timeGetTime () returned 0x464ff [0208.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.032] Sleep (dwMilliseconds=0xa) [0208.047] timeGetTime () returned 0x4650e [0208.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.047] Sleep (dwMilliseconds=0xa) [0208.063] timeGetTime () returned 0x4651e [0208.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.063] Sleep (dwMilliseconds=0xa) [0208.078] timeGetTime () returned 0x4652d [0208.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.078] Sleep (dwMilliseconds=0xa) [0208.094] timeGetTime () returned 0x4653d [0208.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.094] Sleep (dwMilliseconds=0xa) [0208.111] timeGetTime () returned 0x4654d [0208.111] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0208.111] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0208.111] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0208.111] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0208.112] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0208.112] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0208.112] RegCloseKey (hKey=0x240) returned 0x0 [0208.112] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0208.112] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0208.112] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0208.112] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0208.112] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0208.112] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0208.112] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0208.112] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0208.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0208.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab18, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0208.112] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0208.113] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0208.203] FreeLibrary (hLibModule=0x77150000) returned 1 [0208.203] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0208.203] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0208.203] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0208.203] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0208.203] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0208.203] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0208.203] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0208.204] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0208.204] timeGetTime () returned 0x465aa [0208.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.204] Sleep (dwMilliseconds=0xa) [0208.266] timeGetTime () returned 0x465e9 [0208.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.266] Sleep (dwMilliseconds=0xa) [0208.316] timeGetTime () returned 0x46618 [0208.316] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0208.316] TranslateMessage (lpMsg=0x8bf798) returned 0 [0208.316] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0208.316] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0208.316] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0208.317] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.317] Sleep (dwMilliseconds=0xa) [0208.344] timeGetTime () returned 0x46637 [0208.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.345] Sleep (dwMilliseconds=0xa) [0208.366] timeGetTime () returned 0x46647 [0208.366] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.366] Sleep (dwMilliseconds=0xa) [0208.407] timeGetTime () returned 0x46676 [0208.407] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.407] Sleep (dwMilliseconds=0xa) [0208.456] timeGetTime () returned 0x466a4 [0208.457] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.457] Sleep (dwMilliseconds=0xa) [0208.471] timeGetTime () returned 0x466b4 [0208.471] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.471] Sleep (dwMilliseconds=0xa) [0208.493] timeGetTime () returned 0x466c4 [0208.493] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.493] Sleep (dwMilliseconds=0xa) [0208.525] timeGetTime () returned 0x466e3 [0208.525] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.525] Sleep (dwMilliseconds=0xa) [0208.557] timeGetTime () returned 0x46702 [0208.557] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.557] Sleep (dwMilliseconds=0xa) [0208.639] timeGetTime () returned 0x46750 [0208.639] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.639] Sleep (dwMilliseconds=0xa) [0208.657] timeGetTime () returned 0x46770 [0208.657] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.657] Sleep (dwMilliseconds=0xa) [0208.673] timeGetTime () returned 0x4677f [0208.673] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.673] Sleep (dwMilliseconds=0xa) [0208.688] timeGetTime () returned 0x4678f [0208.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.688] Sleep (dwMilliseconds=0xa) [0208.704] timeGetTime () returned 0x4679e [0208.704] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.704] Sleep (dwMilliseconds=0xa) [0208.719] timeGetTime () returned 0x467ae [0208.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.719] Sleep (dwMilliseconds=0xa) [0208.735] timeGetTime () returned 0x467be [0208.735] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.735] Sleep (dwMilliseconds=0xa) [0208.750] timeGetTime () returned 0x467cd [0208.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.750] Sleep (dwMilliseconds=0xa) [0208.770] timeGetTime () returned 0x467dd [0208.770] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.770] Sleep (dwMilliseconds=0xa) [0208.782] timeGetTime () returned 0x467ed [0208.782] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.782] Sleep (dwMilliseconds=0xa) [0208.799] timeGetTime () returned 0x467fc [0208.799] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.799] Sleep (dwMilliseconds=0xa) [0208.816] timeGetTime () returned 0x4680c [0208.816] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.816] Sleep (dwMilliseconds=0xa) [0208.828] timeGetTime () returned 0x4681b [0208.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.828] Sleep (dwMilliseconds=0xa) [0208.846] timeGetTime () returned 0x4682b [0208.846] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.846] Sleep (dwMilliseconds=0xa) [0208.860] timeGetTime () returned 0x4683b [0208.860] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.860] Sleep (dwMilliseconds=0xa) [0208.875] timeGetTime () returned 0x4684a [0208.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.875] Sleep (dwMilliseconds=0xa) [0208.891] timeGetTime () returned 0x4685a [0208.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.891] Sleep (dwMilliseconds=0xa) [0208.907] timeGetTime () returned 0x4686a [0208.907] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.907] Sleep (dwMilliseconds=0xa) [0208.921] timeGetTime () returned 0x46879 [0208.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.922] Sleep (dwMilliseconds=0xa) [0208.938] timeGetTime () returned 0x46889 [0208.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.938] Sleep (dwMilliseconds=0xa) [0208.953] timeGetTime () returned 0x46899 [0208.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.953] Sleep (dwMilliseconds=0xa) [0208.970] timeGetTime () returned 0x468a8 [0208.970] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.970] Sleep (dwMilliseconds=0xa) [0208.985] timeGetTime () returned 0x468b8 [0208.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0208.985] Sleep (dwMilliseconds=0xa) [0209.002] timeGetTime () returned 0x468c7 [0209.002] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.002] Sleep (dwMilliseconds=0xa) [0209.016] timeGetTime () returned 0x468d7 [0209.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.016] Sleep (dwMilliseconds=0xa) [0209.031] timeGetTime () returned 0x468e7 [0209.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.031] Sleep (dwMilliseconds=0xa) [0209.047] timeGetTime () returned 0x468f6 [0209.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.047] Sleep (dwMilliseconds=0xa) [0209.063] timeGetTime () returned 0x46906 [0209.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0209.063] TranslateMessage (lpMsg=0x8bf798) returned 0 [0209.063] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0209.063] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0209.063] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0209.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.063] Sleep (dwMilliseconds=0xa) [0209.081] timeGetTime () returned 0x46916 [0209.081] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.081] Sleep (dwMilliseconds=0xa) [0209.094] timeGetTime () returned 0x46925 [0209.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.094] Sleep (dwMilliseconds=0xa) [0209.110] timeGetTime () returned 0x46935 [0209.110] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.110] Sleep (dwMilliseconds=0xa) [0209.127] timeGetTime () returned 0x46944 [0209.127] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.127] Sleep (dwMilliseconds=0xa) [0209.144] timeGetTime () returned 0x46954 [0209.144] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.144] Sleep (dwMilliseconds=0xa) [0209.159] timeGetTime () returned 0x46964 [0209.159] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.159] Sleep (dwMilliseconds=0xa) [0209.176] timeGetTime () returned 0x46973 [0209.176] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.176] Sleep (dwMilliseconds=0xa) [0209.189] timeGetTime () returned 0x46983 [0209.189] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.189] Sleep (dwMilliseconds=0xa) [0209.203] timeGetTime () returned 0x46992 [0209.203] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0209.204] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0209.204] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0209.204] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0209.204] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0209.204] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0209.204] RegCloseKey (hKey=0x240) returned 0x0 [0209.204] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0209.204] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0209.204] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0209.204] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0209.204] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0209.204] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0209.204] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0209.204] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0209.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0209.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0209.205] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0209.205] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0209.297] FreeLibrary (hLibModule=0x77150000) returned 1 [0209.297] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0209.297] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0209.297] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0209.297] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0209.297] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0209.297] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0209.298] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0209.298] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0209.298] timeGetTime () returned 0x469f0 [0209.298] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.298] Sleep (dwMilliseconds=0xa) [0209.360] timeGetTime () returned 0x46a2f [0209.360] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.360] Sleep (dwMilliseconds=0xa) [0209.410] timeGetTime () returned 0x46a5e [0209.410] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.410] Sleep (dwMilliseconds=0xa) [0209.454] timeGetTime () returned 0x46a8c [0209.454] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.454] Sleep (dwMilliseconds=0xa) [0209.504] timeGetTime () returned 0x46abb [0209.504] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.504] Sleep (dwMilliseconds=0xa) [0209.533] timeGetTime () returned 0x46adb [0209.533] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.533] Sleep (dwMilliseconds=0xa) [0209.562] timeGetTime () returned 0x46af2 [0209.562] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.562] Sleep (dwMilliseconds=0xa) [0209.657] timeGetTime () returned 0x46b58 [0209.657] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.657] Sleep (dwMilliseconds=0xa) [0209.707] timeGetTime () returned 0x46b86 [0209.707] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.707] Sleep (dwMilliseconds=0xa) [0209.719] timeGetTime () returned 0x46b96 [0209.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.719] Sleep (dwMilliseconds=0xa) [0209.745] timeGetTime () returned 0x46ba6 [0209.745] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.745] Sleep (dwMilliseconds=0xa) [0209.767] timeGetTime () returned 0x46bc5 [0209.768] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.768] Sleep (dwMilliseconds=0xa) [0209.784] timeGetTime () returned 0x46bd5 [0209.784] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.784] Sleep (dwMilliseconds=0xa) [0209.801] timeGetTime () returned 0x46be4 [0209.801] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.801] Sleep (dwMilliseconds=0xa) [0209.816] timeGetTime () returned 0x46bf4 [0209.816] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.816] Sleep (dwMilliseconds=0xa) [0209.832] timeGetTime () returned 0x46c03 [0209.832] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0209.832] TranslateMessage (lpMsg=0x8bf798) returned 0 [0209.832] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0209.832] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0209.833] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0209.833] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.833] Sleep (dwMilliseconds=0xa) [0209.846] timeGetTime () returned 0x46c13 [0209.846] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.846] Sleep (dwMilliseconds=0xa) [0209.859] timeGetTime () returned 0x46c23 [0209.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.859] Sleep (dwMilliseconds=0xa) [0209.877] timeGetTime () returned 0x46c32 [0209.877] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.877] Sleep (dwMilliseconds=0xa) [0209.893] timeGetTime () returned 0x46c42 [0209.893] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.893] Sleep (dwMilliseconds=0xa) [0209.910] timeGetTime () returned 0x46c52 [0209.910] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.910] Sleep (dwMilliseconds=0xa) [0209.922] timeGetTime () returned 0x46c61 [0209.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.922] Sleep (dwMilliseconds=0xa) [0209.941] timeGetTime () returned 0x46c71 [0209.941] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.941] Sleep (dwMilliseconds=0xa) [0209.957] timeGetTime () returned 0x46c80 [0209.957] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.957] Sleep (dwMilliseconds=0xa) [0209.972] timeGetTime () returned 0x46c90 [0209.972] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.972] Sleep (dwMilliseconds=0xa) [0209.988] timeGetTime () returned 0x46ca0 [0209.988] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0209.988] Sleep (dwMilliseconds=0xa) [0210.003] timeGetTime () returned 0x46caf [0210.003] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.003] Sleep (dwMilliseconds=0xa) [0210.018] timeGetTime () returned 0x46cbf [0210.018] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.018] Sleep (dwMilliseconds=0xa) [0210.032] timeGetTime () returned 0x46ccf [0210.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.032] Sleep (dwMilliseconds=0xa) [0210.049] timeGetTime () returned 0x46cde [0210.049] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.049] Sleep (dwMilliseconds=0xa) [0210.064] timeGetTime () returned 0x46cee [0210.064] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.065] Sleep (dwMilliseconds=0xa) [0210.082] timeGetTime () returned 0x46cfe [0210.082] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.082] Sleep (dwMilliseconds=0xa) [0210.094] timeGetTime () returned 0x46d0d [0210.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.094] Sleep (dwMilliseconds=0xa) [0210.113] timeGetTime () returned 0x46d1d [0210.113] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.113] Sleep (dwMilliseconds=0xa) [0210.125] timeGetTime () returned 0x46d2c [0210.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.125] Sleep (dwMilliseconds=0xa) [0210.142] timeGetTime () returned 0x46d3c [0210.142] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.142] Sleep (dwMilliseconds=0xa) [0210.159] timeGetTime () returned 0x46d4c [0210.159] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.159] Sleep (dwMilliseconds=0xa) [0210.172] timeGetTime () returned 0x46d5b [0210.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.172] Sleep (dwMilliseconds=0xa) [0210.188] timeGetTime () returned 0x46d6b [0210.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.188] Sleep (dwMilliseconds=0xa) [0210.203] timeGetTime () returned 0x46d7a [0210.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.203] Sleep (dwMilliseconds=0xa) [0210.220] timeGetTime () returned 0x46d8a [0210.220] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.220] Sleep (dwMilliseconds=0xa) [0210.237] timeGetTime () returned 0x46d9a [0210.237] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.237] Sleep (dwMilliseconds=0xa) [0210.250] timeGetTime () returned 0x46da9 [0210.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.250] Sleep (dwMilliseconds=0xa) [0210.271] timeGetTime () returned 0x46db9 [0210.271] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.271] Sleep (dwMilliseconds=0xa) [0210.298] timeGetTime () returned 0x46dd8 [0210.298] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0210.298] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0210.298] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.298] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0210.298] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0210.299] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0210.299] RegCloseKey (hKey=0x240) returned 0x0 [0210.299] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0210.299] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0210.299] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0210.299] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0210.299] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0210.299] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0210.299] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0210.299] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0210.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0210.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acf8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0210.300] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0210.300] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0210.391] FreeLibrary (hLibModule=0x77150000) returned 1 [0210.391] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0210.391] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0210.391] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0210.391] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0210.391] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0210.391] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.391] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0210.391] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0210.391] timeGetTime () returned 0x46e36 [0210.391] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.391] Sleep (dwMilliseconds=0xa) [0210.453] timeGetTime () returned 0x46e74 [0210.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.453] Sleep (dwMilliseconds=0xa) [0210.501] timeGetTime () returned 0x46ea3 [0210.501] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.501] Sleep (dwMilliseconds=0xa) [0210.560] timeGetTime () returned 0x46ed2 [0210.560] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.560] Sleep (dwMilliseconds=0xa) [0210.656] timeGetTime () returned 0x46f30 [0210.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0210.656] TranslateMessage (lpMsg=0x8bf798) returned 0 [0210.656] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0210.656] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0210.656] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0210.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.656] Sleep (dwMilliseconds=0xa) [0210.707] timeGetTime () returned 0x46f6e [0210.707] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.707] Sleep (dwMilliseconds=0xa) [0210.752] timeGetTime () returned 0x46f9d [0210.752] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.752] Sleep (dwMilliseconds=0xa) [0210.789] timeGetTime () returned 0x46fbd [0210.789] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.789] Sleep (dwMilliseconds=0xa) [0210.814] timeGetTime () returned 0x46fdc [0210.814] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.814] Sleep (dwMilliseconds=0xa) [0210.830] timeGetTime () returned 0x46fec [0210.830] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.830] Sleep (dwMilliseconds=0xa) [0210.858] timeGetTime () returned 0x46ffb [0210.858] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.858] Sleep (dwMilliseconds=0xa) [0210.890] timeGetTime () returned 0x4701a [0210.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.890] Sleep (dwMilliseconds=0xa) [0210.909] timeGetTime () returned 0x4703a [0210.909] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.909] Sleep (dwMilliseconds=0xa) [0210.924] timeGetTime () returned 0x47049 [0210.924] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.924] Sleep (dwMilliseconds=0xa) [0210.937] timeGetTime () returned 0x47059 [0210.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.938] Sleep (dwMilliseconds=0xa) [0210.954] timeGetTime () returned 0x47068 [0210.954] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.954] Sleep (dwMilliseconds=0xa) [0210.972] timeGetTime () returned 0x47078 [0210.972] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.972] Sleep (dwMilliseconds=0xa) [0210.987] timeGetTime () returned 0x47088 [0210.987] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0210.988] Sleep (dwMilliseconds=0xa) [0211.003] timeGetTime () returned 0x47097 [0211.003] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.003] Sleep (dwMilliseconds=0xa) [0211.018] timeGetTime () returned 0x470a7 [0211.018] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.018] Sleep (dwMilliseconds=0xa) [0211.031] timeGetTime () returned 0x470b7 [0211.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.031] Sleep (dwMilliseconds=0xa) [0211.049] timeGetTime () returned 0x470c6 [0211.049] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.049] Sleep (dwMilliseconds=0xa) [0211.065] timeGetTime () returned 0x470d6 [0211.065] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.065] Sleep (dwMilliseconds=0xa) [0211.079] timeGetTime () returned 0x470e5 [0211.079] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.079] Sleep (dwMilliseconds=0xa) [0211.097] timeGetTime () returned 0x470f5 [0211.097] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.097] Sleep (dwMilliseconds=0xa) [0211.109] timeGetTime () returned 0x47105 [0211.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.109] Sleep (dwMilliseconds=0xa) [0211.131] timeGetTime () returned 0x47114 [0211.131] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.131] Sleep (dwMilliseconds=0xa) [0211.158] timeGetTime () returned 0x47134 [0211.158] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.158] Sleep (dwMilliseconds=0xa) [0211.172] timeGetTime () returned 0x47143 [0211.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.172] Sleep (dwMilliseconds=0xa) [0211.188] timeGetTime () returned 0x47153 [0211.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.188] Sleep (dwMilliseconds=0xa) [0211.204] timeGetTime () returned 0x47162 [0211.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.204] Sleep (dwMilliseconds=0xa) [0211.220] timeGetTime () returned 0x47172 [0211.220] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.220] Sleep (dwMilliseconds=0xa) [0211.235] timeGetTime () returned 0x47182 [0211.235] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.235] Sleep (dwMilliseconds=0xa) [0211.252] timeGetTime () returned 0x47191 [0211.252] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.252] Sleep (dwMilliseconds=0xa) [0211.268] timeGetTime () returned 0x471a1 [0211.268] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.268] Sleep (dwMilliseconds=0xa) [0211.281] timeGetTime () returned 0x471b1 [0211.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.281] Sleep (dwMilliseconds=0xa) [0211.297] timeGetTime () returned 0x471c0 [0211.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.297] Sleep (dwMilliseconds=0xa) [0211.312] timeGetTime () returned 0x471d0 [0211.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.312] Sleep (dwMilliseconds=0xa) [0211.328] timeGetTime () returned 0x471df [0211.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.328] Sleep (dwMilliseconds=0xa) [0211.345] timeGetTime () returned 0x471ef [0211.345] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.345] Sleep (dwMilliseconds=0xa) [0211.359] timeGetTime () returned 0x471ff [0211.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.359] Sleep (dwMilliseconds=0xa) [0211.378] timeGetTime () returned 0x4720e [0211.378] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.378] Sleep (dwMilliseconds=0xa) [0211.394] timeGetTime () returned 0x4721e [0211.394] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0211.394] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0211.394] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0211.394] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0211.395] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0211.395] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0211.395] RegCloseKey (hKey=0x240) returned 0x0 [0211.395] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0211.395] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0211.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0211.395] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0211.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0211.395] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0211.395] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0211.395] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0211.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0211.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0211.396] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0211.396] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0211.484] FreeLibrary (hLibModule=0x77150000) returned 1 [0211.484] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0211.485] TranslateMessage (lpMsg=0x8bf708) returned 0 [0211.485] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0211.485] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0211.485] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0211.485] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0211.485] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0211.485] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0211.485] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0211.485] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0211.485] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0211.485] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0211.486] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0211.486] timeGetTime () returned 0x4727c [0211.486] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.486] Sleep (dwMilliseconds=0xa) [0211.555] timeGetTime () returned 0x472ba [0211.555] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.555] Sleep (dwMilliseconds=0xa) [0211.599] timeGetTime () returned 0x472e9 [0211.599] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.599] Sleep (dwMilliseconds=0xa) [0211.704] timeGetTime () returned 0x47356 [0211.704] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.704] Sleep (dwMilliseconds=0xa) [0211.755] timeGetTime () returned 0x47385 [0211.755] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.755] Sleep (dwMilliseconds=0xa) [0211.798] timeGetTime () returned 0x473b4 [0211.798] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.798] Sleep (dwMilliseconds=0xa) [0211.848] timeGetTime () returned 0x473e3 [0211.848] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.848] Sleep (dwMilliseconds=0xa) [0211.876] timeGetTime () returned 0x47402 [0211.876] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.876] Sleep (dwMilliseconds=0xa) [0211.894] timeGetTime () returned 0x47412 [0211.894] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.894] Sleep (dwMilliseconds=0xa) [0211.915] timeGetTime () returned 0x47422 [0211.915] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.915] Sleep (dwMilliseconds=0xa) [0211.950] timeGetTime () returned 0x47441 [0211.950] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.950] Sleep (dwMilliseconds=0xa) [0211.972] timeGetTime () returned 0x47460 [0211.972] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.972] Sleep (dwMilliseconds=0xa) [0211.985] timeGetTime () returned 0x47470 [0211.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0211.985] Sleep (dwMilliseconds=0xa) [0212.000] timeGetTime () returned 0x4747f [0212.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.000] Sleep (dwMilliseconds=0xa) [0212.016] timeGetTime () returned 0x4748f [0212.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.016] Sleep (dwMilliseconds=0xa) [0212.032] timeGetTime () returned 0x4749f [0212.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.032] Sleep (dwMilliseconds=0xa) [0212.048] timeGetTime () returned 0x474ae [0212.048] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.048] Sleep (dwMilliseconds=0xa) [0212.064] timeGetTime () returned 0x474be [0212.064] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.064] Sleep (dwMilliseconds=0xa) [0212.080] timeGetTime () returned 0x474cd [0212.080] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.080] Sleep (dwMilliseconds=0xa) [0212.096] timeGetTime () returned 0x474dd [0212.096] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.096] Sleep (dwMilliseconds=0xa) [0212.112] timeGetTime () returned 0x474ed [0212.112] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.112] Sleep (dwMilliseconds=0xa) [0212.128] timeGetTime () returned 0x474fc [0212.128] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.128] Sleep (dwMilliseconds=0xa) [0212.144] timeGetTime () returned 0x4750c [0212.144] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.144] Sleep (dwMilliseconds=0xa) [0212.161] timeGetTime () returned 0x4751c [0212.161] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.162] Sleep (dwMilliseconds=0xa) [0212.191] timeGetTime () returned 0x4753b [0212.191] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.191] Sleep (dwMilliseconds=0xa) [0212.204] timeGetTime () returned 0x4754a [0212.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.204] Sleep (dwMilliseconds=0xa) [0212.220] timeGetTime () returned 0x4755a [0212.220] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.220] Sleep (dwMilliseconds=0xa) [0212.234] timeGetTime () returned 0x4756a [0212.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0212.234] TranslateMessage (lpMsg=0x8bf798) returned 0 [0212.234] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0212.235] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0212.235] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0212.235] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.235] Sleep (dwMilliseconds=0xa) [0212.251] timeGetTime () returned 0x47579 [0212.251] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.251] Sleep (dwMilliseconds=0xa) [0212.266] timeGetTime () returned 0x47589 [0212.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.266] Sleep (dwMilliseconds=0xa) [0212.282] timeGetTime () returned 0x47599 [0212.282] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.282] Sleep (dwMilliseconds=0xa) [0212.300] timeGetTime () returned 0x475a8 [0212.300] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.300] Sleep (dwMilliseconds=0xa) [0212.314] timeGetTime () returned 0x475b8 [0212.314] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.314] Sleep (dwMilliseconds=0xa) [0212.329] timeGetTime () returned 0x475c7 [0212.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.329] Sleep (dwMilliseconds=0xa) [0212.344] timeGetTime () returned 0x475d7 [0212.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.344] Sleep (dwMilliseconds=0xa) [0212.362] timeGetTime () returned 0x475e7 [0212.362] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.362] Sleep (dwMilliseconds=0xa) [0212.377] timeGetTime () returned 0x475f6 [0212.377] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.377] Sleep (dwMilliseconds=0xa) [0212.392] timeGetTime () returned 0x47606 [0212.392] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.392] Sleep (dwMilliseconds=0xa) [0212.407] timeGetTime () returned 0x47616 [0212.407] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.407] Sleep (dwMilliseconds=0xa) [0212.422] timeGetTime () returned 0x47625 [0212.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.422] Sleep (dwMilliseconds=0xa) [0212.440] timeGetTime () returned 0x47635 [0212.440] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.440] Sleep (dwMilliseconds=0xa) [0212.455] timeGetTime () returned 0x47644 [0212.455] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.455] Sleep (dwMilliseconds=0xa) [0212.469] timeGetTime () returned 0x47654 [0212.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.469] Sleep (dwMilliseconds=0xa) [0212.487] timeGetTime () returned 0x47664 [0212.487] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0212.487] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0212.487] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0212.487] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0212.487] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0212.488] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0212.488] RegCloseKey (hKey=0x240) returned 0x0 [0212.488] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0212.488] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0212.488] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0212.488] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0212.488] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0212.488] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0212.488] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0212.488] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0212.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0212.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac98, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0212.488] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0212.489] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0212.579] FreeLibrary (hLibModule=0x77150000) returned 1 [0212.579] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0212.579] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0212.580] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0212.580] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0212.580] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0212.580] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0212.580] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0212.580] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0212.580] timeGetTime () returned 0x476c3 [0212.580] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.580] Sleep (dwMilliseconds=0xa) [0212.687] timeGetTime () returned 0x4772f [0212.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.687] Sleep (dwMilliseconds=0xa) [0212.735] timeGetTime () returned 0x4775e [0212.735] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.735] Sleep (dwMilliseconds=0xa) [0212.786] timeGetTime () returned 0x4778d [0212.786] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.786] Sleep (dwMilliseconds=0xa) [0212.829] timeGetTime () returned 0x477bb [0212.829] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.829] Sleep (dwMilliseconds=0xa) [0212.872] timeGetTime () returned 0x477db [0212.872] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.872] Sleep (dwMilliseconds=0xa) [0212.900] timeGetTime () returned 0x477fa [0212.900] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.900] Sleep (dwMilliseconds=0xa) [0212.923] timeGetTime () returned 0x47819 [0212.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.923] Sleep (dwMilliseconds=0xa) [0212.940] timeGetTime () returned 0x47829 [0212.940] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.940] Sleep (dwMilliseconds=0xa) [0212.953] timeGetTime () returned 0x47838 [0212.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.953] Sleep (dwMilliseconds=0xa) [0212.969] timeGetTime () returned 0x47848 [0212.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.969] Sleep (dwMilliseconds=0xa) [0212.988] timeGetTime () returned 0x47858 [0212.988] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0212.988] Sleep (dwMilliseconds=0xa) [0213.001] timeGetTime () returned 0x47867 [0213.001] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0213.001] TranslateMessage (lpMsg=0x8bf798) returned 0 [0213.001] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0213.001] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0213.001] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0213.002] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.002] Sleep (dwMilliseconds=0xa) [0213.018] timeGetTime () returned 0x47877 [0213.018] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.018] Sleep (dwMilliseconds=0xa) [0213.034] timeGetTime () returned 0x47887 [0213.034] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.034] Sleep (dwMilliseconds=0xa) [0213.047] timeGetTime () returned 0x47896 [0213.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.047] Sleep (dwMilliseconds=0xa) [0213.065] timeGetTime () returned 0x478a6 [0213.065] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.065] Sleep (dwMilliseconds=0xa) [0213.078] timeGetTime () returned 0x478b5 [0213.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.078] Sleep (dwMilliseconds=0xa) [0213.095] timeGetTime () returned 0x478c5 [0213.095] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.095] Sleep (dwMilliseconds=0xa) [0213.110] timeGetTime () returned 0x478d5 [0213.110] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.110] Sleep (dwMilliseconds=0xa) [0213.128] timeGetTime () returned 0x478e4 [0213.128] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.128] Sleep (dwMilliseconds=0xa) [0213.142] timeGetTime () returned 0x478f4 [0213.142] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.142] Sleep (dwMilliseconds=0xa) [0213.160] timeGetTime () returned 0x47904 [0213.160] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.160] Sleep (dwMilliseconds=0xa) [0213.173] timeGetTime () returned 0x47913 [0213.173] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.173] Sleep (dwMilliseconds=0xa) [0213.187] timeGetTime () returned 0x47923 [0213.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.187] Sleep (dwMilliseconds=0xa) [0213.204] timeGetTime () returned 0x47932 [0213.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.204] Sleep (dwMilliseconds=0xa) [0213.218] timeGetTime () returned 0x47942 [0213.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.219] Sleep (dwMilliseconds=0xa) [0213.236] timeGetTime () returned 0x47952 [0213.236] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.236] Sleep (dwMilliseconds=0xa) [0213.250] timeGetTime () returned 0x47961 [0213.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.250] Sleep (dwMilliseconds=0xa) [0213.268] timeGetTime () returned 0x47971 [0213.268] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.268] Sleep (dwMilliseconds=0xa) [0213.281] timeGetTime () returned 0x47981 [0213.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.281] Sleep (dwMilliseconds=0xa) [0213.299] timeGetTime () returned 0x47990 [0213.299] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.299] Sleep (dwMilliseconds=0xa) [0213.316] timeGetTime () returned 0x479a0 [0213.316] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.316] Sleep (dwMilliseconds=0xa) [0213.329] timeGetTime () returned 0x479af [0213.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.329] Sleep (dwMilliseconds=0xa) [0213.346] timeGetTime () returned 0x479bf [0213.346] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.346] Sleep (dwMilliseconds=0xa) [0213.360] timeGetTime () returned 0x479cf [0213.360] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.360] Sleep (dwMilliseconds=0xa) [0213.376] timeGetTime () returned 0x479de [0213.376] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.377] Sleep (dwMilliseconds=0xa) [0213.394] timeGetTime () returned 0x479ee [0213.394] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.394] Sleep (dwMilliseconds=0xa) [0213.407] timeGetTime () returned 0x479fe [0213.407] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.407] Sleep (dwMilliseconds=0xa) [0213.425] timeGetTime () returned 0x47a0d [0213.425] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.425] Sleep (dwMilliseconds=0xa) [0213.437] timeGetTime () returned 0x47a1d [0213.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.437] Sleep (dwMilliseconds=0xa) [0213.453] timeGetTime () returned 0x47a2c [0213.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.453] Sleep (dwMilliseconds=0xa) [0213.470] timeGetTime () returned 0x47a3c [0213.470] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.470] Sleep (dwMilliseconds=0xa) [0213.487] timeGetTime () returned 0x47a4c [0213.487] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.487] Sleep (dwMilliseconds=0xa) [0213.503] timeGetTime () returned 0x47a5b [0213.503] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.503] Sleep (dwMilliseconds=0xa) [0213.516] timeGetTime () returned 0x47a6b [0213.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.516] Sleep (dwMilliseconds=0xa) [0213.533] timeGetTime () returned 0x47a7b [0213.533] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.533] Sleep (dwMilliseconds=0xa) [0213.556] timeGetTime () returned 0x47a8a [0213.556] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.556] Sleep (dwMilliseconds=0xa) [0213.589] timeGetTime () returned 0x47aa9 [0213.589] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.589] Sleep (dwMilliseconds=0xa) [0213.610] timeGetTime () returned 0x47ac9 [0213.610] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0213.610] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0213.610] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0213.610] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0213.610] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0213.611] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0213.611] RegCloseKey (hKey=0x240) returned 0x0 [0213.611] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0213.611] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0213.611] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0213.611] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0213.611] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0213.611] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0213.611] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0213.611] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0213.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0213.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acf8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0213.612] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0213.612] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0213.750] FreeLibrary (hLibModule=0x77150000) returned 1 [0213.750] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0213.750] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0213.750] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0213.750] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0213.750] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0213.750] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0213.750] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0213.751] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0213.751] timeGetTime () returned 0x47b55 [0213.751] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.751] Sleep (dwMilliseconds=0xa) [0213.800] timeGetTime () returned 0x47b84 [0213.800] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0213.800] TranslateMessage (lpMsg=0x8bf798) returned 0 [0213.800] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0213.801] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0213.801] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0213.801] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.801] Sleep (dwMilliseconds=0xa) [0213.844] timeGetTime () returned 0x47bb3 [0213.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.844] Sleep (dwMilliseconds=0xa) [0213.895] timeGetTime () returned 0x47be2 [0213.895] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.895] Sleep (dwMilliseconds=0xa) [0213.938] timeGetTime () returned 0x47c11 [0213.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.938] Sleep (dwMilliseconds=0xa) [0213.988] timeGetTime () returned 0x47c40 [0213.988] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0213.988] Sleep (dwMilliseconds=0xa) [0214.001] timeGetTime () returned 0x47c4f [0214.001] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.001] Sleep (dwMilliseconds=0xa) [0214.017] timeGetTime () returned 0x47c5f [0214.017] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.017] Sleep (dwMilliseconds=0xa) [0214.041] timeGetTime () returned 0x47c6f [0214.041] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.041] Sleep (dwMilliseconds=0xa) [0214.063] timeGetTime () returned 0x47c8e [0214.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.063] Sleep (dwMilliseconds=0xa) [0214.081] timeGetTime () returned 0x47c9d [0214.081] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.081] Sleep (dwMilliseconds=0xa) [0214.094] timeGetTime () returned 0x47cad [0214.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.094] Sleep (dwMilliseconds=0xa) [0214.111] timeGetTime () returned 0x47cbd [0214.111] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.111] Sleep (dwMilliseconds=0xa) [0214.126] timeGetTime () returned 0x47ccc [0214.126] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.126] Sleep (dwMilliseconds=0xa) [0214.143] timeGetTime () returned 0x47cdc [0214.143] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.143] Sleep (dwMilliseconds=0xa) [0214.157] timeGetTime () returned 0x47cec [0214.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.157] Sleep (dwMilliseconds=0xa) [0214.175] timeGetTime () returned 0x47cfb [0214.175] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.175] Sleep (dwMilliseconds=0xa) [0214.188] timeGetTime () returned 0x47d0b [0214.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.188] Sleep (dwMilliseconds=0xa) [0214.206] timeGetTime () returned 0x47d1a [0214.206] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.206] Sleep (dwMilliseconds=0xa) [0214.219] timeGetTime () returned 0x47d2a [0214.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.219] Sleep (dwMilliseconds=0xa) [0214.236] timeGetTime () returned 0x47d3a [0214.236] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.236] Sleep (dwMilliseconds=0xa) [0214.254] timeGetTime () returned 0x47d49 [0214.254] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.254] Sleep (dwMilliseconds=0xa) [0214.268] timeGetTime () returned 0x47d59 [0214.268] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.268] Sleep (dwMilliseconds=0xa) [0214.281] timeGetTime () returned 0x47d69 [0214.282] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.282] Sleep (dwMilliseconds=0xa) [0214.297] timeGetTime () returned 0x47d78 [0214.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.298] Sleep (dwMilliseconds=0xa) [0214.316] timeGetTime () returned 0x47d88 [0214.316] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.316] Sleep (dwMilliseconds=0xa) [0214.328] timeGetTime () returned 0x47d97 [0214.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.328] Sleep (dwMilliseconds=0xa) [0214.345] timeGetTime () returned 0x47da7 [0214.345] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.345] Sleep (dwMilliseconds=0xa) [0214.361] timeGetTime () returned 0x47db7 [0214.361] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.361] Sleep (dwMilliseconds=0xa) [0214.375] timeGetTime () returned 0x47dc6 [0214.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.375] Sleep (dwMilliseconds=0xa) [0214.392] timeGetTime () returned 0x47dd6 [0214.392] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.392] Sleep (dwMilliseconds=0xa) [0214.409] timeGetTime () returned 0x47de6 [0214.409] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.409] Sleep (dwMilliseconds=0xa) [0214.422] timeGetTime () returned 0x47df5 [0214.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.422] Sleep (dwMilliseconds=0xa) [0214.438] timeGetTime () returned 0x47e05 [0214.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.438] Sleep (dwMilliseconds=0xa) [0214.455] timeGetTime () returned 0x47e14 [0214.455] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.455] Sleep (dwMilliseconds=0xa) [0214.471] timeGetTime () returned 0x47e24 [0214.471] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.471] Sleep (dwMilliseconds=0xa) [0214.484] timeGetTime () returned 0x47e34 [0214.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.484] Sleep (dwMilliseconds=0xa) [0214.500] timeGetTime () returned 0x47e43 [0214.501] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.501] Sleep (dwMilliseconds=0xa) [0214.516] timeGetTime () returned 0x47e53 [0214.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.516] Sleep (dwMilliseconds=0xa) [0214.532] timeGetTime () returned 0x47e63 [0214.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.532] Sleep (dwMilliseconds=0xa) [0214.554] timeGetTime () returned 0x47e72 [0214.554] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.554] Sleep (dwMilliseconds=0xa) [0214.580] timeGetTime () returned 0x47e91 [0214.580] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0214.580] TranslateMessage (lpMsg=0x8bf798) returned 0 [0214.580] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0214.580] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0214.580] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0214.581] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.581] Sleep (dwMilliseconds=0xa) [0214.594] timeGetTime () returned 0x47ea1 [0214.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.594] Sleep (dwMilliseconds=0xa) [0214.609] timeGetTime () returned 0x47eb1 [0214.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.609] Sleep (dwMilliseconds=0xa) [0214.627] timeGetTime () returned 0x47ec1 [0214.627] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.627] Sleep (dwMilliseconds=0xa) [0214.712] timeGetTime () returned 0x47f0e [0214.712] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.712] Sleep (dwMilliseconds=0xa) [0214.735] timeGetTime () returned 0x47f2e [0214.735] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.735] Sleep (dwMilliseconds=0xa) [0214.753] timeGetTime () returned 0x47f3d [0214.753] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0214.753] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0214.753] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.753] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0214.753] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0214.753] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0214.753] RegCloseKey (hKey=0x240) returned 0x0 [0214.753] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0214.753] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0214.753] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0214.753] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0214.753] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0214.753] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0214.753] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0214.754] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0214.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0214.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aad8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0214.754] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0214.754] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0214.860] FreeLibrary (hLibModule=0x77150000) returned 1 [0214.860] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0214.860] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0214.860] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0214.860] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0214.860] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0214.860] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.860] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0214.861] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0214.861] timeGetTime () returned 0x47fab [0214.861] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.861] Sleep (dwMilliseconds=0xa) [0214.880] timeGetTime () returned 0x47fba [0214.880] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.880] Sleep (dwMilliseconds=0xa) [0214.908] timeGetTime () returned 0x47fda [0214.908] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.908] Sleep (dwMilliseconds=0xa) [0214.958] timeGetTime () returned 0x48008 [0214.958] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0214.958] Sleep (dwMilliseconds=0xa) [0215.004] timeGetTime () returned 0x48037 [0215.004] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.004] Sleep (dwMilliseconds=0xa) [0215.050] timeGetTime () returned 0x48066 [0215.050] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.050] Sleep (dwMilliseconds=0xa) [0215.094] timeGetTime () returned 0x48095 [0215.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.094] Sleep (dwMilliseconds=0xa) [0215.113] timeGetTime () returned 0x480a5 [0215.113] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.113] Sleep (dwMilliseconds=0xa) [0215.126] timeGetTime () returned 0x480b4 [0215.126] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.126] Sleep (dwMilliseconds=0xa) [0215.152] timeGetTime () returned 0x480c4 [0215.152] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.152] Sleep (dwMilliseconds=0xa) [0215.183] timeGetTime () returned 0x480e3 [0215.183] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.183] Sleep (dwMilliseconds=0xa) [0215.205] timeGetTime () returned 0x48102 [0215.205] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.205] Sleep (dwMilliseconds=0xa) [0215.219] timeGetTime () returned 0x48112 [0215.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.219] Sleep (dwMilliseconds=0xa) [0215.237] timeGetTime () returned 0x48122 [0215.237] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.237] Sleep (dwMilliseconds=0xa) [0215.250] timeGetTime () returned 0x48131 [0215.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.250] Sleep (dwMilliseconds=0xa) [0215.267] timeGetTime () returned 0x48141 [0215.267] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.267] Sleep (dwMilliseconds=0xa) [0215.281] timeGetTime () returned 0x48151 [0215.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.281] Sleep (dwMilliseconds=0xa) [0215.297] timeGetTime () returned 0x48160 [0215.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.297] Sleep (dwMilliseconds=0xa) [0215.315] timeGetTime () returned 0x48170 [0215.315] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.315] Sleep (dwMilliseconds=0xa) [0215.328] timeGetTime () returned 0x4817f [0215.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0215.328] TranslateMessage (lpMsg=0x8bf798) returned 0 [0215.328] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0215.328] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0215.328] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0215.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.328] Sleep (dwMilliseconds=0xa) [0215.345] timeGetTime () returned 0x4818f [0215.345] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.345] Sleep (dwMilliseconds=0xa) [0215.362] timeGetTime () returned 0x4819f [0215.362] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.362] Sleep (dwMilliseconds=0xa) [0215.375] timeGetTime () returned 0x481ae [0215.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.375] Sleep (dwMilliseconds=0xa) [0215.390] timeGetTime () returned 0x481be [0215.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.390] Sleep (dwMilliseconds=0xa) [0215.410] timeGetTime () returned 0x481ce [0215.410] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.410] Sleep (dwMilliseconds=0xa) [0215.424] timeGetTime () returned 0x481dd [0215.424] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.424] Sleep (dwMilliseconds=0xa) [0215.438] timeGetTime () returned 0x481ed [0215.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.438] Sleep (dwMilliseconds=0xa) [0215.454] timeGetTime () returned 0x481fc [0215.454] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.454] Sleep (dwMilliseconds=0xa) [0215.468] timeGetTime () returned 0x4820c [0215.468] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.468] Sleep (dwMilliseconds=0xa) [0215.485] timeGetTime () returned 0x4821c [0215.485] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.485] Sleep (dwMilliseconds=0xa) [0215.502] timeGetTime () returned 0x4822b [0215.503] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.503] Sleep (dwMilliseconds=0xa) [0215.516] timeGetTime () returned 0x4823b [0215.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.516] Sleep (dwMilliseconds=0xa) [0215.533] timeGetTime () returned 0x4824b [0215.533] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.533] Sleep (dwMilliseconds=0xa) [0215.556] timeGetTime () returned 0x4825a [0215.556] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.556] Sleep (dwMilliseconds=0xa) [0215.578] timeGetTime () returned 0x4827a [0215.578] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.579] Sleep (dwMilliseconds=0xa) [0215.595] timeGetTime () returned 0x48289 [0215.595] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.595] Sleep (dwMilliseconds=0xa) [0215.612] timeGetTime () returned 0x48299 [0215.612] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.612] Sleep (dwMilliseconds=0xa) [0215.626] timeGetTime () returned 0x482a8 [0215.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.626] Sleep (dwMilliseconds=0xa) [0215.711] timeGetTime () returned 0x482f6 [0215.711] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.711] Sleep (dwMilliseconds=0xa) [0215.734] timeGetTime () returned 0x48316 [0215.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.734] Sleep (dwMilliseconds=0xa) [0215.751] timeGetTime () returned 0x48325 [0215.751] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.751] Sleep (dwMilliseconds=0xa) [0215.768] timeGetTime () returned 0x48335 [0215.768] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.768] Sleep (dwMilliseconds=0xa) [0215.781] timeGetTime () returned 0x48345 [0215.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.781] Sleep (dwMilliseconds=0xa) [0215.797] timeGetTime () returned 0x48354 [0215.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.797] Sleep (dwMilliseconds=0xa) [0215.815] timeGetTime () returned 0x48364 [0215.815] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.815] Sleep (dwMilliseconds=0xa) [0215.829] timeGetTime () returned 0x48373 [0215.829] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.829] Sleep (dwMilliseconds=0xa) [0215.844] timeGetTime () returned 0x48383 [0215.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.844] Sleep (dwMilliseconds=0xa) [0215.861] timeGetTime () returned 0x48393 [0215.861] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0215.861] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0215.861] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.861] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0215.861] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0215.861] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0215.861] RegCloseKey (hKey=0x240) returned 0x0 [0215.861] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0215.861] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0215.861] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0215.861] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0215.861] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0215.861] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0215.861] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0215.861] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0215.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0215.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0215.862] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0215.862] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0215.953] FreeLibrary (hLibModule=0x77150000) returned 1 [0215.953] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0215.953] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0215.954] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0215.954] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0215.954] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0215.954] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.954] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0215.954] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0215.954] timeGetTime () returned 0x483f1 [0215.954] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0215.954] Sleep (dwMilliseconds=0xa) [0216.015] timeGetTime () returned 0x4842f [0216.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.015] Sleep (dwMilliseconds=0xa) [0216.067] timeGetTime () returned 0x4845e [0216.067] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.067] Sleep (dwMilliseconds=0xa) [0216.110] timeGetTime () returned 0x4848d [0216.110] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0216.110] TranslateMessage (lpMsg=0x8bf798) returned 0 [0216.110] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0216.110] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0216.111] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0216.111] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.111] Sleep (dwMilliseconds=0xa) [0216.161] timeGetTime () returned 0x484bc [0216.161] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.161] Sleep (dwMilliseconds=0xa) [0216.204] timeGetTime () returned 0x484ea [0216.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.204] Sleep (dwMilliseconds=0xa) [0216.242] timeGetTime () returned 0x4850a [0216.242] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.242] Sleep (dwMilliseconds=0xa) [0216.268] timeGetTime () returned 0x48529 [0216.268] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.268] Sleep (dwMilliseconds=0xa) [0216.282] timeGetTime () returned 0x48539 [0216.282] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.282] Sleep (dwMilliseconds=0xa) [0216.307] timeGetTime () returned 0x48548 [0216.307] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.307] Sleep (dwMilliseconds=0xa) [0216.330] timeGetTime () returned 0x48567 [0216.330] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.330] Sleep (dwMilliseconds=0xa) [0216.346] timeGetTime () returned 0x48577 [0216.346] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.346] Sleep (dwMilliseconds=0xa) [0216.363] timeGetTime () returned 0x48587 [0216.363] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.363] Sleep (dwMilliseconds=0xa) [0216.376] timeGetTime () returned 0x48596 [0216.376] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.376] Sleep (dwMilliseconds=0xa) [0216.393] timeGetTime () returned 0x485a6 [0216.393] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.393] Sleep (dwMilliseconds=0xa) [0216.409] timeGetTime () returned 0x485b6 [0216.409] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.409] Sleep (dwMilliseconds=0xa) [0216.423] timeGetTime () returned 0x485c5 [0216.423] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.423] Sleep (dwMilliseconds=0xa) [0216.440] timeGetTime () returned 0x485d5 [0216.440] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.440] Sleep (dwMilliseconds=0xa) [0216.456] timeGetTime () returned 0x485e4 [0216.456] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.456] Sleep (dwMilliseconds=0xa) [0216.470] timeGetTime () returned 0x485f4 [0216.470] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.470] Sleep (dwMilliseconds=0xa) [0216.486] timeGetTime () returned 0x48604 [0216.486] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.486] Sleep (dwMilliseconds=0xa) [0216.500] timeGetTime () returned 0x48613 [0216.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.500] Sleep (dwMilliseconds=0xa) [0216.516] timeGetTime () returned 0x48623 [0216.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.516] Sleep (dwMilliseconds=0xa) [0216.534] timeGetTime () returned 0x48633 [0216.534] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.534] Sleep (dwMilliseconds=0xa) [0216.553] timeGetTime () returned 0x48642 [0216.553] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.553] Sleep (dwMilliseconds=0xa) [0216.580] timeGetTime () returned 0x48661 [0216.580] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.580] Sleep (dwMilliseconds=0xa) [0216.596] timeGetTime () returned 0x48671 [0216.596] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.596] Sleep (dwMilliseconds=0xa) [0216.610] timeGetTime () returned 0x48681 [0216.610] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.610] Sleep (dwMilliseconds=0xa) [0216.626] timeGetTime () returned 0x48690 [0216.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.626] Sleep (dwMilliseconds=0xa) [0216.763] timeGetTime () returned 0x4870d [0216.763] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.763] Sleep (dwMilliseconds=0xa) [0216.783] timeGetTime () returned 0x4872d [0216.784] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.784] Sleep (dwMilliseconds=0xa) [0216.797] timeGetTime () returned 0x4873c [0216.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.797] Sleep (dwMilliseconds=0xa) [0216.815] timeGetTime () returned 0x4874c [0216.815] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.815] Sleep (dwMilliseconds=0xa) [0216.828] timeGetTime () returned 0x4875b [0216.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.828] Sleep (dwMilliseconds=0xa) [0216.844] timeGetTime () returned 0x4876b [0216.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.844] Sleep (dwMilliseconds=0xa) [0216.861] timeGetTime () returned 0x4877b [0216.861] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.861] Sleep (dwMilliseconds=0xa) [0216.878] timeGetTime () returned 0x4878a [0216.878] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0216.878] TranslateMessage (lpMsg=0x8bf798) returned 0 [0216.878] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0216.878] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0216.878] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0216.879] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.879] Sleep (dwMilliseconds=0xa) [0216.891] timeGetTime () returned 0x4879a [0216.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.892] Sleep (dwMilliseconds=0xa) [0216.909] timeGetTime () returned 0x487aa [0216.909] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.909] Sleep (dwMilliseconds=0xa) [0216.922] timeGetTime () returned 0x487b9 [0216.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.922] Sleep (dwMilliseconds=0xa) [0216.939] timeGetTime () returned 0x487c9 [0216.939] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.939] Sleep (dwMilliseconds=0xa) [0216.953] timeGetTime () returned 0x487d8 [0216.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0216.953] Sleep (dwMilliseconds=0xa) [0216.969] timeGetTime () returned 0x487e8 [0216.969] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0216.969] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0216.969] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.969] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0216.969] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0216.969] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0216.969] RegCloseKey (hKey=0x240) returned 0x0 [0216.969] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0216.969] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0216.969] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0216.969] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0216.970] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0216.970] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0216.970] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0216.970] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0216.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0216.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0216.970] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0216.970] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0217.062] FreeLibrary (hLibModule=0x77150000) returned 1 [0217.062] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0217.063] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0217.063] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0217.063] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0217.063] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0217.063] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.063] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0217.063] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0217.063] timeGetTime () returned 0x48846 [0217.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.063] Sleep (dwMilliseconds=0xa) [0217.125] timeGetTime () returned 0x48884 [0217.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.125] Sleep (dwMilliseconds=0xa) [0217.175] timeGetTime () returned 0x488b3 [0217.175] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.175] Sleep (dwMilliseconds=0xa) [0217.219] timeGetTime () returned 0x488e2 [0217.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.219] Sleep (dwMilliseconds=0xa) [0217.269] timeGetTime () returned 0x48911 [0217.269] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.269] Sleep (dwMilliseconds=0xa) [0217.302] timeGetTime () returned 0x48930 [0217.302] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.302] Sleep (dwMilliseconds=0xa) [0217.328] timeGetTime () returned 0x4894f [0217.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.328] Sleep (dwMilliseconds=0xa) [0217.346] timeGetTime () returned 0x4895f [0217.346] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.346] Sleep (dwMilliseconds=0xa) [0217.367] timeGetTime () returned 0x4896f [0217.367] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.367] Sleep (dwMilliseconds=0xa) [0217.402] timeGetTime () returned 0x4898e [0217.402] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.402] Sleep (dwMilliseconds=0xa) [0217.424] timeGetTime () returned 0x489ad [0217.424] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.424] Sleep (dwMilliseconds=0xa) [0217.438] timeGetTime () returned 0x489bd [0217.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.438] Sleep (dwMilliseconds=0xa) [0217.455] timeGetTime () returned 0x489cc [0217.455] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.455] Sleep (dwMilliseconds=0xa) [0217.471] timeGetTime () returned 0x489dc [0217.471] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.471] Sleep (dwMilliseconds=0xa) [0217.484] timeGetTime () returned 0x489ec [0217.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.484] Sleep (dwMilliseconds=0xa) [0217.533] timeGetTime () returned 0x48a1b [0217.533] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.533] Sleep (dwMilliseconds=0xa) [0217.575] timeGetTime () returned 0x48a3a [0217.575] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.575] Sleep (dwMilliseconds=0xa) [0217.626] timeGetTime () returned 0x48a78 [0217.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0217.626] TranslateMessage (lpMsg=0x8bf798) returned 0 [0217.626] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0217.626] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0217.626] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0217.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.626] Sleep (dwMilliseconds=0xa) [0217.735] timeGetTime () returned 0x48ae6 [0217.735] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.735] Sleep (dwMilliseconds=0xa) [0217.797] timeGetTime () returned 0x48b24 [0217.798] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.798] Sleep (dwMilliseconds=0xa) [0217.844] timeGetTime () returned 0x48b53 [0217.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.844] Sleep (dwMilliseconds=0xa) [0217.891] timeGetTime () returned 0x48b82 [0217.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.891] Sleep (dwMilliseconds=0xa) [0217.938] timeGetTime () returned 0x48bb1 [0217.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.938] Sleep (dwMilliseconds=0xa) [0217.964] timeGetTime () returned 0x48bc0 [0217.964] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.964] Sleep (dwMilliseconds=0xa) [0217.987] timeGetTime () returned 0x48be0 [0217.987] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0217.987] Sleep (dwMilliseconds=0xa) [0218.001] timeGetTime () returned 0x48bef [0218.001] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.001] Sleep (dwMilliseconds=0xa) [0218.020] timeGetTime () returned 0x48bff [0218.020] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.020] Sleep (dwMilliseconds=0xa) [0218.034] timeGetTime () returned 0x48c0f [0218.034] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.034] Sleep (dwMilliseconds=0xa) [0218.048] timeGetTime () returned 0x48c1e [0218.048] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.048] Sleep (dwMilliseconds=0xa) [0218.063] timeGetTime () returned 0x48c2e [0218.063] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0218.063] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0218.063] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.063] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0218.063] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0218.063] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0218.063] RegCloseKey (hKey=0x240) returned 0x0 [0218.063] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0218.063] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0218.063] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0218.063] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0218.063] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0218.063] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0218.064] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0218.064] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0218.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0218.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0218.064] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0218.064] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0218.172] FreeLibrary (hLibModule=0x77150000) returned 1 [0218.172] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0218.172] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0218.172] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0218.172] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0218.172] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0218.172] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.172] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0218.172] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0218.172] timeGetTime () returned 0x48c9b [0218.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.172] Sleep (dwMilliseconds=0xa) [0218.234] timeGetTime () returned 0x48cda [0218.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.234] Sleep (dwMilliseconds=0xa) [0218.282] timeGetTime () returned 0x48d09 [0218.282] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.282] Sleep (dwMilliseconds=0xa) [0218.329] timeGetTime () returned 0x48d37 [0218.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.329] Sleep (dwMilliseconds=0xa) [0218.377] timeGetTime () returned 0x48d66 [0218.377] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0218.378] TranslateMessage (lpMsg=0x8bf798) returned 0 [0218.378] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0218.378] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0218.378] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0218.378] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.378] Sleep (dwMilliseconds=0xa) [0218.398] timeGetTime () returned 0x48d76 [0218.398] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.398] Sleep (dwMilliseconds=0xa) [0218.423] timeGetTime () returned 0x48d95 [0218.423] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.423] Sleep (dwMilliseconds=0xa) [0218.447] timeGetTime () returned 0x48da5 [0218.447] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.447] Sleep (dwMilliseconds=0xa) [0218.479] timeGetTime () returned 0x48dc4 [0218.479] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.479] Sleep (dwMilliseconds=0xa) [0218.502] timeGetTime () returned 0x48de3 [0218.502] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.502] Sleep (dwMilliseconds=0xa) [0218.516] timeGetTime () returned 0x48df3 [0218.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.516] Sleep (dwMilliseconds=0xa) [0218.532] timeGetTime () returned 0x48e03 [0218.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.532] Sleep (dwMilliseconds=0xa) [0218.555] timeGetTime () returned 0x48e12 [0218.555] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.555] Sleep (dwMilliseconds=0xa) [0218.580] timeGetTime () returned 0x48e31 [0218.580] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.580] Sleep (dwMilliseconds=0xa) [0218.594] timeGetTime () returned 0x48e41 [0218.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.594] Sleep (dwMilliseconds=0xa) [0218.611] timeGetTime () returned 0x48e51 [0218.611] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.611] Sleep (dwMilliseconds=0xa) [0218.626] timeGetTime () returned 0x48e60 [0218.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.626] Sleep (dwMilliseconds=0xa) [0218.641] timeGetTime () returned 0x48e70 [0218.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.641] Sleep (dwMilliseconds=0xa) [0218.725] timeGetTime () returned 0x48ebe [0218.725] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.725] Sleep (dwMilliseconds=0xa) [0218.750] timeGetTime () returned 0x48edd [0218.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.750] Sleep (dwMilliseconds=0xa) [0218.767] timeGetTime () returned 0x48eed [0218.767] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.767] Sleep (dwMilliseconds=0xa) [0218.781] timeGetTime () returned 0x48efd [0218.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.781] Sleep (dwMilliseconds=0xa) [0218.797] timeGetTime () returned 0x48f0c [0218.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.797] Sleep (dwMilliseconds=0xa) [0218.814] timeGetTime () returned 0x48f1c [0218.814] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.814] Sleep (dwMilliseconds=0xa) [0218.828] timeGetTime () returned 0x48f2b [0218.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.828] Sleep (dwMilliseconds=0xa) [0218.844] timeGetTime () returned 0x48f3b [0218.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.844] Sleep (dwMilliseconds=0xa) [0218.859] timeGetTime () returned 0x48f4b [0218.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.859] Sleep (dwMilliseconds=0xa) [0218.885] timeGetTime () returned 0x48f5a [0218.885] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.885] Sleep (dwMilliseconds=0xa) [0218.907] timeGetTime () returned 0x48f7a [0218.907] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.907] Sleep (dwMilliseconds=0xa) [0218.924] timeGetTime () returned 0x48f89 [0218.924] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.924] Sleep (dwMilliseconds=0xa) [0218.938] timeGetTime () returned 0x48f99 [0218.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.938] Sleep (dwMilliseconds=0xa) [0218.953] timeGetTime () returned 0x48fa8 [0218.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.953] Sleep (dwMilliseconds=0xa) [0218.970] timeGetTime () returned 0x48fb8 [0218.970] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.970] Sleep (dwMilliseconds=0xa) [0218.984] timeGetTime () returned 0x48fc8 [0218.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0218.984] Sleep (dwMilliseconds=0xa) [0219.002] timeGetTime () returned 0x48fd7 [0219.002] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.002] Sleep (dwMilliseconds=0xa) [0219.016] timeGetTime () returned 0x48fe7 [0219.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.016] Sleep (dwMilliseconds=0xa) [0219.032] timeGetTime () returned 0x48ff7 [0219.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.032] Sleep (dwMilliseconds=0xa) [0219.050] timeGetTime () returned 0x49006 [0219.050] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.050] Sleep (dwMilliseconds=0xa) [0219.064] timeGetTime () returned 0x49016 [0219.064] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.064] Sleep (dwMilliseconds=0xa) [0219.078] timeGetTime () returned 0x49025 [0219.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.078] Sleep (dwMilliseconds=0xa) [0219.096] timeGetTime () returned 0x49035 [0219.096] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.096] Sleep (dwMilliseconds=0xa) [0219.111] timeGetTime () returned 0x49045 [0219.111] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.111] Sleep (dwMilliseconds=0xa) [0219.125] timeGetTime () returned 0x49054 [0219.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0219.126] TranslateMessage (lpMsg=0x8bf798) returned 0 [0219.126] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0219.126] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0219.126] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0219.126] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.126] Sleep (dwMilliseconds=0xa) [0219.140] timeGetTime () returned 0x49064 [0219.140] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.140] Sleep (dwMilliseconds=0xa) [0219.156] timeGetTime () returned 0x49074 [0219.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.156] Sleep (dwMilliseconds=0xa) [0219.172] timeGetTime () returned 0x49083 [0219.172] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0219.173] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0219.173] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0219.173] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0219.173] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0219.173] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0219.173] RegCloseKey (hKey=0x240) returned 0x0 [0219.173] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0219.173] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0219.173] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0219.173] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0219.173] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0219.173] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0219.173] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0219.173] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0219.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0219.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9b8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0219.174] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0219.174] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0219.266] FreeLibrary (hLibModule=0x77150000) returned 1 [0219.266] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0219.266] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0219.266] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0219.266] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0219.266] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0219.266] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0219.266] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0219.266] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0219.266] timeGetTime () returned 0x490e1 [0219.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.266] Sleep (dwMilliseconds=0xa) [0219.328] timeGetTime () returned 0x4911f [0219.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.328] Sleep (dwMilliseconds=0xa) [0219.375] timeGetTime () returned 0x4914e [0219.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.375] Sleep (dwMilliseconds=0xa) [0219.409] timeGetTime () returned 0x4916e [0219.409] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.409] Sleep (dwMilliseconds=0xa) [0219.456] timeGetTime () returned 0x4919c [0219.456] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.456] Sleep (dwMilliseconds=0xa) [0219.500] timeGetTime () returned 0x491cb [0219.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.500] Sleep (dwMilliseconds=0xa) [0219.517] timeGetTime () returned 0x491db [0219.517] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.517] Sleep (dwMilliseconds=0xa) [0219.533] timeGetTime () returned 0x491eb [0219.533] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.533] Sleep (dwMilliseconds=0xa) [0219.555] timeGetTime () returned 0x491fa [0219.555] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.555] Sleep (dwMilliseconds=0xa) [0219.592] timeGetTime () returned 0x49219 [0219.592] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.592] Sleep (dwMilliseconds=0xa) [0219.612] timeGetTime () returned 0x49239 [0219.612] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.612] Sleep (dwMilliseconds=0xa) [0219.626] timeGetTime () returned 0x49248 [0219.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.626] Sleep (dwMilliseconds=0xa) [0219.641] timeGetTime () returned 0x49258 [0219.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.641] Sleep (dwMilliseconds=0xa) [0219.730] timeGetTime () returned 0x492a6 [0219.730] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.730] Sleep (dwMilliseconds=0xa) [0219.751] timeGetTime () returned 0x492c5 [0219.751] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.751] Sleep (dwMilliseconds=0xa) [0219.766] timeGetTime () returned 0x492d5 [0219.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.766] Sleep (dwMilliseconds=0xa) [0219.783] timeGetTime () returned 0x492e5 [0219.783] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.783] Sleep (dwMilliseconds=0xa) [0219.798] timeGetTime () returned 0x492f4 [0219.798] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.798] Sleep (dwMilliseconds=0xa) [0219.815] timeGetTime () returned 0x49304 [0219.815] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.815] Sleep (dwMilliseconds=0xa) [0219.828] timeGetTime () returned 0x49314 [0219.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.828] Sleep (dwMilliseconds=0xa) [0219.844] timeGetTime () returned 0x49323 [0219.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.844] Sleep (dwMilliseconds=0xa) [0219.861] timeGetTime () returned 0x49333 [0219.861] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.861] Sleep (dwMilliseconds=0xa) [0219.877] timeGetTime () returned 0x49342 [0219.877] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0219.877] TranslateMessage (lpMsg=0x8bf798) returned 0 [0219.877] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0219.877] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0219.877] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0219.877] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.877] Sleep (dwMilliseconds=0xa) [0219.893] timeGetTime () returned 0x49352 [0219.893] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.893] Sleep (dwMilliseconds=0xa) [0219.908] timeGetTime () returned 0x49362 [0219.908] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.908] Sleep (dwMilliseconds=0xa) [0219.922] timeGetTime () returned 0x49371 [0219.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.922] Sleep (dwMilliseconds=0xa) [0219.937] timeGetTime () returned 0x49381 [0219.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.937] Sleep (dwMilliseconds=0xa) [0219.954] timeGetTime () returned 0x49390 [0219.954] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.954] Sleep (dwMilliseconds=0xa) [0219.971] timeGetTime () returned 0x493a0 [0219.971] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.971] Sleep (dwMilliseconds=0xa) [0219.986] timeGetTime () returned 0x493b0 [0219.986] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0219.986] Sleep (dwMilliseconds=0xa) [0220.002] timeGetTime () returned 0x493bf [0220.002] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.002] Sleep (dwMilliseconds=0xa) [0220.017] timeGetTime () returned 0x493cf [0220.017] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.017] Sleep (dwMilliseconds=0xa) [0220.033] timeGetTime () returned 0x493df [0220.033] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.033] Sleep (dwMilliseconds=0xa) [0220.049] timeGetTime () returned 0x493ee [0220.049] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.049] Sleep (dwMilliseconds=0xa) [0220.063] timeGetTime () returned 0x493fe [0220.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.063] Sleep (dwMilliseconds=0xa) [0220.078] timeGetTime () returned 0x4940d [0220.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.078] Sleep (dwMilliseconds=0xa) [0220.094] timeGetTime () returned 0x4941d [0220.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.094] Sleep (dwMilliseconds=0xa) [0220.109] timeGetTime () returned 0x4942d [0220.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.109] Sleep (dwMilliseconds=0xa) [0220.125] timeGetTime () returned 0x4943c [0220.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.125] Sleep (dwMilliseconds=0xa) [0220.141] timeGetTime () returned 0x4944c [0220.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.141] Sleep (dwMilliseconds=0xa) [0220.156] timeGetTime () returned 0x4945c [0220.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.156] Sleep (dwMilliseconds=0xa) [0220.172] timeGetTime () returned 0x4946b [0220.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.172] Sleep (dwMilliseconds=0xa) [0220.188] timeGetTime () returned 0x4947b [0220.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.188] Sleep (dwMilliseconds=0xa) [0220.204] timeGetTime () returned 0x4948a [0220.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.204] Sleep (dwMilliseconds=0xa) [0220.219] timeGetTime () returned 0x4949a [0220.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.219] Sleep (dwMilliseconds=0xa) [0220.235] timeGetTime () returned 0x494aa [0220.235] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.235] Sleep (dwMilliseconds=0xa) [0220.252] timeGetTime () returned 0x494b9 [0220.252] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.252] Sleep (dwMilliseconds=0xa) [0220.267] timeGetTime () returned 0x494c9 [0220.267] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0220.267] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0220.267] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.267] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0220.267] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0220.267] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0220.267] RegCloseKey (hKey=0x240) returned 0x0 [0220.267] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0220.267] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0220.267] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0220.267] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0220.267] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0220.267] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0220.268] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0220.268] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0220.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0220.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0220.268] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0220.268] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0220.406] FreeLibrary (hLibModule=0x77150000) returned 1 [0220.406] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0220.406] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0220.406] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0220.406] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0220.407] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0220.407] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.407] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0220.407] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0220.407] timeGetTime () returned 0x49556 [0220.407] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.407] Sleep (dwMilliseconds=0xa) [0220.469] timeGetTime () returned 0x49594 [0220.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.469] Sleep (dwMilliseconds=0xa) [0220.516] timeGetTime () returned 0x495c3 [0220.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.516] Sleep (dwMilliseconds=0xa) [0220.563] timeGetTime () returned 0x495f2 [0220.563] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.563] Sleep (dwMilliseconds=0xa) [0220.612] timeGetTime () returned 0x49621 [0220.612] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.612] Sleep (dwMilliseconds=0xa) [0220.726] timeGetTime () returned 0x4968e [0220.726] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0220.727] TranslateMessage (lpMsg=0x8bf798) returned 0 [0220.727] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0220.727] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0220.727] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0220.727] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.727] Sleep (dwMilliseconds=0xa) [0220.750] timeGetTime () returned 0x496ad [0220.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.750] Sleep (dwMilliseconds=0xa) [0220.767] timeGetTime () returned 0x496bd [0220.767] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.767] Sleep (dwMilliseconds=0xa) [0220.783] timeGetTime () returned 0x496cd [0220.783] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.783] Sleep (dwMilliseconds=0xa) [0220.808] timeGetTime () returned 0x496dc [0220.808] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.808] Sleep (dwMilliseconds=0xa) [0220.830] timeGetTime () returned 0x496fb [0220.830] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.830] Sleep (dwMilliseconds=0xa) [0220.845] timeGetTime () returned 0x4970b [0220.845] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.845] Sleep (dwMilliseconds=0xa) [0220.861] timeGetTime () returned 0x4971b [0220.861] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.861] Sleep (dwMilliseconds=0xa) [0220.875] timeGetTime () returned 0x4972a [0220.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.875] Sleep (dwMilliseconds=0xa) [0220.891] timeGetTime () returned 0x4973a [0220.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.891] Sleep (dwMilliseconds=0xa) [0220.906] timeGetTime () returned 0x4974a [0220.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.906] Sleep (dwMilliseconds=0xa) [0220.923] timeGetTime () returned 0x49759 [0220.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.923] Sleep (dwMilliseconds=0xa) [0220.937] timeGetTime () returned 0x49769 [0220.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.937] Sleep (dwMilliseconds=0xa) [0220.953] timeGetTime () returned 0x49778 [0220.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.953] Sleep (dwMilliseconds=0xa) [0220.969] timeGetTime () returned 0x49788 [0220.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.969] Sleep (dwMilliseconds=0xa) [0220.988] timeGetTime () returned 0x49798 [0220.988] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0220.988] Sleep (dwMilliseconds=0xa) [0221.000] timeGetTime () returned 0x497a7 [0221.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.000] Sleep (dwMilliseconds=0xa) [0221.016] timeGetTime () returned 0x497b7 [0221.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.016] Sleep (dwMilliseconds=0xa) [0221.031] timeGetTime () returned 0x497c7 [0221.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.031] Sleep (dwMilliseconds=0xa) [0221.047] timeGetTime () returned 0x497d6 [0221.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.047] Sleep (dwMilliseconds=0xa) [0221.063] timeGetTime () returned 0x497e6 [0221.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.064] Sleep (dwMilliseconds=0xa) [0221.079] timeGetTime () returned 0x497f5 [0221.079] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.079] Sleep (dwMilliseconds=0xa) [0221.095] timeGetTime () returned 0x49805 [0221.095] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.095] Sleep (dwMilliseconds=0xa) [0221.110] timeGetTime () returned 0x49815 [0221.111] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.111] Sleep (dwMilliseconds=0xa) [0221.127] timeGetTime () returned 0x49824 [0221.127] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.127] Sleep (dwMilliseconds=0xa) [0221.142] timeGetTime () returned 0x49834 [0221.142] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.142] Sleep (dwMilliseconds=0xa) [0221.157] timeGetTime () returned 0x49844 [0221.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.157] Sleep (dwMilliseconds=0xa) [0221.172] timeGetTime () returned 0x49853 [0221.173] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.173] Sleep (dwMilliseconds=0xa) [0221.188] timeGetTime () returned 0x49863 [0221.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.188] Sleep (dwMilliseconds=0xa) [0221.204] timeGetTime () returned 0x49873 [0221.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.204] Sleep (dwMilliseconds=0xa) [0221.243] timeGetTime () returned 0x49892 [0221.243] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.243] Sleep (dwMilliseconds=0xa) [0221.267] timeGetTime () returned 0x498b1 [0221.267] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.267] Sleep (dwMilliseconds=0xa) [0221.282] timeGetTime () returned 0x498c1 [0221.282] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.282] Sleep (dwMilliseconds=0xa) [0221.297] timeGetTime () returned 0x498d0 [0221.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.297] Sleep (dwMilliseconds=0xa) [0221.312] timeGetTime () returned 0x498e0 [0221.313] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.313] Sleep (dwMilliseconds=0xa) [0221.331] timeGetTime () returned 0x498f0 [0221.331] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.331] Sleep (dwMilliseconds=0xa) [0221.346] timeGetTime () returned 0x498ff [0221.346] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.346] Sleep (dwMilliseconds=0xa) [0221.361] timeGetTime () returned 0x4990f [0221.361] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.361] Sleep (dwMilliseconds=0xa) [0221.376] timeGetTime () returned 0x4991e [0221.376] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.376] Sleep (dwMilliseconds=0xa) [0221.392] timeGetTime () returned 0x4992e [0221.392] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.392] Sleep (dwMilliseconds=0xa) [0221.408] timeGetTime () returned 0x4993e [0221.408] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0221.408] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0221.408] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.408] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0221.408] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0221.408] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0221.409] RegCloseKey (hKey=0x240) returned 0x0 [0221.409] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0221.409] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0221.409] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0221.409] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0221.409] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0221.409] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0221.409] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0221.409] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0221.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0221.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0221.409] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0221.410] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0221.563] FreeLibrary (hLibModule=0x77150000) returned 1 [0221.563] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0221.564] TranslateMessage (lpMsg=0x8bf708) returned 0 [0221.564] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0221.564] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0221.564] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0221.564] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0221.564] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0221.564] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0221.564] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0221.564] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0221.564] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.564] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0221.564] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0221.564] timeGetTime () returned 0x499da [0221.564] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.564] Sleep (dwMilliseconds=0xa) [0221.625] timeGetTime () returned 0x49a18 [0221.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.625] Sleep (dwMilliseconds=0xa) [0221.721] timeGetTime () returned 0x49a76 [0221.721] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.721] Sleep (dwMilliseconds=0xa) [0221.769] timeGetTime () returned 0x49aa5 [0221.769] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.769] Sleep (dwMilliseconds=0xa) [0221.816] timeGetTime () returned 0x49ad4 [0221.816] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.816] Sleep (dwMilliseconds=0xa) [0221.860] timeGetTime () returned 0x49b03 [0221.860] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.860] Sleep (dwMilliseconds=0xa) [0221.897] timeGetTime () returned 0x49b22 [0221.897] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.897] Sleep (dwMilliseconds=0xa) [0221.922] timeGetTime () returned 0x49b41 [0221.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.922] Sleep (dwMilliseconds=0xa) [0221.950] timeGetTime () returned 0x49b51 [0221.950] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.950] Sleep (dwMilliseconds=0xa) [0221.981] timeGetTime () returned 0x49b70 [0221.981] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0221.981] Sleep (dwMilliseconds=0xa) [0222.001] timeGetTime () returned 0x49b8f [0222.001] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.001] Sleep (dwMilliseconds=0xa) [0222.015] timeGetTime () returned 0x49b9f [0222.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.016] Sleep (dwMilliseconds=0xa) [0222.031] timeGetTime () returned 0x49baf [0222.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.031] Sleep (dwMilliseconds=0xa) [0222.047] timeGetTime () returned 0x49bbe [0222.048] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.048] Sleep (dwMilliseconds=0xa) [0222.064] timeGetTime () returned 0x49bce [0222.064] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.064] Sleep (dwMilliseconds=0xa) [0222.080] timeGetTime () returned 0x49bdd [0222.080] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.080] Sleep (dwMilliseconds=0xa) [0222.095] timeGetTime () returned 0x49bed [0222.096] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.096] Sleep (dwMilliseconds=0xa) [0222.109] timeGetTime () returned 0x49bfd [0222.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.109] Sleep (dwMilliseconds=0xa) [0222.125] timeGetTime () returned 0x49c0c [0222.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.125] Sleep (dwMilliseconds=0xa) [0222.141] timeGetTime () returned 0x49c1c [0222.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.141] Sleep (dwMilliseconds=0xa) [0222.158] timeGetTime () returned 0x49c2c [0222.158] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.158] Sleep (dwMilliseconds=0xa) [0222.172] timeGetTime () returned 0x49c3b [0222.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.172] Sleep (dwMilliseconds=0xa) [0222.188] timeGetTime () returned 0x49c4b [0222.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.188] Sleep (dwMilliseconds=0xa) [0222.204] timeGetTime () returned 0x49c5a [0222.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.204] Sleep (dwMilliseconds=0xa) [0222.218] timeGetTime () returned 0x49c6a [0222.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.219] Sleep (dwMilliseconds=0xa) [0222.258] timeGetTime () returned 0x49c89 [0222.258] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.258] Sleep (dwMilliseconds=0xa) [0222.281] timeGetTime () returned 0x49ca9 [0222.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.281] Sleep (dwMilliseconds=0xa) [0222.297] timeGetTime () returned 0x49cb8 [0222.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.297] Sleep (dwMilliseconds=0xa) [0222.313] timeGetTime () returned 0x49cc8 [0222.313] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.313] Sleep (dwMilliseconds=0xa) [0222.329] timeGetTime () returned 0x49cd7 [0222.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0222.329] TranslateMessage (lpMsg=0x8bf798) returned 0 [0222.329] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0222.329] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0222.329] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0222.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.329] Sleep (dwMilliseconds=0xa) [0222.345] timeGetTime () returned 0x49ce7 [0222.345] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.345] Sleep (dwMilliseconds=0xa) [0222.359] timeGetTime () returned 0x49cf7 [0222.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.359] Sleep (dwMilliseconds=0xa) [0222.378] timeGetTime () returned 0x49d06 [0222.378] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.378] Sleep (dwMilliseconds=0xa) [0222.393] timeGetTime () returned 0x49d16 [0222.393] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.393] Sleep (dwMilliseconds=0xa) [0222.407] timeGetTime () returned 0x49d26 [0222.407] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.407] Sleep (dwMilliseconds=0xa) [0222.422] timeGetTime () returned 0x49d35 [0222.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.422] Sleep (dwMilliseconds=0xa) [0222.438] timeGetTime () returned 0x49d45 [0222.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.438] Sleep (dwMilliseconds=0xa) [0222.454] timeGetTime () returned 0x49d54 [0222.454] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.454] Sleep (dwMilliseconds=0xa) [0222.470] timeGetTime () returned 0x49d64 [0222.470] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.470] Sleep (dwMilliseconds=0xa) [0222.485] timeGetTime () returned 0x49d74 [0222.485] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.485] Sleep (dwMilliseconds=0xa) [0222.501] timeGetTime () returned 0x49d83 [0222.501] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.501] Sleep (dwMilliseconds=0xa) [0222.516] timeGetTime () returned 0x49d93 [0222.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.517] Sleep (dwMilliseconds=0xa) [0222.546] timeGetTime () returned 0x49da3 [0222.546] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.546] Sleep (dwMilliseconds=0xa) [0222.579] timeGetTime () returned 0x49dd1 [0222.580] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0222.581] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0222.582] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.583] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0222.583] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0222.585] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0222.588] RegCloseKey (hKey=0x240) returned 0x0 [0222.589] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0222.589] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0222.590] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0222.590] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0222.590] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0222.590] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0222.590] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0222.590] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0222.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0222.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a998, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0222.590] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0222.590] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0222.676] FreeLibrary (hLibModule=0x77150000) returned 1 [0222.676] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0222.676] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0222.676] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0222.676] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0222.676] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0222.676] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.677] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0222.677] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0222.677] timeGetTime () returned 0x49e2f [0222.677] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.677] Sleep (dwMilliseconds=0xa) [0222.764] timeGetTime () returned 0x49e7d [0222.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.765] Sleep (dwMilliseconds=0xa) [0222.798] timeGetTime () returned 0x49eac [0222.798] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.798] Sleep (dwMilliseconds=0xa) [0222.844] timeGetTime () returned 0x49edb [0222.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.844] Sleep (dwMilliseconds=0xa) [0222.891] timeGetTime () returned 0x49f0a [0222.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.891] Sleep (dwMilliseconds=0xa) [0222.938] timeGetTime () returned 0x49f39 [0222.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.938] Sleep (dwMilliseconds=0xa) [0222.974] timeGetTime () returned 0x49f58 [0222.974] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0222.974] Sleep (dwMilliseconds=0xa) [0223.005] timeGetTime () returned 0x49f79 [0223.005] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.005] Sleep (dwMilliseconds=0xa) [0223.045] timeGetTime () returned 0x49f97 [0223.045] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.045] Sleep (dwMilliseconds=0xa) [0223.156] timeGetTime () returned 0x4a014 [0223.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0223.157] TranslateMessage (lpMsg=0x8bf798) returned 0 [0223.157] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0223.157] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0223.157] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0223.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.157] Sleep (dwMilliseconds=0xa) [0223.204] timeGetTime () returned 0x4a042 [0223.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.204] Sleep (dwMilliseconds=0xa) [0223.237] timeGetTime () returned 0x4a062 [0223.237] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.237] Sleep (dwMilliseconds=0xa) [0223.256] timeGetTime () returned 0x4a071 [0223.256] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.256] Sleep (dwMilliseconds=0xa) [0223.289] timeGetTime () returned 0x4a091 [0223.289] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.289] Sleep (dwMilliseconds=0xa) [0223.315] timeGetTime () returned 0x4a0b0 [0223.315] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.315] Sleep (dwMilliseconds=0xa) [0223.328] timeGetTime () returned 0x4a0bf [0223.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.328] Sleep (dwMilliseconds=0xa) [0223.344] timeGetTime () returned 0x4a0cf [0223.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.344] Sleep (dwMilliseconds=0xa) [0223.438] timeGetTime () returned 0x4a12d [0223.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.438] Sleep (dwMilliseconds=0xa) [0223.458] timeGetTime () returned 0x4a13c [0223.458] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.458] Sleep (dwMilliseconds=0xa) [0223.470] timeGetTime () returned 0x4a14c [0223.470] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.470] Sleep (dwMilliseconds=0xa) [0223.491] timeGetTime () returned 0x4a15c [0223.491] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.491] Sleep (dwMilliseconds=0xa) [0223.517] timeGetTime () returned 0x4a17b [0223.517] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.517] Sleep (dwMilliseconds=0xa) [0223.532] timeGetTime () returned 0x4a18b [0223.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.532] Sleep (dwMilliseconds=0xa) [0223.556] timeGetTime () returned 0x4a19a [0223.556] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.556] Sleep (dwMilliseconds=0xa) [0223.642] timeGetTime () returned 0x4a1f8 [0223.642] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.642] Sleep (dwMilliseconds=0xa) [0223.685] timeGetTime () returned 0x4a217 [0223.685] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0223.686] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0223.686] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.686] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0223.686] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0223.686] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0223.686] RegCloseKey (hKey=0x240) returned 0x0 [0223.686] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0223.686] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0223.686] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0223.686] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0223.686] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0223.686] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0223.686] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0223.686] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0223.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0223.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0223.687] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0223.687] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0223.828] FreeLibrary (hLibModule=0x77150000) returned 1 [0223.828] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0223.828] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0223.828] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0223.828] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0223.828] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0223.828] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.828] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0223.828] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0223.829] timeGetTime () returned 0x4a2b3 [0223.829] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.829] Sleep (dwMilliseconds=0xa) [0223.876] timeGetTime () returned 0x4a2e2 [0223.876] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.876] Sleep (dwMilliseconds=0xa) [0223.923] timeGetTime () returned 0x4a311 [0223.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0223.923] TranslateMessage (lpMsg=0x8bf798) returned 0 [0223.923] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0223.923] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0223.923] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0223.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.923] Sleep (dwMilliseconds=0xa) [0223.972] timeGetTime () returned 0x4a340 [0223.972] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0223.972] Sleep (dwMilliseconds=0xa) [0224.016] timeGetTime () returned 0x4a36f [0224.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.016] Sleep (dwMilliseconds=0xa) [0224.059] timeGetTime () returned 0x4a38e [0224.059] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.059] Sleep (dwMilliseconds=0xa) [0224.097] timeGetTime () returned 0x4a3bd [0224.097] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.097] Sleep (dwMilliseconds=0xa) [0224.121] timeGetTime () returned 0x4a3cd [0224.121] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.121] Sleep (dwMilliseconds=0xa) [0224.189] timeGetTime () returned 0x4a41b [0224.189] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.189] Sleep (dwMilliseconds=0xa) [0224.234] timeGetTime () returned 0x4a44a [0224.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.234] Sleep (dwMilliseconds=0xa) [0224.281] timeGetTime () returned 0x4a479 [0224.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.281] Sleep (dwMilliseconds=0xa) [0224.301] timeGetTime () returned 0x4a488 [0224.301] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.301] Sleep (dwMilliseconds=0xa) [0224.314] timeGetTime () returned 0x4a498 [0224.314] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.314] Sleep (dwMilliseconds=0xa) [0224.338] timeGetTime () returned 0x4a4a7 [0224.338] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.338] Sleep (dwMilliseconds=0xa) [0224.362] timeGetTime () returned 0x4a4c7 [0224.362] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.362] Sleep (dwMilliseconds=0xa) [0224.376] timeGetTime () returned 0x4a4d6 [0224.376] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.376] Sleep (dwMilliseconds=0xa) [0224.392] timeGetTime () returned 0x4a4f6 [0224.411] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.411] Sleep (dwMilliseconds=0xa) [0224.438] timeGetTime () returned 0x4a515 [0224.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.438] Sleep (dwMilliseconds=0xa) [0224.532] timeGetTime () returned 0x4a573 [0224.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.532] Sleep (dwMilliseconds=0xa) [0224.579] timeGetTime () returned 0x4a5a1 [0224.579] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.579] Sleep (dwMilliseconds=0xa) [0224.597] timeGetTime () returned 0x4a5b1 [0224.597] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.597] Sleep (dwMilliseconds=0xa) [0224.614] timeGetTime () returned 0x4a5c1 [0224.614] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.614] Sleep (dwMilliseconds=0xa) [0224.628] timeGetTime () returned 0x4a5d0 [0224.628] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.628] Sleep (dwMilliseconds=0xa) [0224.642] timeGetTime () returned 0x4a5e0 [0224.642] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.642] Sleep (dwMilliseconds=0xa) [0224.666] timeGetTime () returned 0x4a5f0 [0224.666] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.666] Sleep (dwMilliseconds=0xa) [0224.688] timeGetTime () returned 0x4a60f [0224.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0224.688] TranslateMessage (lpMsg=0x8bf798) returned 0 [0224.688] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0224.688] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0224.688] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0224.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.688] Sleep (dwMilliseconds=0xa) [0224.704] timeGetTime () returned 0x4a61e [0224.704] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.704] Sleep (dwMilliseconds=0xa) [0224.768] timeGetTime () returned 0x4a65d [0224.768] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.768] Sleep (dwMilliseconds=0xa) [0224.784] timeGetTime () returned 0x4a66d [0224.784] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.784] Sleep (dwMilliseconds=0xa) [0224.799] timeGetTime () returned 0x4a67c [0224.799] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.799] Sleep (dwMilliseconds=0xa) [0224.813] timeGetTime () returned 0x4a68c [0224.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0224.813] Sleep (dwMilliseconds=0xa) [0224.910] timeGetTime () returned 0x4a6ea [0224.910] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0224.910] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0224.910] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.910] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0224.910] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0224.910] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0224.910] RegCloseKey (hKey=0x240) returned 0x0 [0224.910] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0224.910] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0224.911] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0224.911] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0224.911] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0224.911] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0224.911] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0224.911] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0224.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0224.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0224.911] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0224.911] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0225.000] FreeLibrary (hLibModule=0x77150000) returned 1 [0225.001] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0225.001] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0225.001] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0225.001] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0225.001] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0225.001] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0225.001] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0225.001] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0225.001] timeGetTime () returned 0x4a747 [0225.001] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.001] Sleep (dwMilliseconds=0xa) [0225.156] timeGetTime () returned 0x4a7e4 [0225.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.156] Sleep (dwMilliseconds=0xa) [0225.220] timeGetTime () returned 0x4a822 [0225.220] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.220] Sleep (dwMilliseconds=0xa) [0225.270] timeGetTime () returned 0x4a851 [0225.270] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.270] Sleep (dwMilliseconds=0xa) [0225.313] timeGetTime () returned 0x4a880 [0225.313] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.313] Sleep (dwMilliseconds=0xa) [0225.360] timeGetTime () returned 0x4a8af [0225.360] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.360] Sleep (dwMilliseconds=0xa) [0225.386] timeGetTime () returned 0x4a8be [0225.386] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.386] Sleep (dwMilliseconds=0xa) [0225.415] timeGetTime () returned 0x4a8de [0225.415] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.415] Sleep (dwMilliseconds=0xa) [0225.447] timeGetTime () returned 0x4a8fd [0225.447] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0225.448] TranslateMessage (lpMsg=0x8bf798) returned 0 [0225.448] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0225.448] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0225.448] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0225.448] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.448] Sleep (dwMilliseconds=0xa) [0225.470] timeGetTime () returned 0x4a91c [0225.470] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.470] Sleep (dwMilliseconds=0xa) [0225.487] timeGetTime () returned 0x4a92c [0225.487] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.487] Sleep (dwMilliseconds=0xa) [0225.513] timeGetTime () returned 0x4a93b [0225.513] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.513] Sleep (dwMilliseconds=0xa) [0225.538] timeGetTime () returned 0x4a95b [0225.540] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.542] Sleep (dwMilliseconds=0xa) [0225.571] timeGetTime () returned 0x4a97a [0225.571] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.571] Sleep (dwMilliseconds=0xa) [0225.597] timeGetTime () returned 0x4a999 [0225.597] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.597] Sleep (dwMilliseconds=0xa) [0225.611] timeGetTime () returned 0x4a9a9 [0225.611] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.611] Sleep (dwMilliseconds=0xa) [0225.625] timeGetTime () returned 0x4a9b8 [0225.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.625] Sleep (dwMilliseconds=0xa) [0225.640] timeGetTime () returned 0x4a9c8 [0225.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.640] Sleep (dwMilliseconds=0xa) [0225.659] timeGetTime () returned 0x4a9d8 [0225.659] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.659] Sleep (dwMilliseconds=0xa) [0225.815] timeGetTime () returned 0x4aa74 [0225.815] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.815] Sleep (dwMilliseconds=0xa) [0225.855] timeGetTime () returned 0x4aa93 [0225.855] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.855] Sleep (dwMilliseconds=0xa) [0225.890] timeGetTime () returned 0x4aac2 [0225.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.890] Sleep (dwMilliseconds=0xa) [0225.908] timeGetTime () returned 0x4aad2 [0225.908] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.908] Sleep (dwMilliseconds=0xa) [0225.924] timeGetTime () returned 0x4aae1 [0225.924] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.924] Sleep (dwMilliseconds=0xa) [0225.947] timeGetTime () returned 0x4aaf1 [0225.947] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.947] Sleep (dwMilliseconds=0xa) [0225.969] timeGetTime () returned 0x4ab10 [0225.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.969] Sleep (dwMilliseconds=0xa) [0225.984] timeGetTime () returned 0x4ab20 [0225.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0225.984] Sleep (dwMilliseconds=0xa) [0226.000] timeGetTime () returned 0x4ab2f [0226.000] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0226.001] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0226.001] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0226.001] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0226.001] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0226.001] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0226.001] RegCloseKey (hKey=0x240) returned 0x0 [0226.001] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0226.001] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0226.001] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0226.001] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0226.001] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0226.001] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0226.001] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0226.001] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0226.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0226.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0226.002] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0226.002] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0226.094] FreeLibrary (hLibModule=0x77150000) returned 1 [0226.094] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0226.094] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0226.094] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0226.094] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0226.094] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0226.094] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0226.094] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0226.094] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0226.095] timeGetTime () returned 0x4ab8d [0226.095] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.095] Sleep (dwMilliseconds=0xa) [0226.141] timeGetTime () returned 0x4abbc [0226.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.141] Sleep (dwMilliseconds=0xa) [0226.188] timeGetTime () returned 0x4abeb [0226.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0226.188] TranslateMessage (lpMsg=0x8bf798) returned 0 [0226.188] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0226.188] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0226.188] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0226.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.188] Sleep (dwMilliseconds=0xa) [0226.235] timeGetTime () returned 0x4ac1a [0226.235] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.235] Sleep (dwMilliseconds=0xa) [0226.281] timeGetTime () returned 0x4ac49 [0226.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.281] Sleep (dwMilliseconds=0xa) [0226.376] timeGetTime () returned 0x4aca6 [0226.376] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.376] Sleep (dwMilliseconds=0xa) [0226.408] timeGetTime () returned 0x4acc6 [0226.408] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.408] Sleep (dwMilliseconds=0xa) [0226.424] timeGetTime () returned 0x4acd5 [0226.424] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.424] Sleep (dwMilliseconds=0xa) [0226.450] timeGetTime () returned 0x4ace5 [0226.450] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.450] Sleep (dwMilliseconds=0xa) [0226.481] timeGetTime () returned 0x4ad04 [0226.481] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.482] Sleep (dwMilliseconds=0xa) [0226.500] timeGetTime () returned 0x4ad23 [0226.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.500] Sleep (dwMilliseconds=0xa) [0226.518] timeGetTime () returned 0x4ad33 [0226.518] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.518] Sleep (dwMilliseconds=0xa) [0226.531] timeGetTime () returned 0x4ad43 [0226.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.531] Sleep (dwMilliseconds=0xa) [0226.665] timeGetTime () returned 0x4adc0 [0226.665] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.665] Sleep (dwMilliseconds=0xa) [0226.709] timeGetTime () returned 0x4adee [0226.709] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.709] Sleep (dwMilliseconds=0xa) [0226.736] timeGetTime () returned 0x4ae0e [0226.736] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.736] Sleep (dwMilliseconds=0xa) [0226.750] timeGetTime () returned 0x4ae1d [0226.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.750] Sleep (dwMilliseconds=0xa) [0226.859] timeGetTime () returned 0x4ae8b [0226.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.859] Sleep (dwMilliseconds=0xa) [0226.909] timeGetTime () returned 0x4aeba [0226.909] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.909] Sleep (dwMilliseconds=0xa) [0226.954] timeGetTime () returned 0x4aee8 [0226.954] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0226.954] TranslateMessage (lpMsg=0x8bf798) returned 0 [0226.954] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0226.954] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0226.954] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0226.954] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0226.954] Sleep (dwMilliseconds=0xa) [0227.000] timeGetTime () returned 0x4af17 [0227.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.000] Sleep (dwMilliseconds=0xa) [0227.079] timeGetTime () returned 0x4af65 [0227.079] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.079] Sleep (dwMilliseconds=0xa) [0227.125] timeGetTime () returned 0x4af94 [0227.126] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0227.126] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0227.126] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.126] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0227.126] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0227.126] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0227.126] RegCloseKey (hKey=0x240) returned 0x0 [0227.126] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0227.126] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0227.126] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0227.126] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0227.126] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0227.127] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0227.127] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0227.127] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0227.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0227.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0227.127] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0227.127] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0227.219] FreeLibrary (hLibModule=0x77150000) returned 1 [0227.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0227.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0227.219] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0227.219] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0227.219] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0227.219] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.219] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0227.220] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0227.220] timeGetTime () returned 0x4aff2 [0227.220] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.220] Sleep (dwMilliseconds=0xa) [0227.266] timeGetTime () returned 0x4b021 [0227.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.267] Sleep (dwMilliseconds=0xa) [0227.313] timeGetTime () returned 0x4b050 [0227.313] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.313] Sleep (dwMilliseconds=0xa) [0227.360] timeGetTime () returned 0x4b07f [0227.360] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.360] Sleep (dwMilliseconds=0xa) [0227.410] timeGetTime () returned 0x4b0ae [0227.410] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.410] Sleep (dwMilliseconds=0xa) [0227.454] timeGetTime () returned 0x4b0dc [0227.454] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.454] Sleep (dwMilliseconds=0xa) [0227.500] timeGetTime () returned 0x4b10b [0227.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.500] Sleep (dwMilliseconds=0xa) [0227.520] timeGetTime () returned 0x4b11b [0227.520] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.520] Sleep (dwMilliseconds=0xa) [0227.533] timeGetTime () returned 0x4b12b [0227.533] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.533] Sleep (dwMilliseconds=0xa) [0227.651] timeGetTime () returned 0x4b198 [0227.651] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.651] Sleep (dwMilliseconds=0xa) [0227.672] timeGetTime () returned 0x4b1b8 [0227.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.672] Sleep (dwMilliseconds=0xa) [0227.687] timeGetTime () returned 0x4b1c7 [0227.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.687] Sleep (dwMilliseconds=0xa) [0227.703] timeGetTime () returned 0x4b1d6 [0227.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0227.703] TranslateMessage (lpMsg=0x8bf798) returned 0 [0227.704] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0227.704] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0227.704] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0227.704] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.704] Sleep (dwMilliseconds=0xa) [0227.719] timeGetTime () returned 0x4b1e6 [0227.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.719] Sleep (dwMilliseconds=0xa) [0227.734] timeGetTime () returned 0x4b1f6 [0227.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.734] Sleep (dwMilliseconds=0xa) [0227.750] timeGetTime () returned 0x4b205 [0227.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.750] Sleep (dwMilliseconds=0xa) [0227.766] timeGetTime () returned 0x4b215 [0227.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.766] Sleep (dwMilliseconds=0xa) [0227.845] timeGetTime () returned 0x4b263 [0227.845] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.845] Sleep (dwMilliseconds=0xa) [0227.859] timeGetTime () returned 0x4b273 [0227.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.859] Sleep (dwMilliseconds=0xa) [0227.875] timeGetTime () returned 0x4b282 [0227.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.875] Sleep (dwMilliseconds=0xa) [0227.899] timeGetTime () returned 0x4b292 [0227.899] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.899] Sleep (dwMilliseconds=0xa) [0227.930] timeGetTime () returned 0x4b2b1 [0227.931] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.931] Sleep (dwMilliseconds=0xa) [0227.953] timeGetTime () returned 0x4b2d0 [0227.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.953] Sleep (dwMilliseconds=0xa) [0227.969] timeGetTime () returned 0x4b2e0 [0227.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.969] Sleep (dwMilliseconds=0xa) [0227.984] timeGetTime () returned 0x4b2f0 [0227.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0227.984] Sleep (dwMilliseconds=0xa) [0228.000] timeGetTime () returned 0x4b2ff [0228.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.000] Sleep (dwMilliseconds=0xa) [0228.016] timeGetTime () returned 0x4b30f [0228.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.016] Sleep (dwMilliseconds=0xa) [0228.031] timeGetTime () returned 0x4b31f [0228.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.031] Sleep (dwMilliseconds=0xa) [0228.056] timeGetTime () returned 0x4b32e [0228.056] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.056] Sleep (dwMilliseconds=0xa) [0228.092] timeGetTime () returned 0x4b34d [0228.092] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.092] Sleep (dwMilliseconds=0xa) [0228.110] timeGetTime () returned 0x4b36d [0228.110] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.110] Sleep (dwMilliseconds=0xa) [0228.125] timeGetTime () returned 0x4b37c [0228.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.125] Sleep (dwMilliseconds=0xa) [0228.140] timeGetTime () returned 0x4b38c [0228.140] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.141] Sleep (dwMilliseconds=0xa) [0228.156] timeGetTime () returned 0x4b39c [0228.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.156] Sleep (dwMilliseconds=0xa) [0228.172] timeGetTime () returned 0x4b3ab [0228.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.172] Sleep (dwMilliseconds=0xa) [0228.187] timeGetTime () returned 0x4b3bb [0228.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.187] Sleep (dwMilliseconds=0xa) [0228.203] timeGetTime () returned 0x4b3ca [0228.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.203] Sleep (dwMilliseconds=0xa) [0228.219] timeGetTime () returned 0x4b3da [0228.219] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0228.219] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0228.219] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.220] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0228.220] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0228.220] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0228.220] RegCloseKey (hKey=0x240) returned 0x0 [0228.220] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0228.220] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0228.220] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0228.220] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0228.220] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0228.220] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0228.220] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0228.220] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0228.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0228.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0228.221] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0228.221] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0228.313] FreeLibrary (hLibModule=0x77150000) returned 1 [0228.313] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0228.314] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0228.314] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0228.314] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0228.314] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0228.314] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.314] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0228.314] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0228.314] timeGetTime () returned 0x4b438 [0228.314] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.314] Sleep (dwMilliseconds=0xa) [0228.359] timeGetTime () returned 0x4b467 [0228.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.359] Sleep (dwMilliseconds=0xa) [0228.406] timeGetTime () returned 0x4b496 [0228.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.406] Sleep (dwMilliseconds=0xa) [0228.453] timeGetTime () returned 0x4b4c4 [0228.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0228.453] TranslateMessage (lpMsg=0x8bf798) returned 0 [0228.453] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0228.453] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0228.453] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0228.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.453] Sleep (dwMilliseconds=0xa) [0228.500] timeGetTime () returned 0x4b4f3 [0228.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.500] Sleep (dwMilliseconds=0xa) [0228.541] timeGetTime () returned 0x4b513 [0228.541] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.541] Sleep (dwMilliseconds=0xa) [0228.562] timeGetTime () returned 0x4b532 [0228.562] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.562] Sleep (dwMilliseconds=0xa) [0228.587] timeGetTime () returned 0x4b541 [0228.587] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.587] Sleep (dwMilliseconds=0xa) [0228.609] timeGetTime () returned 0x4b561 [0228.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.609] Sleep (dwMilliseconds=0xa) [0228.625] timeGetTime () returned 0x4b570 [0228.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.625] Sleep (dwMilliseconds=0xa) [0228.640] timeGetTime () returned 0x4b580 [0228.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.640] Sleep (dwMilliseconds=0xa) [0228.656] timeGetTime () returned 0x4b590 [0228.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.656] Sleep (dwMilliseconds=0xa) [0228.672] timeGetTime () returned 0x4b59f [0228.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.672] Sleep (dwMilliseconds=0xa) [0228.688] timeGetTime () returned 0x4b5af [0228.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.688] Sleep (dwMilliseconds=0xa) [0228.777] timeGetTime () returned 0x4b5fd [0228.777] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.777] Sleep (dwMilliseconds=0xa) [0228.815] timeGetTime () returned 0x4b62c [0228.815] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.815] Sleep (dwMilliseconds=0xa) [0228.828] timeGetTime () returned 0x4b63b [0228.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.828] Sleep (dwMilliseconds=0xa) [0228.844] timeGetTime () returned 0x4b64b [0228.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.844] Sleep (dwMilliseconds=0xa) [0228.859] timeGetTime () returned 0x4b65b [0228.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.859] Sleep (dwMilliseconds=0xa) [0228.875] timeGetTime () returned 0x4b66a [0228.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.875] Sleep (dwMilliseconds=0xa) [0228.891] timeGetTime () returned 0x4b67a [0228.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.891] Sleep (dwMilliseconds=0xa) [0228.907] timeGetTime () returned 0x4b68a [0228.907] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.907] Sleep (dwMilliseconds=0xa) [0228.922] timeGetTime () returned 0x4b699 [0228.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.922] Sleep (dwMilliseconds=0xa) [0228.937] timeGetTime () returned 0x4b6a9 [0228.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.937] Sleep (dwMilliseconds=0xa) [0228.953] timeGetTime () returned 0x4b6b8 [0228.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.953] Sleep (dwMilliseconds=0xa) [0228.968] timeGetTime () returned 0x4b6c8 [0228.968] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.969] Sleep (dwMilliseconds=0xa) [0228.984] timeGetTime () returned 0x4b6d8 [0228.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0228.984] Sleep (dwMilliseconds=0xa) [0229.000] timeGetTime () returned 0x4b6e7 [0229.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.000] Sleep (dwMilliseconds=0xa) [0229.016] timeGetTime () returned 0x4b6f7 [0229.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.016] Sleep (dwMilliseconds=0xa) [0229.031] timeGetTime () returned 0x4b707 [0229.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.031] Sleep (dwMilliseconds=0xa) [0229.047] timeGetTime () returned 0x4b716 [0229.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.047] Sleep (dwMilliseconds=0xa) [0229.062] timeGetTime () returned 0x4b726 [0229.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.063] Sleep (dwMilliseconds=0xa) [0229.078] timeGetTime () returned 0x4b735 [0229.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.078] Sleep (dwMilliseconds=0xa) [0229.094] timeGetTime () returned 0x4b745 [0229.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.094] Sleep (dwMilliseconds=0xa) [0229.111] timeGetTime () returned 0x4b756 [0229.111] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.111] Sleep (dwMilliseconds=0xa) [0229.125] timeGetTime () returned 0x4b764 [0229.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.125] Sleep (dwMilliseconds=0xa) [0229.141] timeGetTime () returned 0x4b774 [0229.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.141] Sleep (dwMilliseconds=0xa) [0229.156] timeGetTime () returned 0x4b784 [0229.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.156] Sleep (dwMilliseconds=0xa) [0229.172] timeGetTime () returned 0x4b793 [0229.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.172] Sleep (dwMilliseconds=0xa) [0229.187] timeGetTime () returned 0x4b7a3 [0229.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.187] Sleep (dwMilliseconds=0xa) [0229.204] timeGetTime () returned 0x4b7b2 [0229.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0229.204] TranslateMessage (lpMsg=0x8bf798) returned 0 [0229.204] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0229.204] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0229.204] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0229.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.204] Sleep (dwMilliseconds=0xa) [0229.219] timeGetTime () returned 0x4b7c2 [0229.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.219] Sleep (dwMilliseconds=0xa) [0229.237] timeGetTime () returned 0x4b7d2 [0229.237] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.238] Sleep (dwMilliseconds=0xa) [0229.250] timeGetTime () returned 0x4b7e1 [0229.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.250] Sleep (dwMilliseconds=0xa) [0229.265] timeGetTime () returned 0x4b7f1 [0229.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.266] Sleep (dwMilliseconds=0xa) [0229.281] timeGetTime () returned 0x4b801 [0229.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.281] Sleep (dwMilliseconds=0xa) [0229.297] timeGetTime () returned 0x4b810 [0229.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.297] Sleep (dwMilliseconds=0xa) [0229.312] timeGetTime () returned 0x4b820 [0229.312] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0229.313] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0229.313] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.313] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0229.313] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0229.313] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0229.313] RegCloseKey (hKey=0x240) returned 0x0 [0229.313] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0229.313] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0229.313] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0229.313] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0229.313] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0229.313] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0229.313] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0229.313] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0229.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0229.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa98, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0229.314] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0229.314] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0229.422] FreeLibrary (hLibModule=0x77150000) returned 1 [0229.422] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0229.422] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0229.422] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0229.422] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0229.422] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0229.422] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.422] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0229.423] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0229.423] timeGetTime () returned 0x4b88d [0229.423] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.423] Sleep (dwMilliseconds=0xa) [0229.470] timeGetTime () returned 0x4b8bc [0229.470] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.470] Sleep (dwMilliseconds=0xa) [0229.515] timeGetTime () returned 0x4b8eb [0229.515] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.516] Sleep (dwMilliseconds=0xa) [0229.562] timeGetTime () returned 0x4b91a [0229.562] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.562] Sleep (dwMilliseconds=0xa) [0229.609] timeGetTime () returned 0x4b949 [0229.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.609] Sleep (dwMilliseconds=0xa) [0229.656] timeGetTime () returned 0x4b978 [0229.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.656] Sleep (dwMilliseconds=0xa) [0229.672] timeGetTime () returned 0x4b987 [0229.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.672] Sleep (dwMilliseconds=0xa) [0229.688] timeGetTime () returned 0x4b997 [0229.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.688] Sleep (dwMilliseconds=0xa) [0229.713] timeGetTime () returned 0x4b9a7 [0229.713] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.713] Sleep (dwMilliseconds=0xa) [0229.744] timeGetTime () returned 0x4b9c6 [0229.744] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.744] Sleep (dwMilliseconds=0xa) [0229.766] timeGetTime () returned 0x4b9e5 [0229.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.766] Sleep (dwMilliseconds=0xa) [0229.781] timeGetTime () returned 0x4b9f5 [0229.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.781] Sleep (dwMilliseconds=0xa) [0229.836] timeGetTime () returned 0x4ba23 [0229.836] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.836] Sleep (dwMilliseconds=0xa) [0229.859] timeGetTime () returned 0x4ba43 [0229.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.859] Sleep (dwMilliseconds=0xa) [0229.875] timeGetTime () returned 0x4ba52 [0229.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.875] Sleep (dwMilliseconds=0xa) [0229.891] timeGetTime () returned 0x4ba62 [0229.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.891] Sleep (dwMilliseconds=0xa) [0229.908] timeGetTime () returned 0x4ba72 [0229.908] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.908] Sleep (dwMilliseconds=0xa) [0229.922] timeGetTime () returned 0x4ba81 [0229.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.922] Sleep (dwMilliseconds=0xa) [0229.937] timeGetTime () returned 0x4ba91 [0229.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.937] Sleep (dwMilliseconds=0xa) [0229.953] timeGetTime () returned 0x4baa1 [0229.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0229.953] TranslateMessage (lpMsg=0x8bf798) returned 0 [0229.953] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0229.953] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0229.953] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0229.954] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.954] Sleep (dwMilliseconds=0xa) [0229.969] timeGetTime () returned 0x4bab0 [0229.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.969] Sleep (dwMilliseconds=0xa) [0229.984] timeGetTime () returned 0x4bac0 [0229.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0229.984] Sleep (dwMilliseconds=0xa) [0230.000] timeGetTime () returned 0x4bacf [0230.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.000] Sleep (dwMilliseconds=0xa) [0230.016] timeGetTime () returned 0x4badf [0230.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.016] Sleep (dwMilliseconds=0xa) [0230.031] timeGetTime () returned 0x4baef [0230.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.031] Sleep (dwMilliseconds=0xa) [0230.047] timeGetTime () returned 0x4bafe [0230.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.047] Sleep (dwMilliseconds=0xa) [0230.062] timeGetTime () returned 0x4bb0e [0230.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.062] Sleep (dwMilliseconds=0xa) [0230.078] timeGetTime () returned 0x4bb1d [0230.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.078] Sleep (dwMilliseconds=0xa) [0230.094] timeGetTime () returned 0x4bb2d [0230.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.094] Sleep (dwMilliseconds=0xa) [0230.109] timeGetTime () returned 0x4bb3d [0230.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.109] Sleep (dwMilliseconds=0xa) [0230.125] timeGetTime () returned 0x4bb4c [0230.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.125] Sleep (dwMilliseconds=0xa) [0230.140] timeGetTime () returned 0x4bb5c [0230.140] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.140] Sleep (dwMilliseconds=0xa) [0230.156] timeGetTime () returned 0x4bb6c [0230.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.156] Sleep (dwMilliseconds=0xa) [0230.172] timeGetTime () returned 0x4bb7b [0230.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.172] Sleep (dwMilliseconds=0xa) [0230.187] timeGetTime () returned 0x4bb8b [0230.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.187] Sleep (dwMilliseconds=0xa) [0230.203] timeGetTime () returned 0x4bb9a [0230.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.203] Sleep (dwMilliseconds=0xa) [0230.219] timeGetTime () returned 0x4bbaa [0230.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.219] Sleep (dwMilliseconds=0xa) [0230.235] timeGetTime () returned 0x4bbba [0230.235] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.235] Sleep (dwMilliseconds=0xa) [0230.250] timeGetTime () returned 0x4bbc9 [0230.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.250] Sleep (dwMilliseconds=0xa) [0230.266] timeGetTime () returned 0x4bbd9 [0230.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.266] Sleep (dwMilliseconds=0xa) [0230.281] timeGetTime () returned 0x4bbe9 [0230.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.281] Sleep (dwMilliseconds=0xa) [0230.297] timeGetTime () returned 0x4bbf8 [0230.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.297] Sleep (dwMilliseconds=0xa) [0230.313] timeGetTime () returned 0x4bc08 [0230.313] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.313] Sleep (dwMilliseconds=0xa) [0230.328] timeGetTime () returned 0x4bc17 [0230.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.328] Sleep (dwMilliseconds=0xa) [0230.344] timeGetTime () returned 0x4bc27 [0230.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.344] Sleep (dwMilliseconds=0xa) [0230.359] timeGetTime () returned 0x4bc37 [0230.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.359] Sleep (dwMilliseconds=0xa) [0230.375] timeGetTime () returned 0x4bc46 [0230.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.375] Sleep (dwMilliseconds=0xa) [0230.390] timeGetTime () returned 0x4bc56 [0230.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.390] Sleep (dwMilliseconds=0xa) [0230.406] timeGetTime () returned 0x4bc66 [0230.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.406] Sleep (dwMilliseconds=0xa) [0230.422] timeGetTime () returned 0x4bc75 [0230.422] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0230.422] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0230.422] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.422] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0230.422] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0230.422] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0230.422] RegCloseKey (hKey=0x240) returned 0x0 [0230.422] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0230.422] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0230.422] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0230.422] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0230.423] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0230.423] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0230.423] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0230.423] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0230.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0230.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0230.423] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0230.423] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0230.516] FreeLibrary (hLibModule=0x77150000) returned 1 [0230.516] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0230.516] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0230.516] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0230.516] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0230.516] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0230.516] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.516] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0230.516] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0230.516] timeGetTime () returned 0x4bcd3 [0230.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.517] Sleep (dwMilliseconds=0xa) [0230.562] timeGetTime () returned 0x4bd02 [0230.562] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.562] Sleep (dwMilliseconds=0xa) [0230.609] timeGetTime () returned 0x4bd31 [0230.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.609] Sleep (dwMilliseconds=0xa) [0230.660] timeGetTime () returned 0x4bd60 [0230.660] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.660] Sleep (dwMilliseconds=0xa) [0230.703] timeGetTime () returned 0x4bd8e [0230.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0230.703] TranslateMessage (lpMsg=0x8bf798) returned 0 [0230.703] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0230.703] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0230.703] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0230.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.703] Sleep (dwMilliseconds=0xa) [0230.745] timeGetTime () returned 0x4bdae [0230.745] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.745] Sleep (dwMilliseconds=0xa) [0230.766] timeGetTime () returned 0x4bdcd [0230.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.766] Sleep (dwMilliseconds=0xa) [0230.791] timeGetTime () returned 0x4bddd [0230.791] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.791] Sleep (dwMilliseconds=0xa) [0230.847] timeGetTime () returned 0x4be1b [0230.847] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.847] Sleep (dwMilliseconds=0xa) [0230.859] timeGetTime () returned 0x4be2b [0230.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.859] Sleep (dwMilliseconds=0xa) [0230.875] timeGetTime () returned 0x4be3a [0230.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.875] Sleep (dwMilliseconds=0xa) [0230.890] timeGetTime () returned 0x4be4a [0230.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.890] Sleep (dwMilliseconds=0xa) [0230.907] timeGetTime () returned 0x4be5a [0230.907] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.907] Sleep (dwMilliseconds=0xa) [0230.922] timeGetTime () returned 0x4be69 [0230.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.922] Sleep (dwMilliseconds=0xa) [0230.937] timeGetTime () returned 0x4be79 [0230.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.937] Sleep (dwMilliseconds=0xa) [0230.953] timeGetTime () returned 0x4be88 [0230.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.953] Sleep (dwMilliseconds=0xa) [0230.969] timeGetTime () returned 0x4be98 [0230.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.969] Sleep (dwMilliseconds=0xa) [0230.984] timeGetTime () returned 0x4bea8 [0230.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0230.984] Sleep (dwMilliseconds=0xa) [0231.000] timeGetTime () returned 0x4beb7 [0231.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.000] Sleep (dwMilliseconds=0xa) [0231.015] timeGetTime () returned 0x4bec7 [0231.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.015] Sleep (dwMilliseconds=0xa) [0231.032] timeGetTime () returned 0x4bed7 [0231.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.032] Sleep (dwMilliseconds=0xa) [0231.047] timeGetTime () returned 0x4bee6 [0231.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.047] Sleep (dwMilliseconds=0xa) [0231.062] timeGetTime () returned 0x4bef6 [0231.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.062] Sleep (dwMilliseconds=0xa) [0231.078] timeGetTime () returned 0x4bf05 [0231.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.078] Sleep (dwMilliseconds=0xa) [0231.094] timeGetTime () returned 0x4bf15 [0231.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.094] Sleep (dwMilliseconds=0xa) [0231.109] timeGetTime () returned 0x4bf25 [0231.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.109] Sleep (dwMilliseconds=0xa) [0231.125] timeGetTime () returned 0x4bf34 [0231.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.125] Sleep (dwMilliseconds=0xa) [0231.141] timeGetTime () returned 0x4bf44 [0231.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.141] Sleep (dwMilliseconds=0xa) [0231.156] timeGetTime () returned 0x4bf54 [0231.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.156] Sleep (dwMilliseconds=0xa) [0231.172] timeGetTime () returned 0x4bf63 [0231.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.172] Sleep (dwMilliseconds=0xa) [0231.187] timeGetTime () returned 0x4bf73 [0231.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.187] Sleep (dwMilliseconds=0xa) [0231.203] timeGetTime () returned 0x4bf82 [0231.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.203] Sleep (dwMilliseconds=0xa) [0231.219] timeGetTime () returned 0x4bf92 [0231.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.219] Sleep (dwMilliseconds=0xa) [0231.234] timeGetTime () returned 0x4bfa2 [0231.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.234] Sleep (dwMilliseconds=0xa) [0231.250] timeGetTime () returned 0x4bfb1 [0231.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.250] Sleep (dwMilliseconds=0xa) [0231.265] timeGetTime () returned 0x4bfc1 [0231.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.265] Sleep (dwMilliseconds=0xa) [0231.281] timeGetTime () returned 0x4bfd1 [0231.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.281] Sleep (dwMilliseconds=0xa) [0231.297] timeGetTime () returned 0x4bfe0 [0231.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.297] Sleep (dwMilliseconds=0xa) [0231.312] timeGetTime () returned 0x4bff0 [0231.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.312] Sleep (dwMilliseconds=0xa) [0231.328] timeGetTime () returned 0x4bfff [0231.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.328] Sleep (dwMilliseconds=0xa) [0231.344] timeGetTime () returned 0x4c00f [0231.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.344] Sleep (dwMilliseconds=0xa) [0231.359] timeGetTime () returned 0x4c01f [0231.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.359] Sleep (dwMilliseconds=0xa) [0231.376] timeGetTime () returned 0x4c030 [0231.376] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.376] Sleep (dwMilliseconds=0xa) [0231.390] timeGetTime () returned 0x4c03e [0231.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.390] Sleep (dwMilliseconds=0xa) [0231.406] timeGetTime () returned 0x4c04e [0231.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.406] Sleep (dwMilliseconds=0xa) [0231.422] timeGetTime () returned 0x4c05d [0231.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.422] Sleep (dwMilliseconds=0xa) [0231.437] timeGetTime () returned 0x4c06d [0231.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.437] Sleep (dwMilliseconds=0xa) [0231.453] timeGetTime () returned 0x4c07c [0231.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0231.453] TranslateMessage (lpMsg=0x8bf798) returned 0 [0231.453] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0231.453] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0231.453] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0231.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.453] Sleep (dwMilliseconds=0xa) [0231.469] timeGetTime () returned 0x4c08c [0231.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.469] Sleep (dwMilliseconds=0xa) [0231.484] timeGetTime () returned 0x4c09c [0231.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.484] Sleep (dwMilliseconds=0xa) [0231.501] timeGetTime () returned 0x4c0ab [0231.501] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.501] Sleep (dwMilliseconds=0xa) [0231.516] timeGetTime () returned 0x4c0bb [0231.516] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0231.516] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0231.516] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.516] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0231.516] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0231.516] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0231.516] RegCloseKey (hKey=0x240) returned 0x0 [0231.516] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0231.516] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0231.516] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0231.516] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0231.516] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0231.516] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0231.517] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0231.517] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0231.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0231.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0231.517] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0231.517] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0231.625] FreeLibrary (hLibModule=0x77150000) returned 1 [0231.625] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0231.625] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0231.625] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0231.625] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0231.625] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0231.625] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.625] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0231.625] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0231.625] timeGetTime () returned 0x4c128 [0231.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.626] Sleep (dwMilliseconds=0xa) [0231.672] timeGetTime () returned 0x4c157 [0231.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.672] Sleep (dwMilliseconds=0xa) [0231.718] timeGetTime () returned 0x4c186 [0231.718] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.718] Sleep (dwMilliseconds=0xa) [0231.765] timeGetTime () returned 0x4c1b5 [0231.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.765] Sleep (dwMilliseconds=0xa) [0231.849] timeGetTime () returned 0x4c203 [0231.849] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.849] Sleep (dwMilliseconds=0xa) [0231.875] timeGetTime () returned 0x4c222 [0231.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.875] Sleep (dwMilliseconds=0xa) [0231.891] timeGetTime () returned 0x4c232 [0231.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.891] Sleep (dwMilliseconds=0xa) [0231.920] timeGetTime () returned 0x4c242 [0231.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.920] Sleep (dwMilliseconds=0xa) [0231.948] timeGetTime () returned 0x4c261 [0231.948] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.948] Sleep (dwMilliseconds=0xa) [0231.969] timeGetTime () returned 0x4c280 [0231.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.969] Sleep (dwMilliseconds=0xa) [0231.984] timeGetTime () returned 0x4c290 [0231.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0231.985] Sleep (dwMilliseconds=0xa) [0232.000] timeGetTime () returned 0x4c29f [0232.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.000] Sleep (dwMilliseconds=0xa) [0232.016] timeGetTime () returned 0x4c2af [0232.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.016] Sleep (dwMilliseconds=0xa) [0232.031] timeGetTime () returned 0x4c2bf [0232.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.031] Sleep (dwMilliseconds=0xa) [0232.047] timeGetTime () returned 0x4c2ce [0232.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.047] Sleep (dwMilliseconds=0xa) [0232.062] timeGetTime () returned 0x4c2de [0232.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.062] Sleep (dwMilliseconds=0xa) [0232.078] timeGetTime () returned 0x4c2ed [0232.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.078] Sleep (dwMilliseconds=0xa) [0232.094] timeGetTime () returned 0x4c2fd [0232.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.094] Sleep (dwMilliseconds=0xa) [0232.109] timeGetTime () returned 0x4c30d [0232.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.109] Sleep (dwMilliseconds=0xa) [0232.125] timeGetTime () returned 0x4c31c [0232.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.125] Sleep (dwMilliseconds=0xa) [0232.140] timeGetTime () returned 0x4c32c [0232.140] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.140] Sleep (dwMilliseconds=0xa) [0232.157] timeGetTime () returned 0x4c33c [0232.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.157] Sleep (dwMilliseconds=0xa) [0232.172] timeGetTime () returned 0x4c34b [0232.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.172] Sleep (dwMilliseconds=0xa) [0232.187] timeGetTime () returned 0x4c35b [0232.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.187] Sleep (dwMilliseconds=0xa) [0232.203] timeGetTime () returned 0x4c36a [0232.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0232.203] TranslateMessage (lpMsg=0x8bf798) returned 0 [0232.203] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0232.203] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0232.203] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0232.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.203] Sleep (dwMilliseconds=0xa) [0232.219] timeGetTime () returned 0x4c37a [0232.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.219] Sleep (dwMilliseconds=0xa) [0232.234] timeGetTime () returned 0x4c38a [0232.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.234] Sleep (dwMilliseconds=0xa) [0232.250] timeGetTime () returned 0x4c399 [0232.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.250] Sleep (dwMilliseconds=0xa) [0232.265] timeGetTime () returned 0x4c3a9 [0232.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.265] Sleep (dwMilliseconds=0xa) [0232.281] timeGetTime () returned 0x4c3b9 [0232.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.281] Sleep (dwMilliseconds=0xa) [0232.297] timeGetTime () returned 0x4c3c8 [0232.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.297] Sleep (dwMilliseconds=0xa) [0232.312] timeGetTime () returned 0x4c3d8 [0232.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.312] Sleep (dwMilliseconds=0xa) [0232.328] timeGetTime () returned 0x4c3e8 [0232.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.328] Sleep (dwMilliseconds=0xa) [0232.343] timeGetTime () returned 0x4c3f7 [0232.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.344] Sleep (dwMilliseconds=0xa) [0232.359] timeGetTime () returned 0x4c407 [0232.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.359] Sleep (dwMilliseconds=0xa) [0232.375] timeGetTime () returned 0x4c416 [0232.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.375] Sleep (dwMilliseconds=0xa) [0232.390] timeGetTime () returned 0x4c426 [0232.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.390] Sleep (dwMilliseconds=0xa) [0232.406] timeGetTime () returned 0x4c436 [0232.407] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.407] Sleep (dwMilliseconds=0xa) [0232.421] timeGetTime () returned 0x4c445 [0232.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.422] Sleep (dwMilliseconds=0xa) [0232.437] timeGetTime () returned 0x4c455 [0232.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.437] Sleep (dwMilliseconds=0xa) [0232.453] timeGetTime () returned 0x4c464 [0232.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.453] Sleep (dwMilliseconds=0xa) [0232.469] timeGetTime () returned 0x4c474 [0232.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.469] Sleep (dwMilliseconds=0xa) [0232.484] timeGetTime () returned 0x4c484 [0232.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.484] Sleep (dwMilliseconds=0xa) [0232.502] timeGetTime () returned 0x4c496 [0232.502] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.502] Sleep (dwMilliseconds=0xa) [0232.516] timeGetTime () returned 0x4c4a3 [0232.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.516] Sleep (dwMilliseconds=0xa) [0232.532] timeGetTime () returned 0x4c4b3 [0232.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.532] Sleep (dwMilliseconds=0xa) [0232.547] timeGetTime () returned 0x4c4c2 [0232.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.547] Sleep (dwMilliseconds=0xa) [0232.562] timeGetTime () returned 0x4c4d2 [0232.562] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.562] Sleep (dwMilliseconds=0xa) [0232.578] timeGetTime () returned 0x4c4e2 [0232.578] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.578] Sleep (dwMilliseconds=0xa) [0232.594] timeGetTime () returned 0x4c4f1 [0232.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.594] Sleep (dwMilliseconds=0xa) [0232.609] timeGetTime () returned 0x4c501 [0232.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.609] Sleep (dwMilliseconds=0xa) [0232.625] timeGetTime () returned 0x4c510 [0232.625] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0232.625] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0232.625] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.625] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0232.625] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0232.625] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0232.626] RegCloseKey (hKey=0x240) returned 0x0 [0232.626] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0232.626] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0232.626] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0232.626] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0232.626] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0232.626] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0232.626] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0232.626] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0232.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0232.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0232.626] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0232.626] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0232.719] FreeLibrary (hLibModule=0x77150000) returned 1 [0232.719] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0232.719] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0232.719] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0232.719] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0232.719] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0232.719] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.719] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0232.719] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0232.719] timeGetTime () returned 0x4c56e [0232.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.719] Sleep (dwMilliseconds=0xa) [0232.765] timeGetTime () returned 0x4c59d [0232.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.766] Sleep (dwMilliseconds=0xa) [0232.813] timeGetTime () returned 0x4c5cc [0232.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.813] Sleep (dwMilliseconds=0xa) [0232.890] timeGetTime () returned 0x4c61a [0232.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.890] Sleep (dwMilliseconds=0xa) [0232.937] timeGetTime () returned 0x4c649 [0232.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.937] Sleep (dwMilliseconds=0xa) [0232.970] timeGetTime () returned 0x4c668 [0232.970] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0232.970] TranslateMessage (lpMsg=0x8bf798) returned 0 [0232.970] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0232.970] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0232.970] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0232.970] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.970] Sleep (dwMilliseconds=0xa) [0232.994] timeGetTime () returned 0x4c678 [0232.994] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0232.994] Sleep (dwMilliseconds=0xa) [0233.025] timeGetTime () returned 0x4c697 [0233.025] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.025] Sleep (dwMilliseconds=0xa) [0233.047] timeGetTime () returned 0x4c6b6 [0233.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.047] Sleep (dwMilliseconds=0xa) [0233.064] timeGetTime () returned 0x4c6c6 [0233.064] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.064] Sleep (dwMilliseconds=0xa) [0233.078] timeGetTime () returned 0x4c6d5 [0233.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.078] Sleep (dwMilliseconds=0xa) [0233.094] timeGetTime () returned 0x4c6e5 [0233.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.094] Sleep (dwMilliseconds=0xa) [0233.109] timeGetTime () returned 0x4c6f5 [0233.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.109] Sleep (dwMilliseconds=0xa) [0233.125] timeGetTime () returned 0x4c704 [0233.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.125] Sleep (dwMilliseconds=0xa) [0233.140] timeGetTime () returned 0x4c714 [0233.140] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.140] Sleep (dwMilliseconds=0xa) [0233.156] timeGetTime () returned 0x4c724 [0233.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.156] Sleep (dwMilliseconds=0xa) [0233.172] timeGetTime () returned 0x4c733 [0233.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.172] Sleep (dwMilliseconds=0xa) [0233.188] timeGetTime () returned 0x4c743 [0233.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.188] Sleep (dwMilliseconds=0xa) [0233.203] timeGetTime () returned 0x4c753 [0233.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.203] Sleep (dwMilliseconds=0xa) [0233.219] timeGetTime () returned 0x4c762 [0233.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.219] Sleep (dwMilliseconds=0xa) [0233.234] timeGetTime () returned 0x4c772 [0233.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.234] Sleep (dwMilliseconds=0xa) [0233.250] timeGetTime () returned 0x4c781 [0233.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.250] Sleep (dwMilliseconds=0xa) [0233.265] timeGetTime () returned 0x4c791 [0233.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.265] Sleep (dwMilliseconds=0xa) [0233.281] timeGetTime () returned 0x4c7a1 [0233.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.281] Sleep (dwMilliseconds=0xa) [0233.297] timeGetTime () returned 0x4c7b0 [0233.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.297] Sleep (dwMilliseconds=0xa) [0233.312] timeGetTime () returned 0x4c7c0 [0233.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.312] Sleep (dwMilliseconds=0xa) [0233.328] timeGetTime () returned 0x4c7cf [0233.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.328] Sleep (dwMilliseconds=0xa) [0233.344] timeGetTime () returned 0x4c7df [0233.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.344] Sleep (dwMilliseconds=0xa) [0233.359] timeGetTime () returned 0x4c7ef [0233.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.359] Sleep (dwMilliseconds=0xa) [0233.375] timeGetTime () returned 0x4c7fe [0233.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.375] Sleep (dwMilliseconds=0xa) [0233.390] timeGetTime () returned 0x4c80e [0233.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.390] Sleep (dwMilliseconds=0xa) [0233.406] timeGetTime () returned 0x4c81e [0233.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.406] Sleep (dwMilliseconds=0xa) [0233.422] timeGetTime () returned 0x4c82d [0233.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.422] Sleep (dwMilliseconds=0xa) [0233.437] timeGetTime () returned 0x4c83d [0233.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.437] Sleep (dwMilliseconds=0xa) [0233.453] timeGetTime () returned 0x4c84c [0233.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.453] Sleep (dwMilliseconds=0xa) [0233.469] timeGetTime () returned 0x4c85c [0233.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.469] Sleep (dwMilliseconds=0xa) [0233.484] timeGetTime () returned 0x4c86c [0233.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.484] Sleep (dwMilliseconds=0xa) [0233.500] timeGetTime () returned 0x4c87b [0233.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.500] Sleep (dwMilliseconds=0xa) [0233.516] timeGetTime () returned 0x4c88b [0233.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.516] Sleep (dwMilliseconds=0xa) [0233.531] timeGetTime () returned 0x4c89b [0233.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.531] Sleep (dwMilliseconds=0xa) [0233.553] timeGetTime () returned 0x4c8aa [0233.553] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.553] Sleep (dwMilliseconds=0xa) [0233.579] timeGetTime () returned 0x4c8c9 [0233.579] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.579] Sleep (dwMilliseconds=0xa) [0233.595] timeGetTime () returned 0x4c8da [0233.595] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.595] Sleep (dwMilliseconds=0xa) [0233.609] timeGetTime () returned 0x4c8e9 [0233.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.609] Sleep (dwMilliseconds=0xa) [0233.629] timeGetTime () returned 0x4c8f8 [0233.629] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.629] Sleep (dwMilliseconds=0xa) [0233.641] timeGetTime () returned 0x4c908 [0233.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.641] Sleep (dwMilliseconds=0xa) [0233.656] timeGetTime () returned 0x4c918 [0233.657] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.657] Sleep (dwMilliseconds=0xa) [0233.672] timeGetTime () returned 0x4c927 [0233.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.672] Sleep (dwMilliseconds=0xa) [0233.687] timeGetTime () returned 0x4c937 [0233.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.687] Sleep (dwMilliseconds=0xa) [0233.703] timeGetTime () returned 0x4c946 [0233.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.703] Sleep (dwMilliseconds=0xa) [0233.719] timeGetTime () returned 0x4c956 [0233.719] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 1 [0233.719] TranslateMessage (lpMsg=0x8bf968) returned 0 [0233.719] DispatchMessageW (lpMsg=0x8bf968) returned 0x0 [0233.719] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0233.719] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0233.719] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0233.719] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0233.719] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.719] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0233.719] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0233.720] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0233.720] RegCloseKey (hKey=0x240) returned 0x0 [0233.720] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0233.720] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0233.720] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0233.720] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0233.720] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0233.720] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0233.720] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0233.720] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0233.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0233.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9b8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0233.720] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0233.721] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0233.813] FreeLibrary (hLibModule=0x77150000) returned 1 [0233.813] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0233.813] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0233.813] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0233.813] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0233.813] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0233.813] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.813] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0233.813] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0233.813] timeGetTime () returned 0x4c9b4 [0233.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.813] Sleep (dwMilliseconds=0xa) [0233.891] timeGetTime () returned 0x4ca02 [0233.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.891] Sleep (dwMilliseconds=0xa) [0233.938] timeGetTime () returned 0x4ca31 [0233.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.938] Sleep (dwMilliseconds=0xa) [0233.988] timeGetTime () returned 0x4ca61 [0233.988] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0233.988] Sleep (dwMilliseconds=0xa) [0234.031] timeGetTime () returned 0x4ca8f [0234.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.031] Sleep (dwMilliseconds=0xa) [0234.078] timeGetTime () returned 0x4cabd [0234.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.078] Sleep (dwMilliseconds=0xa) [0234.094] timeGetTime () returned 0x4cacd [0234.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.094] Sleep (dwMilliseconds=0xa) [0234.109] timeGetTime () returned 0x4cadd [0234.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.109] Sleep (dwMilliseconds=0xa) [0234.125] timeGetTime () returned 0x4caec [0234.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.125] Sleep (dwMilliseconds=0xa) [0234.181] timeGetTime () returned 0x4cb1b [0234.181] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.181] Sleep (dwMilliseconds=0xa) [0234.203] timeGetTime () returned 0x4cb3a [0234.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.203] Sleep (dwMilliseconds=0xa) [0234.218] timeGetTime () returned 0x4cb4a [0234.218] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.218] Sleep (dwMilliseconds=0xa) [0234.234] timeGetTime () returned 0x4cb5a [0234.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.234] Sleep (dwMilliseconds=0xa) [0234.250] timeGetTime () returned 0x4cb69 [0234.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.250] Sleep (dwMilliseconds=0xa) [0234.265] timeGetTime () returned 0x4cb79 [0234.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.265] Sleep (dwMilliseconds=0xa) [0234.281] timeGetTime () returned 0x4cb89 [0234.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.281] Sleep (dwMilliseconds=0xa) [0234.297] timeGetTime () returned 0x4cb98 [0234.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.297] Sleep (dwMilliseconds=0xa) [0234.317] timeGetTime () returned 0x4cba8 [0234.317] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.317] Sleep (dwMilliseconds=0xa) [0234.328] timeGetTime () returned 0x4cbb7 [0234.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.328] Sleep (dwMilliseconds=0xa) [0234.344] timeGetTime () returned 0x4cbc7 [0234.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.344] Sleep (dwMilliseconds=0xa) [0234.359] timeGetTime () returned 0x4cbd7 [0234.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.359] Sleep (dwMilliseconds=0xa) [0234.376] timeGetTime () returned 0x4cbe8 [0234.376] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.377] Sleep (dwMilliseconds=0xa) [0234.390] timeGetTime () returned 0x4cbf6 [0234.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.390] Sleep (dwMilliseconds=0xa) [0234.406] timeGetTime () returned 0x4cc06 [0234.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.406] Sleep (dwMilliseconds=0xa) [0234.425] timeGetTime () returned 0x4cc15 [0234.425] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.425] Sleep (dwMilliseconds=0xa) [0234.437] timeGetTime () returned 0x4cc25 [0234.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.437] Sleep (dwMilliseconds=0xa) [0234.454] timeGetTime () returned 0x4cc34 [0234.454] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.454] Sleep (dwMilliseconds=0xa) [0234.475] timeGetTime () returned 0x4cc44 [0234.481] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.481] Sleep (dwMilliseconds=0xa) [0234.523] timeGetTime () returned 0x4cc73 [0234.523] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0234.523] TranslateMessage (lpMsg=0x8bf798) returned 0 [0234.523] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0234.523] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0234.523] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0234.523] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.523] Sleep (dwMilliseconds=0xa) [0234.546] timeGetTime () returned 0x4cc92 [0234.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.547] Sleep (dwMilliseconds=0xa) [0234.562] timeGetTime () returned 0x4cca2 [0234.562] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.562] Sleep (dwMilliseconds=0xa) [0234.578] timeGetTime () returned 0x4ccb1 [0234.578] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.578] Sleep (dwMilliseconds=0xa) [0234.593] timeGetTime () returned 0x4ccc1 [0234.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.594] Sleep (dwMilliseconds=0xa) [0234.609] timeGetTime () returned 0x4ccd1 [0234.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.609] Sleep (dwMilliseconds=0xa) [0234.634] timeGetTime () returned 0x4cce0 [0234.634] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.634] Sleep (dwMilliseconds=0xa) [0234.656] timeGetTime () returned 0x4cd00 [0234.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.656] Sleep (dwMilliseconds=0xa) [0234.672] timeGetTime () returned 0x4cd0f [0234.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.672] Sleep (dwMilliseconds=0xa) [0234.687] timeGetTime () returned 0x4cd1f [0234.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.688] Sleep (dwMilliseconds=0xa) [0234.703] timeGetTime () returned 0x4cd2e [0234.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.703] Sleep (dwMilliseconds=0xa) [0234.718] timeGetTime () returned 0x4cd3e [0234.718] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.719] Sleep (dwMilliseconds=0xa) [0234.734] timeGetTime () returned 0x4cd4e [0234.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.734] Sleep (dwMilliseconds=0xa) [0234.750] timeGetTime () returned 0x4cd5d [0234.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.750] Sleep (dwMilliseconds=0xa) [0234.766] timeGetTime () returned 0x4cd6d [0234.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.766] Sleep (dwMilliseconds=0xa) [0234.782] timeGetTime () returned 0x4cd7d [0234.782] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.782] Sleep (dwMilliseconds=0xa) [0234.797] timeGetTime () returned 0x4cd8c [0234.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.797] Sleep (dwMilliseconds=0xa) [0234.813] timeGetTime () returned 0x4cd9c [0234.813] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0234.813] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0234.813] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0234.813] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0234.813] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0234.813] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0234.813] RegCloseKey (hKey=0x240) returned 0x0 [0234.813] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0234.813] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0234.813] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0234.813] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0234.814] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0234.814] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0234.814] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0234.814] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0234.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0234.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aab8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0234.814] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0234.814] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0234.922] FreeLibrary (hLibModule=0x77150000) returned 1 [0234.922] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0234.922] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0234.922] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0234.922] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0234.922] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0234.922] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0234.922] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0234.922] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0234.923] timeGetTime () returned 0x4ce09 [0234.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.923] Sleep (dwMilliseconds=0xa) [0234.969] timeGetTime () returned 0x4ce38 [0234.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0234.969] Sleep (dwMilliseconds=0xa) [0235.016] timeGetTime () returned 0x4ce67 [0235.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.016] Sleep (dwMilliseconds=0xa) [0235.065] timeGetTime () returned 0x4ce96 [0235.065] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.065] Sleep (dwMilliseconds=0xa) [0235.109] timeGetTime () returned 0x4cec5 [0235.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.109] Sleep (dwMilliseconds=0xa) [0235.156] timeGetTime () returned 0x4cef4 [0235.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.156] Sleep (dwMilliseconds=0xa) [0235.172] timeGetTime () returned 0x4cf03 [0235.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.172] Sleep (dwMilliseconds=0xa) [0235.187] timeGetTime () returned 0x4cf13 [0235.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.187] Sleep (dwMilliseconds=0xa) [0235.211] timeGetTime () returned 0x4cf22 [0235.211] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.211] Sleep (dwMilliseconds=0xa) [0235.234] timeGetTime () returned 0x4cf42 [0235.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.234] Sleep (dwMilliseconds=0xa) [0235.253] timeGetTime () returned 0x4cf51 [0235.253] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.253] Sleep (dwMilliseconds=0xa) [0235.275] timeGetTime () returned 0x4cf62 [0235.275] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0235.275] TranslateMessage (lpMsg=0x8bf798) returned 0 [0235.275] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0235.275] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0235.275] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0235.275] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.275] Sleep (dwMilliseconds=0xa) [0235.297] timeGetTime () returned 0x4cf80 [0235.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.297] Sleep (dwMilliseconds=0xa) [0235.313] timeGetTime () returned 0x4cf90 [0235.313] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.313] Sleep (dwMilliseconds=0xa) [0235.329] timeGetTime () returned 0x4cf9f [0235.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.329] Sleep (dwMilliseconds=0xa) [0235.343] timeGetTime () returned 0x4cfaf [0235.343] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.344] Sleep (dwMilliseconds=0xa) [0235.359] timeGetTime () returned 0x4cfbf [0235.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.359] Sleep (dwMilliseconds=0xa) [0235.375] timeGetTime () returned 0x4cfce [0235.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.376] Sleep (dwMilliseconds=0xa) [0235.390] timeGetTime () returned 0x4cfde [0235.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.390] Sleep (dwMilliseconds=0xa) [0235.406] timeGetTime () returned 0x4cfee [0235.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.407] Sleep (dwMilliseconds=0xa) [0235.422] timeGetTime () returned 0x4cffd [0235.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.422] Sleep (dwMilliseconds=0xa) [0235.437] timeGetTime () returned 0x4d00d [0235.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.437] Sleep (dwMilliseconds=0xa) [0235.482] timeGetTime () returned 0x4d02c [0235.482] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.482] Sleep (dwMilliseconds=0xa) [0235.500] timeGetTime () returned 0x4d04b [0235.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.500] Sleep (dwMilliseconds=0xa) [0235.515] timeGetTime () returned 0x4d05b [0235.515] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.515] Sleep (dwMilliseconds=0xa) [0235.531] timeGetTime () returned 0x4d06b [0235.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.531] Sleep (dwMilliseconds=0xa) [0235.593] timeGetTime () returned 0x4d0a9 [0235.593] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.593] Sleep (dwMilliseconds=0xa) [0235.609] timeGetTime () returned 0x4d0b9 [0235.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.609] Sleep (dwMilliseconds=0xa) [0235.625] timeGetTime () returned 0x4d0c8 [0235.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.625] Sleep (dwMilliseconds=0xa) [0235.640] timeGetTime () returned 0x4d0d8 [0235.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.641] Sleep (dwMilliseconds=0xa) [0235.656] timeGetTime () returned 0x4d0e8 [0235.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.656] Sleep (dwMilliseconds=0xa) [0235.672] timeGetTime () returned 0x4d0f7 [0235.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.672] Sleep (dwMilliseconds=0xa) [0235.688] timeGetTime () returned 0x4d107 [0235.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.688] Sleep (dwMilliseconds=0xa) [0235.704] timeGetTime () returned 0x4d116 [0235.704] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.704] Sleep (dwMilliseconds=0xa) [0235.719] timeGetTime () returned 0x4d126 [0235.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.719] Sleep (dwMilliseconds=0xa) [0235.734] timeGetTime () returned 0x4d136 [0235.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.734] Sleep (dwMilliseconds=0xa) [0235.750] timeGetTime () returned 0x4d145 [0235.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.750] Sleep (dwMilliseconds=0xa) [0235.766] timeGetTime () returned 0x4d155 [0235.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.766] Sleep (dwMilliseconds=0xa) [0235.781] timeGetTime () returned 0x4d165 [0235.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.781] Sleep (dwMilliseconds=0xa) [0235.797] timeGetTime () returned 0x4d174 [0235.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.797] Sleep (dwMilliseconds=0xa) [0235.812] timeGetTime () returned 0x4d184 [0235.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.812] Sleep (dwMilliseconds=0xa) [0235.828] timeGetTime () returned 0x4d193 [0235.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.828] Sleep (dwMilliseconds=0xa) [0235.844] timeGetTime () returned 0x4d1a3 [0235.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.844] Sleep (dwMilliseconds=0xa) [0235.859] timeGetTime () returned 0x4d1b3 [0235.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.859] Sleep (dwMilliseconds=0xa) [0235.896] timeGetTime () returned 0x4d1d2 [0235.896] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0235.896] Sleep (dwMilliseconds=0xa) [0235.922] timeGetTime () returned 0x4d1f1 [0235.922] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0235.922] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0235.922] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0235.922] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0235.922] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0235.922] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0235.922] RegCloseKey (hKey=0x240) returned 0x0 [0235.922] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0235.922] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0235.922] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0235.922] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0235.922] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0235.922] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0235.922] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0235.922] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0235.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0235.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab18, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0235.923] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0235.923] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0236.031] FreeLibrary (hLibModule=0x77150000) returned 1 [0236.031] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0236.031] TranslateMessage (lpMsg=0x8bf708) returned 0 [0236.031] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0236.032] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0236.032] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0236.032] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0236.032] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0236.032] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0236.032] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0236.032] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0236.032] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0236.032] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0236.032] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0236.032] timeGetTime () returned 0x4d25f [0236.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.032] Sleep (dwMilliseconds=0xa) [0236.078] timeGetTime () returned 0x4d28d [0236.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.078] Sleep (dwMilliseconds=0xa) [0236.125] timeGetTime () returned 0x4d2bc [0236.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.125] Sleep (dwMilliseconds=0xa) [0236.172] timeGetTime () returned 0x4d2eb [0236.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.172] Sleep (dwMilliseconds=0xa) [0236.219] timeGetTime () returned 0x4d31a [0236.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.219] Sleep (dwMilliseconds=0xa) [0236.244] timeGetTime () returned 0x4d32a [0236.244] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.244] Sleep (dwMilliseconds=0xa) [0236.277] timeGetTime () returned 0x4d349 [0236.277] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.277] Sleep (dwMilliseconds=0xa) [0236.309] timeGetTime () returned 0x4d368 [0236.309] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.309] Sleep (dwMilliseconds=0xa) [0236.328] timeGetTime () returned 0x4d388 [0236.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.329] Sleep (dwMilliseconds=0xa) [0236.343] timeGetTime () returned 0x4d397 [0236.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.344] Sleep (dwMilliseconds=0xa) [0236.359] timeGetTime () returned 0x4d3a7 [0236.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.359] Sleep (dwMilliseconds=0xa) [0236.375] timeGetTime () returned 0x4d3b6 [0236.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.375] Sleep (dwMilliseconds=0xa) [0236.390] timeGetTime () returned 0x4d3c6 [0236.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.390] Sleep (dwMilliseconds=0xa) [0236.406] timeGetTime () returned 0x4d3d6 [0236.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.406] Sleep (dwMilliseconds=0xa) [0236.422] timeGetTime () returned 0x4d3e5 [0236.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.422] Sleep (dwMilliseconds=0xa) [0236.437] timeGetTime () returned 0x4d3f5 [0236.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.437] Sleep (dwMilliseconds=0xa) [0236.453] timeGetTime () returned 0x4d404 [0236.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.453] Sleep (dwMilliseconds=0xa) [0236.468] timeGetTime () returned 0x4d414 [0236.468] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.468] Sleep (dwMilliseconds=0xa) [0236.484] timeGetTime () returned 0x4d424 [0236.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.484] Sleep (dwMilliseconds=0xa) [0236.515] timeGetTime () returned 0x4d443 [0236.515] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.516] Sleep (dwMilliseconds=0xa) [0236.532] timeGetTime () returned 0x4d453 [0236.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.532] Sleep (dwMilliseconds=0xa) [0236.547] timeGetTime () returned 0x4d462 [0236.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.547] Sleep (dwMilliseconds=0xa) [0236.569] timeGetTime () returned 0x4d472 [0236.569] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.569] Sleep (dwMilliseconds=0xa) [0236.594] timeGetTime () returned 0x4d491 [0236.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.594] Sleep (dwMilliseconds=0xa) [0236.610] timeGetTime () returned 0x4d4a2 [0236.610] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.610] Sleep (dwMilliseconds=0xa) [0236.724] timeGetTime () returned 0x4d50e [0236.725] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.725] Sleep (dwMilliseconds=0xa) [0236.750] timeGetTime () returned 0x4d52d [0236.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.750] Sleep (dwMilliseconds=0xa) [0236.765] timeGetTime () returned 0x4d53d [0236.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.765] Sleep (dwMilliseconds=0xa) [0236.781] timeGetTime () returned 0x4d54d [0236.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.781] Sleep (dwMilliseconds=0xa) [0236.797] timeGetTime () returned 0x4d55c [0236.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0236.797] TranslateMessage (lpMsg=0x8bf798) returned 0 [0236.797] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0236.797] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0236.797] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0236.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.797] Sleep (dwMilliseconds=0xa) [0236.812] timeGetTime () returned 0x4d56c [0236.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.812] Sleep (dwMilliseconds=0xa) [0236.828] timeGetTime () returned 0x4d57b [0236.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.828] Sleep (dwMilliseconds=0xa) [0236.844] timeGetTime () returned 0x4d58b [0236.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.844] Sleep (dwMilliseconds=0xa) [0236.859] timeGetTime () returned 0x4d59b [0236.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.859] Sleep (dwMilliseconds=0xa) [0236.892] timeGetTime () returned 0x4d5ba [0236.892] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.892] Sleep (dwMilliseconds=0xa) [0236.907] timeGetTime () returned 0x4d5ca [0236.908] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.908] Sleep (dwMilliseconds=0xa) [0236.921] timeGetTime () returned 0x4d5d9 [0236.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.922] Sleep (dwMilliseconds=0xa) [0236.938] timeGetTime () returned 0x4d5e9 [0236.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.938] Sleep (dwMilliseconds=0xa) [0236.958] timeGetTime () returned 0x4d5f8 [0236.958] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.958] Sleep (dwMilliseconds=0xa) [0236.969] timeGetTime () returned 0x4d608 [0236.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.969] Sleep (dwMilliseconds=0xa) [0236.984] timeGetTime () returned 0x4d618 [0236.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0236.984] Sleep (dwMilliseconds=0xa) [0237.003] timeGetTime () returned 0x4d627 [0237.003] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.003] Sleep (dwMilliseconds=0xa) [0237.015] timeGetTime () returned 0x4d637 [0237.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.016] Sleep (dwMilliseconds=0xa) [0237.032] timeGetTime () returned 0x4d647 [0237.032] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0237.032] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0237.032] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0237.032] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0237.032] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0237.033] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0237.033] RegCloseKey (hKey=0x240) returned 0x0 [0237.033] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0237.033] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0237.033] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0237.033] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0237.033] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0237.033] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0237.033] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0237.033] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0237.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0237.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aaf8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0237.033] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0237.033] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0237.125] FreeLibrary (hLibModule=0x77150000) returned 1 [0237.125] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0237.125] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0237.125] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0237.125] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0237.125] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0237.125] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0237.125] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0237.125] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0237.125] timeGetTime () returned 0x4d6a4 [0237.126] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.126] Sleep (dwMilliseconds=0xa) [0237.172] timeGetTime () returned 0x4d6d3 [0237.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.172] Sleep (dwMilliseconds=0xa) [0237.220] timeGetTime () returned 0x4d704 [0237.220] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.220] Sleep (dwMilliseconds=0xa) [0237.266] timeGetTime () returned 0x4d731 [0237.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.266] Sleep (dwMilliseconds=0xa) [0237.312] timeGetTime () returned 0x4d760 [0237.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.312] Sleep (dwMilliseconds=0xa) [0237.342] timeGetTime () returned 0x4d76f [0237.342] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.342] Sleep (dwMilliseconds=0xa) [0237.368] timeGetTime () returned 0x4d78f [0237.368] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.368] Sleep (dwMilliseconds=0xa) [0237.391] timeGetTime () returned 0x4d7ae [0237.391] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.391] Sleep (dwMilliseconds=0xa) [0237.406] timeGetTime () returned 0x4d7be [0237.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.406] Sleep (dwMilliseconds=0xa) [0237.422] timeGetTime () returned 0x4d7cd [0237.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.422] Sleep (dwMilliseconds=0xa) [0237.437] timeGetTime () returned 0x4d7dd [0237.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.437] Sleep (dwMilliseconds=0xa) [0237.453] timeGetTime () returned 0x4d7ec [0237.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.453] Sleep (dwMilliseconds=0xa) [0237.469] timeGetTime () returned 0x4d7fc [0237.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.469] Sleep (dwMilliseconds=0xa) [0237.484] timeGetTime () returned 0x4d80c [0237.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.484] Sleep (dwMilliseconds=0xa) [0237.500] timeGetTime () returned 0x4d81b [0237.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.500] Sleep (dwMilliseconds=0xa) [0237.516] timeGetTime () returned 0x4d82b [0237.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.516] Sleep (dwMilliseconds=0xa) [0237.531] timeGetTime () returned 0x4d83b [0237.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.531] Sleep (dwMilliseconds=0xa) [0237.547] timeGetTime () returned 0x4d84a [0237.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0237.547] TranslateMessage (lpMsg=0x8bf798) returned 0 [0237.547] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0237.547] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0237.547] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0237.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.547] Sleep (dwMilliseconds=0xa) [0237.571] timeGetTime () returned 0x4d85a [0237.571] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.571] Sleep (dwMilliseconds=0xa) [0237.594] timeGetTime () returned 0x4d879 [0237.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.594] Sleep (dwMilliseconds=0xa) [0237.609] timeGetTime () returned 0x4d889 [0237.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.609] Sleep (dwMilliseconds=0xa) [0237.625] timeGetTime () returned 0x4d898 [0237.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.625] Sleep (dwMilliseconds=0xa) [0237.640] timeGetTime () returned 0x4d8a8 [0237.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.640] Sleep (dwMilliseconds=0xa) [0237.656] timeGetTime () returned 0x4d8b8 [0237.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.656] Sleep (dwMilliseconds=0xa) [0237.672] timeGetTime () returned 0x4d8c7 [0237.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.672] Sleep (dwMilliseconds=0xa) [0237.687] timeGetTime () returned 0x4d8d7 [0237.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.687] Sleep (dwMilliseconds=0xa) [0237.703] timeGetTime () returned 0x4d8e6 [0237.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.703] Sleep (dwMilliseconds=0xa) [0237.724] timeGetTime () returned 0x4d8f6 [0237.724] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.724] Sleep (dwMilliseconds=0xa) [0237.750] timeGetTime () returned 0x4d915 [0237.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.750] Sleep (dwMilliseconds=0xa) [0237.765] timeGetTime () returned 0x4d925 [0237.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.766] Sleep (dwMilliseconds=0xa) [0237.781] timeGetTime () returned 0x4d935 [0237.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.781] Sleep (dwMilliseconds=0xa) [0237.797] timeGetTime () returned 0x4d944 [0237.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.797] Sleep (dwMilliseconds=0xa) [0237.812] timeGetTime () returned 0x4d954 [0237.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.812] Sleep (dwMilliseconds=0xa) [0237.828] timeGetTime () returned 0x4d963 [0237.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.828] Sleep (dwMilliseconds=0xa) [0237.844] timeGetTime () returned 0x4d973 [0237.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.844] Sleep (dwMilliseconds=0xa) [0237.859] timeGetTime () returned 0x4d983 [0237.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.859] Sleep (dwMilliseconds=0xa) [0237.875] timeGetTime () returned 0x4d992 [0237.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.875] Sleep (dwMilliseconds=0xa) [0237.909] timeGetTime () returned 0x4d9b2 [0237.909] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.909] Sleep (dwMilliseconds=0xa) [0237.922] timeGetTime () returned 0x4d9c1 [0237.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.922] Sleep (dwMilliseconds=0xa) [0237.937] timeGetTime () returned 0x4d9d1 [0237.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.937] Sleep (dwMilliseconds=0xa) [0237.953] timeGetTime () returned 0x4d9e0 [0237.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.953] Sleep (dwMilliseconds=0xa) [0237.969] timeGetTime () returned 0x4d9f0 [0237.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.969] Sleep (dwMilliseconds=0xa) [0237.985] timeGetTime () returned 0x4da00 [0237.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0237.985] Sleep (dwMilliseconds=0xa) [0238.000] timeGetTime () returned 0x4da0f [0238.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.000] Sleep (dwMilliseconds=0xa) [0238.016] timeGetTime () returned 0x4da1f [0238.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.016] Sleep (dwMilliseconds=0xa) [0238.031] timeGetTime () returned 0x4da2f [0238.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.031] Sleep (dwMilliseconds=0xa) [0238.047] timeGetTime () returned 0x4da3e [0238.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.047] Sleep (dwMilliseconds=0xa) [0238.063] timeGetTime () returned 0x4da4e [0238.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.063] Sleep (dwMilliseconds=0xa) [0238.078] timeGetTime () returned 0x4da5d [0238.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.078] Sleep (dwMilliseconds=0xa) [0238.094] timeGetTime () returned 0x4da6d [0238.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.094] Sleep (dwMilliseconds=0xa) [0238.109] timeGetTime () returned 0x4da7d [0238.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.109] Sleep (dwMilliseconds=0xa) [0238.125] timeGetTime () returned 0x4da8c [0238.125] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0238.125] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0238.125] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.125] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0238.125] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0238.125] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0238.125] RegCloseKey (hKey=0x240) returned 0x0 [0238.126] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0238.126] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0238.126] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0238.126] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0238.126] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0238.126] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0238.126] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0238.126] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0238.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0238.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0238.126] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0238.126] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0238.219] FreeLibrary (hLibModule=0x77150000) returned 1 [0238.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0238.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0238.219] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0238.219] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0238.219] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0238.219] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.219] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0238.220] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0238.220] timeGetTime () returned 0x4daea [0238.220] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.220] Sleep (dwMilliseconds=0xa) [0238.266] timeGetTime () returned 0x4db19 [0238.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.266] Sleep (dwMilliseconds=0xa) [0238.299] timeGetTime () returned 0x4db3a [0238.299] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0238.299] TranslateMessage (lpMsg=0x8bf798) returned 0 [0238.299] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0238.299] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0238.299] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0238.299] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.299] Sleep (dwMilliseconds=0xa) [0238.344] timeGetTime () returned 0x4db67 [0238.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.344] Sleep (dwMilliseconds=0xa) [0238.391] timeGetTime () returned 0x4db96 [0238.391] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.391] Sleep (dwMilliseconds=0xa) [0238.437] timeGetTime () returned 0x4dbc5 [0238.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.437] Sleep (dwMilliseconds=0xa) [0238.453] timeGetTime () returned 0x4dbd4 [0238.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.453] Sleep (dwMilliseconds=0xa) [0238.480] timeGetTime () returned 0x4dbe4 [0238.480] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.480] Sleep (dwMilliseconds=0xa) [0238.500] timeGetTime () returned 0x4dc03 [0238.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.500] Sleep (dwMilliseconds=0xa) [0238.516] timeGetTime () returned 0x4dc13 [0238.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.516] Sleep (dwMilliseconds=0xa) [0238.531] timeGetTime () returned 0x4dc23 [0238.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.531] Sleep (dwMilliseconds=0xa) [0238.547] timeGetTime () returned 0x4dc32 [0238.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.547] Sleep (dwMilliseconds=0xa) [0238.570] timeGetTime () returned 0x4dc42 [0238.570] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.570] Sleep (dwMilliseconds=0xa) [0238.594] timeGetTime () returned 0x4dc61 [0238.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.594] Sleep (dwMilliseconds=0xa) [0238.609] timeGetTime () returned 0x4dc71 [0238.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.609] Sleep (dwMilliseconds=0xa) [0238.626] timeGetTime () returned 0x4dc81 [0238.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.626] Sleep (dwMilliseconds=0xa) [0238.640] timeGetTime () returned 0x4dc90 [0238.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.640] Sleep (dwMilliseconds=0xa) [0238.657] timeGetTime () returned 0x4dca0 [0238.657] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.657] Sleep (dwMilliseconds=0xa) [0238.672] timeGetTime () returned 0x4dcaf [0238.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.672] Sleep (dwMilliseconds=0xa) [0238.687] timeGetTime () returned 0x4dcbf [0238.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.687] Sleep (dwMilliseconds=0xa) [0238.703] timeGetTime () returned 0x4dccf [0238.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.703] Sleep (dwMilliseconds=0xa) [0238.719] timeGetTime () returned 0x4dcde [0238.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.719] Sleep (dwMilliseconds=0xa) [0238.734] timeGetTime () returned 0x4dcee [0238.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.734] Sleep (dwMilliseconds=0xa) [0238.750] timeGetTime () returned 0x4dcfd [0238.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.750] Sleep (dwMilliseconds=0xa) [0238.766] timeGetTime () returned 0x4dd0d [0238.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.766] Sleep (dwMilliseconds=0xa) [0238.781] timeGetTime () returned 0x4dd1d [0238.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.781] Sleep (dwMilliseconds=0xa) [0238.797] timeGetTime () returned 0x4dd2c [0238.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.797] Sleep (dwMilliseconds=0xa) [0238.813] timeGetTime () returned 0x4dd3c [0238.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.813] Sleep (dwMilliseconds=0xa) [0238.828] timeGetTime () returned 0x4dd4b [0238.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.828] Sleep (dwMilliseconds=0xa) [0238.844] timeGetTime () returned 0x4dd5b [0238.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.844] Sleep (dwMilliseconds=0xa) [0238.859] timeGetTime () returned 0x4dd6b [0238.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.859] Sleep (dwMilliseconds=0xa) [0238.875] timeGetTime () returned 0x4dd7a [0238.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.875] Sleep (dwMilliseconds=0xa) [0238.890] timeGetTime () returned 0x4dd8a [0238.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.890] Sleep (dwMilliseconds=0xa) [0238.926] timeGetTime () returned 0x4dda9 [0238.926] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.926] Sleep (dwMilliseconds=0xa) [0238.937] timeGetTime () returned 0x4ddb9 [0238.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.937] Sleep (dwMilliseconds=0xa) [0238.953] timeGetTime () returned 0x4ddc8 [0238.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.953] Sleep (dwMilliseconds=0xa) [0238.969] timeGetTime () returned 0x4ddd8 [0238.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.969] Sleep (dwMilliseconds=0xa) [0238.984] timeGetTime () returned 0x4dde8 [0238.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0238.984] Sleep (dwMilliseconds=0xa) [0239.000] timeGetTime () returned 0x4ddf7 [0239.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.000] Sleep (dwMilliseconds=0xa) [0239.015] timeGetTime () returned 0x4de07 [0239.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.015] Sleep (dwMilliseconds=0xa) [0239.031] timeGetTime () returned 0x4de17 [0239.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.031] Sleep (dwMilliseconds=0xa) [0239.047] timeGetTime () returned 0x4de26 [0239.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.047] Sleep (dwMilliseconds=0xa) [0239.062] timeGetTime () returned 0x4de36 [0239.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.062] Sleep (dwMilliseconds=0xa) [0239.081] timeGetTime () returned 0x4de45 [0239.081] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0239.081] TranslateMessage (lpMsg=0x8bf798) returned 0 [0239.081] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0239.081] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0239.081] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0239.081] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.081] Sleep (dwMilliseconds=0xa) [0239.093] timeGetTime () returned 0x4de55 [0239.093] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.093] Sleep (dwMilliseconds=0xa) [0239.109] timeGetTime () returned 0x4de65 [0239.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.109] Sleep (dwMilliseconds=0xa) [0239.125] timeGetTime () returned 0x4de74 [0239.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.125] Sleep (dwMilliseconds=0xa) [0239.141] timeGetTime () returned 0x4de84 [0239.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.141] Sleep (dwMilliseconds=0xa) [0239.156] timeGetTime () returned 0x4de94 [0239.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.156] Sleep (dwMilliseconds=0xa) [0239.172] timeGetTime () returned 0x4dea3 [0239.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.172] Sleep (dwMilliseconds=0xa) [0239.187] timeGetTime () returned 0x4deb3 [0239.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.187] Sleep (dwMilliseconds=0xa) [0239.203] timeGetTime () returned 0x4dec2 [0239.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.203] Sleep (dwMilliseconds=0xa) [0239.218] timeGetTime () returned 0x4ded2 [0239.218] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0239.219] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0239.219] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.219] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0239.219] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0239.219] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0239.219] RegCloseKey (hKey=0x240) returned 0x0 [0239.219] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0239.219] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0239.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0239.219] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0239.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0239.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0239.219] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0239.219] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0239.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0239.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aab8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0239.220] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0239.220] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0239.312] FreeLibrary (hLibModule=0x77150000) returned 1 [0239.312] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0239.312] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0239.312] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0239.313] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0239.313] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0239.313] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.313] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0239.313] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0239.313] timeGetTime () returned 0x4df30 [0239.313] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.313] Sleep (dwMilliseconds=0xa) [0239.359] timeGetTime () returned 0x4df5f [0239.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.359] Sleep (dwMilliseconds=0xa) [0239.408] timeGetTime () returned 0x4df90 [0239.408] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.408] Sleep (dwMilliseconds=0xa) [0239.453] timeGetTime () returned 0x4dfbc [0239.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.453] Sleep (dwMilliseconds=0xa) [0239.500] timeGetTime () returned 0x4dfeb [0239.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.500] Sleep (dwMilliseconds=0xa) [0239.520] timeGetTime () returned 0x4dffb [0239.520] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.520] Sleep (dwMilliseconds=0xa) [0239.531] timeGetTime () returned 0x4e00b [0239.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.531] Sleep (dwMilliseconds=0xa) [0239.547] timeGetTime () returned 0x4e01a [0239.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.547] Sleep (dwMilliseconds=0xa) [0239.587] timeGetTime () returned 0x4e03a [0239.587] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.587] Sleep (dwMilliseconds=0xa) [0239.609] timeGetTime () returned 0x4e059 [0239.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.609] Sleep (dwMilliseconds=0xa) [0239.625] timeGetTime () returned 0x4e068 [0239.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.625] Sleep (dwMilliseconds=0xa) [0239.641] timeGetTime () returned 0x4e078 [0239.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.641] Sleep (dwMilliseconds=0xa) [0239.656] timeGetTime () returned 0x4e088 [0239.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.656] Sleep (dwMilliseconds=0xa) [0239.672] timeGetTime () returned 0x4e097 [0239.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.672] Sleep (dwMilliseconds=0xa) [0239.687] timeGetTime () returned 0x4e0a7 [0239.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.687] Sleep (dwMilliseconds=0xa) [0239.703] timeGetTime () returned 0x4e0b6 [0239.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.703] Sleep (dwMilliseconds=0xa) [0239.719] timeGetTime () returned 0x4e0c6 [0239.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.719] Sleep (dwMilliseconds=0xa) [0239.734] timeGetTime () returned 0x4e0d6 [0239.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.734] Sleep (dwMilliseconds=0xa) [0239.750] timeGetTime () returned 0x4e0e5 [0239.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.750] Sleep (dwMilliseconds=0xa) [0239.766] timeGetTime () returned 0x4e0f5 [0239.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.766] Sleep (dwMilliseconds=0xa) [0239.782] timeGetTime () returned 0x4e105 [0239.782] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.782] Sleep (dwMilliseconds=0xa) [0239.797] timeGetTime () returned 0x4e114 [0239.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.797] Sleep (dwMilliseconds=0xa) [0239.813] timeGetTime () returned 0x4e124 [0239.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.813] Sleep (dwMilliseconds=0xa) [0239.828] timeGetTime () returned 0x4e133 [0239.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0239.829] TranslateMessage (lpMsg=0x8bf798) returned 0 [0239.829] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0239.829] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0239.829] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0239.829] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.829] Sleep (dwMilliseconds=0xa) [0239.844] timeGetTime () returned 0x4e143 [0239.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.844] Sleep (dwMilliseconds=0xa) [0239.859] timeGetTime () returned 0x4e153 [0239.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.859] Sleep (dwMilliseconds=0xa) [0239.875] timeGetTime () returned 0x4e162 [0239.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.875] Sleep (dwMilliseconds=0xa) [0239.891] timeGetTime () returned 0x4e172 [0239.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.891] Sleep (dwMilliseconds=0xa) [0239.917] timeGetTime () returned 0x4e182 [0239.917] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.917] Sleep (dwMilliseconds=0xa) [0239.944] timeGetTime () returned 0x4e1a1 [0239.944] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.944] Sleep (dwMilliseconds=0xa) [0239.969] timeGetTime () returned 0x4e1c0 [0239.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.969] Sleep (dwMilliseconds=0xa) [0239.984] timeGetTime () returned 0x4e1d0 [0239.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0239.984] Sleep (dwMilliseconds=0xa) [0240.000] timeGetTime () returned 0x4e1df [0240.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.000] Sleep (dwMilliseconds=0xa) [0240.017] timeGetTime () returned 0x4e1ef [0240.017] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.017] Sleep (dwMilliseconds=0xa) [0240.031] timeGetTime () returned 0x4e1ff [0240.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.031] Sleep (dwMilliseconds=0xa) [0240.047] timeGetTime () returned 0x4e20e [0240.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.047] Sleep (dwMilliseconds=0xa) [0240.062] timeGetTime () returned 0x4e21e [0240.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.062] Sleep (dwMilliseconds=0xa) [0240.078] timeGetTime () returned 0x4e22d [0240.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.078] Sleep (dwMilliseconds=0xa) [0240.094] timeGetTime () returned 0x4e23d [0240.095] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.095] Sleep (dwMilliseconds=0xa) [0240.110] timeGetTime () returned 0x4e24d [0240.110] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.110] Sleep (dwMilliseconds=0xa) [0240.125] timeGetTime () returned 0x4e25c [0240.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.125] Sleep (dwMilliseconds=0xa) [0240.141] timeGetTime () returned 0x4e26c [0240.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.141] Sleep (dwMilliseconds=0xa) [0240.157] timeGetTime () returned 0x4e27c [0240.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.157] Sleep (dwMilliseconds=0xa) [0240.172] timeGetTime () returned 0x4e28b [0240.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.172] Sleep (dwMilliseconds=0xa) [0240.187] timeGetTime () returned 0x4e29b [0240.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.187] Sleep (dwMilliseconds=0xa) [0240.203] timeGetTime () returned 0x4e2aa [0240.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.203] Sleep (dwMilliseconds=0xa) [0240.220] timeGetTime () returned 0x4e2ba [0240.220] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.220] Sleep (dwMilliseconds=0xa) [0240.236] timeGetTime () returned 0x4e2ca [0240.236] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.236] Sleep (dwMilliseconds=0xa) [0240.250] timeGetTime () returned 0x4e2d9 [0240.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.250] Sleep (dwMilliseconds=0xa) [0240.266] timeGetTime () returned 0x4e2e9 [0240.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.266] Sleep (dwMilliseconds=0xa) [0240.281] timeGetTime () returned 0x4e2f9 [0240.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.281] Sleep (dwMilliseconds=0xa) [0240.297] timeGetTime () returned 0x4e308 [0240.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.297] Sleep (dwMilliseconds=0xa) [0240.312] timeGetTime () returned 0x4e318 [0240.312] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0240.313] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0240.313] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0240.313] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0240.313] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0240.313] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0240.313] RegCloseKey (hKey=0x240) returned 0x0 [0240.313] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0240.313] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0240.313] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0240.313] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0240.313] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0240.314] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0240.314] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0240.314] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0240.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0240.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0240.314] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0240.314] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0240.422] FreeLibrary (hLibModule=0x77150000) returned 1 [0240.422] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0240.422] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0240.422] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0240.422] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0240.422] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0240.422] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0240.422] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0240.423] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0240.423] timeGetTime () returned 0x4e385 [0240.423] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.423] Sleep (dwMilliseconds=0xa) [0240.469] timeGetTime () returned 0x4e3b4 [0240.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.470] Sleep (dwMilliseconds=0xa) [0240.516] timeGetTime () returned 0x4e3e3 [0240.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.516] Sleep (dwMilliseconds=0xa) [0240.571] timeGetTime () returned 0x4e412 [0240.571] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.571] Sleep (dwMilliseconds=0xa) [0240.613] timeGetTime () returned 0x4e441 [0240.613] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0240.613] TranslateMessage (lpMsg=0x8bf798) returned 0 [0240.613] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0240.613] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0240.613] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0240.614] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.614] Sleep (dwMilliseconds=0xa) [0240.656] timeGetTime () returned 0x4e470 [0240.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.657] Sleep (dwMilliseconds=0xa) [0240.703] timeGetTime () returned 0x4e49e [0240.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.703] Sleep (dwMilliseconds=0xa) [0240.823] timeGetTime () returned 0x4e50c [0240.823] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.823] Sleep (dwMilliseconds=0xa) [0240.863] timeGetTime () returned 0x4e53b [0240.863] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.863] Sleep (dwMilliseconds=0xa) [0240.899] timeGetTime () returned 0x4e55a [0240.899] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.899] Sleep (dwMilliseconds=0xa) [0240.985] timeGetTime () returned 0x4e5b8 [0240.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0240.985] Sleep (dwMilliseconds=0xa) [0241.000] timeGetTime () returned 0x4e5c7 [0241.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.000] Sleep (dwMilliseconds=0xa) [0241.023] timeGetTime () returned 0x4e5d7 [0241.023] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.023] Sleep (dwMilliseconds=0xa) [0241.059] timeGetTime () returned 0x4e5f6 [0241.060] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.060] Sleep (dwMilliseconds=0xa) [0241.088] timeGetTime () returned 0x4e615 [0241.088] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.088] Sleep (dwMilliseconds=0xa) [0241.110] timeGetTime () returned 0x4e635 [0241.110] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.110] Sleep (dwMilliseconds=0xa) [0241.126] timeGetTime () returned 0x4e644 [0241.126] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.126] Sleep (dwMilliseconds=0xa) [0241.140] timeGetTime () returned 0x4e654 [0241.140] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.140] Sleep (dwMilliseconds=0xa) [0241.156] timeGetTime () returned 0x4e664 [0241.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.156] Sleep (dwMilliseconds=0xa) [0241.172] timeGetTime () returned 0x4e673 [0241.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.172] Sleep (dwMilliseconds=0xa) [0241.187] timeGetTime () returned 0x4e683 [0241.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.187] Sleep (dwMilliseconds=0xa) [0241.203] timeGetTime () returned 0x4e692 [0241.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.203] Sleep (dwMilliseconds=0xa) [0241.219] timeGetTime () returned 0x4e6a2 [0241.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.219] Sleep (dwMilliseconds=0xa) [0241.234] timeGetTime () returned 0x4e6b2 [0241.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.234] Sleep (dwMilliseconds=0xa) [0241.250] timeGetTime () returned 0x4e6c1 [0241.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.250] Sleep (dwMilliseconds=0xa) [0241.265] timeGetTime () returned 0x4e6d1 [0241.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.265] Sleep (dwMilliseconds=0xa) [0241.281] timeGetTime () returned 0x4e6e1 [0241.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.281] Sleep (dwMilliseconds=0xa) [0241.298] timeGetTime () returned 0x4e6f0 [0241.298] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.298] Sleep (dwMilliseconds=0xa) [0241.312] timeGetTime () returned 0x4e700 [0241.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.312] Sleep (dwMilliseconds=0xa) [0241.328] timeGetTime () returned 0x4e710 [0241.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.328] Sleep (dwMilliseconds=0xa) [0241.346] timeGetTime () returned 0x4e71f [0241.346] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.346] Sleep (dwMilliseconds=0xa) [0241.360] timeGetTime () returned 0x4e72f [0241.360] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0241.360] TranslateMessage (lpMsg=0x8bf798) returned 0 [0241.360] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0241.360] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0241.360] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0241.361] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.361] Sleep (dwMilliseconds=0xa) [0241.376] timeGetTime () returned 0x4e73e [0241.376] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.376] Sleep (dwMilliseconds=0xa) [0241.390] timeGetTime () returned 0x4e74e [0241.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.391] Sleep (dwMilliseconds=0xa) [0241.406] timeGetTime () returned 0x4e75e [0241.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.406] Sleep (dwMilliseconds=0xa) [0241.422] timeGetTime () returned 0x4e76d [0241.422] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0241.422] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0241.422] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0241.422] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0241.422] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0241.422] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0241.423] RegCloseKey (hKey=0x240) returned 0x0 [0241.423] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0241.423] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0241.423] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0241.423] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0241.423] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0241.423] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0241.423] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0241.423] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0241.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0241.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a978, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0241.424] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0241.424] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0241.531] FreeLibrary (hLibModule=0x77150000) returned 1 [0241.531] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0241.531] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0241.531] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0241.531] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0241.532] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0241.532] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0241.532] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0241.532] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0241.532] timeGetTime () returned 0x4e7db [0241.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.532] Sleep (dwMilliseconds=0xa) [0241.578] timeGetTime () returned 0x4e809 [0241.578] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.578] Sleep (dwMilliseconds=0xa) [0241.625] timeGetTime () returned 0x4e838 [0241.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.625] Sleep (dwMilliseconds=0xa) [0241.660] timeGetTime () returned 0x4e858 [0241.660] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.660] Sleep (dwMilliseconds=0xa) [0241.703] timeGetTime () returned 0x4e886 [0241.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.703] Sleep (dwMilliseconds=0xa) [0241.750] timeGetTime () returned 0x4e8b5 [0241.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.750] Sleep (dwMilliseconds=0xa) [0241.766] timeGetTime () returned 0x4e8c5 [0241.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.766] Sleep (dwMilliseconds=0xa) [0241.781] timeGetTime () returned 0x4e8d5 [0241.782] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.782] Sleep (dwMilliseconds=0xa) [0241.806] timeGetTime () returned 0x4e8e6 [0241.806] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.806] Sleep (dwMilliseconds=0xa) [0241.839] timeGetTime () returned 0x4e903 [0241.839] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.839] Sleep (dwMilliseconds=0xa) [0241.859] timeGetTime () returned 0x4e923 [0241.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.859] Sleep (dwMilliseconds=0xa) [0241.875] timeGetTime () returned 0x4e932 [0241.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.875] Sleep (dwMilliseconds=0xa) [0241.891] timeGetTime () returned 0x4e942 [0241.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.891] Sleep (dwMilliseconds=0xa) [0241.906] timeGetTime () returned 0x4e952 [0241.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.906] Sleep (dwMilliseconds=0xa) [0241.923] timeGetTime () returned 0x4e961 [0241.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.923] Sleep (dwMilliseconds=0xa) [0241.979] timeGetTime () returned 0x4e990 [0241.979] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0241.979] Sleep (dwMilliseconds=0xa) [0242.000] timeGetTime () returned 0x4e9b0 [0242.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.000] Sleep (dwMilliseconds=0xa) [0242.016] timeGetTime () returned 0x4e9bf [0242.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.016] Sleep (dwMilliseconds=0xa) [0242.031] timeGetTime () returned 0x4e9cf [0242.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.031] Sleep (dwMilliseconds=0xa) [0242.047] timeGetTime () returned 0x4e9de [0242.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.047] Sleep (dwMilliseconds=0xa) [0242.062] timeGetTime () returned 0x4e9ee [0242.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.062] Sleep (dwMilliseconds=0xa) [0242.078] timeGetTime () returned 0x4e9fd [0242.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.078] Sleep (dwMilliseconds=0xa) [0242.094] timeGetTime () returned 0x4ea0d [0242.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.094] Sleep (dwMilliseconds=0xa) [0242.109] timeGetTime () returned 0x4ea1d [0242.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.109] Sleep (dwMilliseconds=0xa) [0242.125] timeGetTime () returned 0x4ea2c [0242.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0242.125] TranslateMessage (lpMsg=0x8bf798) returned 0 [0242.125] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0242.125] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0242.125] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0242.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.125] Sleep (dwMilliseconds=0xa) [0242.140] timeGetTime () returned 0x4ea3c [0242.140] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.140] Sleep (dwMilliseconds=0xa) [0242.156] timeGetTime () returned 0x4ea4c [0242.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.156] Sleep (dwMilliseconds=0xa) [0242.172] timeGetTime () returned 0x4ea5b [0242.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.172] Sleep (dwMilliseconds=0xa) [0242.187] timeGetTime () returned 0x4ea6b [0242.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.187] Sleep (dwMilliseconds=0xa) [0242.204] timeGetTime () returned 0x4ea7b [0242.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.204] Sleep (dwMilliseconds=0xa) [0242.219] timeGetTime () returned 0x4ea8a [0242.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.219] Sleep (dwMilliseconds=0xa) [0242.234] timeGetTime () returned 0x4ea9a [0242.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.234] Sleep (dwMilliseconds=0xa) [0242.250] timeGetTime () returned 0x4eaa9 [0242.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.250] Sleep (dwMilliseconds=0xa) [0242.265] timeGetTime () returned 0x4eab9 [0242.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.265] Sleep (dwMilliseconds=0xa) [0242.281] timeGetTime () returned 0x4eac9 [0242.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.281] Sleep (dwMilliseconds=0xa) [0242.297] timeGetTime () returned 0x4ead8 [0242.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.297] Sleep (dwMilliseconds=0xa) [0242.312] timeGetTime () returned 0x4eae8 [0242.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.312] Sleep (dwMilliseconds=0xa) [0242.328] timeGetTime () returned 0x4eaf7 [0242.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.328] Sleep (dwMilliseconds=0xa) [0242.345] timeGetTime () returned 0x4eb08 [0242.345] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.345] Sleep (dwMilliseconds=0xa) [0242.359] timeGetTime () returned 0x4eb17 [0242.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.359] Sleep (dwMilliseconds=0xa) [0242.375] timeGetTime () returned 0x4eb26 [0242.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.375] Sleep (dwMilliseconds=0xa) [0242.390] timeGetTime () returned 0x4eb36 [0242.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.390] Sleep (dwMilliseconds=0xa) [0242.407] timeGetTime () returned 0x4eb46 [0242.407] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.407] Sleep (dwMilliseconds=0xa) [0242.422] timeGetTime () returned 0x4eb55 [0242.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.422] Sleep (dwMilliseconds=0xa) [0242.437] timeGetTime () returned 0x4eb65 [0242.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.437] Sleep (dwMilliseconds=0xa) [0242.453] timeGetTime () returned 0x4eb74 [0242.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.453] Sleep (dwMilliseconds=0xa) [0242.469] timeGetTime () returned 0x4eb84 [0242.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.469] Sleep (dwMilliseconds=0xa) [0242.484] timeGetTime () returned 0x4eb94 [0242.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.484] Sleep (dwMilliseconds=0xa) [0242.500] timeGetTime () returned 0x4eba3 [0242.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.500] Sleep (dwMilliseconds=0xa) [0242.516] timeGetTime () returned 0x4ebb3 [0242.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.516] Sleep (dwMilliseconds=0xa) [0242.531] timeGetTime () returned 0x4ebc3 [0242.531] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0242.531] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0242.531] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0242.531] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0242.531] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0242.532] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0242.532] RegCloseKey (hKey=0x240) returned 0x0 [0242.532] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0242.532] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0242.532] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0242.532] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0242.532] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0242.532] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0242.532] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0242.532] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0242.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0242.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0242.532] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0242.532] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0242.611] FreeLibrary (hLibModule=0x77150000) returned 1 [0242.611] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0242.611] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0242.611] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0242.612] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0242.612] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0242.612] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0242.612] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0242.612] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0242.612] timeGetTime () returned 0x4ec11 [0242.612] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.612] Sleep (dwMilliseconds=0xa) [0242.658] timeGetTime () returned 0x4ec40 [0242.659] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.659] Sleep (dwMilliseconds=0xa) [0242.703] timeGetTime () returned 0x4ec6e [0242.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.703] Sleep (dwMilliseconds=0xa) [0242.737] timeGetTime () returned 0x4ec90 [0242.737] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.737] Sleep (dwMilliseconds=0xa) [0242.782] timeGetTime () returned 0x4ecbd [0242.782] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.783] Sleep (dwMilliseconds=0xa) [0242.830] timeGetTime () returned 0x4eced [0242.830] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.830] Sleep (dwMilliseconds=0xa) [0242.864] timeGetTime () returned 0x4ed0b [0242.864] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.864] Sleep (dwMilliseconds=0xa) [0242.875] timeGetTime () returned 0x4ed1a [0242.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0242.875] TranslateMessage (lpMsg=0x8bf798) returned 0 [0242.875] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0242.875] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0242.875] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0242.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.875] Sleep (dwMilliseconds=0xa) [0242.891] timeGetTime () returned 0x4ed2a [0242.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.891] Sleep (dwMilliseconds=0xa) [0242.914] timeGetTime () returned 0x4ed3a [0242.914] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.914] Sleep (dwMilliseconds=0xa) [0242.949] timeGetTime () returned 0x4ed59 [0242.949] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.949] Sleep (dwMilliseconds=0xa) [0242.969] timeGetTime () returned 0x4ed78 [0242.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.969] Sleep (dwMilliseconds=0xa) [0242.985] timeGetTime () returned 0x4ed88 [0242.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0242.985] Sleep (dwMilliseconds=0xa) [0243.043] timeGetTime () returned 0x4edb7 [0243.043] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.043] Sleep (dwMilliseconds=0xa) [0243.062] timeGetTime () returned 0x4edd6 [0243.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.062] Sleep (dwMilliseconds=0xa) [0243.078] timeGetTime () returned 0x4ede5 [0243.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.078] Sleep (dwMilliseconds=0xa) [0243.094] timeGetTime () returned 0x4edf5 [0243.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.094] Sleep (dwMilliseconds=0xa) [0243.109] timeGetTime () returned 0x4ee05 [0243.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.109] Sleep (dwMilliseconds=0xa) [0243.125] timeGetTime () returned 0x4ee14 [0243.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.125] Sleep (dwMilliseconds=0xa) [0243.141] timeGetTime () returned 0x4ee24 [0243.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.141] Sleep (dwMilliseconds=0xa) [0243.156] timeGetTime () returned 0x4ee34 [0243.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.156] Sleep (dwMilliseconds=0xa) [0243.172] timeGetTime () returned 0x4ee43 [0243.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.172] Sleep (dwMilliseconds=0xa) [0243.187] timeGetTime () returned 0x4ee53 [0243.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.187] Sleep (dwMilliseconds=0xa) [0243.203] timeGetTime () returned 0x4ee62 [0243.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.203] Sleep (dwMilliseconds=0xa) [0243.219] timeGetTime () returned 0x4ee72 [0243.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.219] Sleep (dwMilliseconds=0xa) [0243.234] timeGetTime () returned 0x4ee82 [0243.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.234] Sleep (dwMilliseconds=0xa) [0243.250] timeGetTime () returned 0x4ee91 [0243.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.250] Sleep (dwMilliseconds=0xa) [0243.266] timeGetTime () returned 0x4eea1 [0243.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.266] Sleep (dwMilliseconds=0xa) [0243.281] timeGetTime () returned 0x4eeb1 [0243.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.281] Sleep (dwMilliseconds=0xa) [0243.297] timeGetTime () returned 0x4eec0 [0243.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.297] Sleep (dwMilliseconds=0xa) [0243.312] timeGetTime () returned 0x4eed0 [0243.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.312] Sleep (dwMilliseconds=0xa) [0243.329] timeGetTime () returned 0x4eee1 [0243.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.329] Sleep (dwMilliseconds=0xa) [0243.344] timeGetTime () returned 0x4eeef [0243.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.344] Sleep (dwMilliseconds=0xa) [0243.359] timeGetTime () returned 0x4eeff [0243.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.359] Sleep (dwMilliseconds=0xa) [0243.375] timeGetTime () returned 0x4ef0e [0243.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.375] Sleep (dwMilliseconds=0xa) [0243.390] timeGetTime () returned 0x4ef1e [0243.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.390] Sleep (dwMilliseconds=0xa) [0243.406] timeGetTime () returned 0x4ef2e [0243.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.406] Sleep (dwMilliseconds=0xa) [0243.422] timeGetTime () returned 0x4ef3d [0243.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.422] Sleep (dwMilliseconds=0xa) [0243.437] timeGetTime () returned 0x4ef4d [0243.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.437] Sleep (dwMilliseconds=0xa) [0243.453] timeGetTime () returned 0x4ef5c [0243.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.453] Sleep (dwMilliseconds=0xa) [0243.469] timeGetTime () returned 0x4ef6c [0243.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.469] Sleep (dwMilliseconds=0xa) [0243.484] timeGetTime () returned 0x4ef7c [0243.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.484] Sleep (dwMilliseconds=0xa) [0243.500] timeGetTime () returned 0x4ef8b [0243.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.500] Sleep (dwMilliseconds=0xa) [0243.516] timeGetTime () returned 0x4ef9b [0243.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.516] Sleep (dwMilliseconds=0xa) [0243.531] timeGetTime () returned 0x4efab [0243.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.531] Sleep (dwMilliseconds=0xa) [0243.547] timeGetTime () returned 0x4efba [0243.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.547] Sleep (dwMilliseconds=0xa) [0243.568] timeGetTime () returned 0x4efca [0243.568] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.568] Sleep (dwMilliseconds=0xa) [0243.594] timeGetTime () returned 0x4efe9 [0243.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.594] Sleep (dwMilliseconds=0xa) [0243.609] timeGetTime () returned 0x4eff9 [0243.609] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0243.610] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0243.610] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0243.610] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0243.610] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0243.610] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0243.610] RegCloseKey (hKey=0x240) returned 0x0 [0243.610] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0243.610] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0243.610] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0243.610] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0243.610] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0243.610] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0243.610] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0243.610] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0243.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0243.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0243.611] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0243.611] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0243.703] FreeLibrary (hLibModule=0x77150000) returned 1 [0243.703] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0243.703] TranslateMessage (lpMsg=0x8bf708) returned 0 [0243.703] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0243.703] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0243.703] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0243.703] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0243.704] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0243.704] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0243.704] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0243.704] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0243.704] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0243.704] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0243.704] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0243.704] timeGetTime () returned 0x4f056 [0243.704] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.704] Sleep (dwMilliseconds=0xa) [0243.750] timeGetTime () returned 0x4f085 [0243.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.750] Sleep (dwMilliseconds=0xa) [0243.797] timeGetTime () returned 0x4f0b4 [0243.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.797] Sleep (dwMilliseconds=0xa) [0243.847] timeGetTime () returned 0x4f0e3 [0243.847] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.848] Sleep (dwMilliseconds=0xa) [0243.890] timeGetTime () returned 0x4f112 [0243.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.890] Sleep (dwMilliseconds=0xa) [0243.938] timeGetTime () returned 0x4f141 [0243.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.938] Sleep (dwMilliseconds=0xa) [0243.953] timeGetTime () returned 0x4f150 [0243.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.953] Sleep (dwMilliseconds=0xa) [0243.975] timeGetTime () returned 0x4f160 [0243.975] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0243.975] Sleep (dwMilliseconds=0xa) [0244.008] timeGetTime () returned 0x4f17f [0244.008] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.008] Sleep (dwMilliseconds=0xa) [0244.054] timeGetTime () returned 0x4f1ae [0244.054] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.054] Sleep (dwMilliseconds=0xa) [0244.078] timeGetTime () returned 0x4f1cd [0244.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.078] Sleep (dwMilliseconds=0xa) [0244.094] timeGetTime () returned 0x4f1dd [0244.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.094] Sleep (dwMilliseconds=0xa) [0244.111] timeGetTime () returned 0x4f1ef [0244.111] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.111] Sleep (dwMilliseconds=0xa) [0244.125] timeGetTime () returned 0x4f1fc [0244.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.125] Sleep (dwMilliseconds=0xa) [0244.140] timeGetTime () returned 0x4f20c [0244.140] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.140] Sleep (dwMilliseconds=0xa) [0244.156] timeGetTime () returned 0x4f21c [0244.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.156] Sleep (dwMilliseconds=0xa) [0244.172] timeGetTime () returned 0x4f22b [0244.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.172] Sleep (dwMilliseconds=0xa) [0244.187] timeGetTime () returned 0x4f23b [0244.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.187] Sleep (dwMilliseconds=0xa) [0244.203] timeGetTime () returned 0x4f24a [0244.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.203] Sleep (dwMilliseconds=0xa) [0244.219] timeGetTime () returned 0x4f25a [0244.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.219] Sleep (dwMilliseconds=0xa) [0244.235] timeGetTime () returned 0x4f26a [0244.235] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.235] Sleep (dwMilliseconds=0xa) [0244.250] timeGetTime () returned 0x4f279 [0244.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.250] Sleep (dwMilliseconds=0xa) [0244.265] timeGetTime () returned 0x4f289 [0244.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.265] Sleep (dwMilliseconds=0xa) [0244.281] timeGetTime () returned 0x4f299 [0244.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.281] Sleep (dwMilliseconds=0xa) [0244.297] timeGetTime () returned 0x4f2a8 [0244.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.297] Sleep (dwMilliseconds=0xa) [0244.312] timeGetTime () returned 0x4f2b8 [0244.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.312] Sleep (dwMilliseconds=0xa) [0244.328] timeGetTime () returned 0x4f2c7 [0244.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.328] Sleep (dwMilliseconds=0xa) [0244.344] timeGetTime () returned 0x4f2d7 [0244.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.344] Sleep (dwMilliseconds=0xa) [0244.359] timeGetTime () returned 0x4f2e7 [0244.360] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.360] Sleep (dwMilliseconds=0xa) [0244.476] timeGetTime () returned 0x4f354 [0244.476] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0244.476] TranslateMessage (lpMsg=0x8bf798) returned 0 [0244.476] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0244.476] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0244.476] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0244.476] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.476] Sleep (dwMilliseconds=0xa) [0244.502] timeGetTime () returned 0x4f375 [0244.502] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.502] Sleep (dwMilliseconds=0xa) [0244.515] timeGetTime () returned 0x4f383 [0244.515] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.515] Sleep (dwMilliseconds=0xa) [0244.532] timeGetTime () returned 0x4f393 [0244.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.532] Sleep (dwMilliseconds=0xa) [0244.547] timeGetTime () returned 0x4f3a2 [0244.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.547] Sleep (dwMilliseconds=0xa) [0244.568] timeGetTime () returned 0x4f3b2 [0244.568] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.568] Sleep (dwMilliseconds=0xa) [0244.595] timeGetTime () returned 0x4f3d1 [0244.595] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.595] Sleep (dwMilliseconds=0xa) [0244.609] timeGetTime () returned 0x4f3e1 [0244.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.609] Sleep (dwMilliseconds=0xa) [0244.625] timeGetTime () returned 0x4f3f0 [0244.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.625] Sleep (dwMilliseconds=0xa) [0244.640] timeGetTime () returned 0x4f400 [0244.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.640] Sleep (dwMilliseconds=0xa) [0244.656] timeGetTime () returned 0x4f410 [0244.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.656] Sleep (dwMilliseconds=0xa) [0244.672] timeGetTime () returned 0x4f41f [0244.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.672] Sleep (dwMilliseconds=0xa) [0244.687] timeGetTime () returned 0x4f42f [0244.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.687] Sleep (dwMilliseconds=0xa) [0244.703] timeGetTime () returned 0x4f43e [0244.703] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0244.703] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0244.703] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0244.703] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0244.703] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0244.704] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0244.704] RegCloseKey (hKey=0x240) returned 0x0 [0244.704] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0244.704] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0244.704] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0244.704] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0244.704] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0244.704] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0244.704] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0244.704] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0244.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0244.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa98, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0244.704] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0244.704] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0244.813] FreeLibrary (hLibModule=0x77150000) returned 1 [0244.813] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0244.813] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0244.813] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0244.813] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0244.813] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0244.813] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0244.813] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0244.813] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0244.813] timeGetTime () returned 0x4f4ac [0244.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.814] Sleep (dwMilliseconds=0xa) [0244.859] timeGetTime () returned 0x4f4db [0244.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.859] Sleep (dwMilliseconds=0xa) [0244.906] timeGetTime () returned 0x4f50a [0244.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.906] Sleep (dwMilliseconds=0xa) [0244.949] timeGetTime () returned 0x4f529 [0244.949] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.949] Sleep (dwMilliseconds=0xa) [0244.984] timeGetTime () returned 0x4f558 [0244.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0244.984] Sleep (dwMilliseconds=0xa) [0245.032] timeGetTime () returned 0x4f587 [0245.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.032] Sleep (dwMilliseconds=0xa) [0245.047] timeGetTime () returned 0x4f596 [0245.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.047] Sleep (dwMilliseconds=0xa) [0245.110] timeGetTime () returned 0x4f5d5 [0245.110] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.110] Sleep (dwMilliseconds=0xa) [0245.134] timeGetTime () returned 0x4f5e4 [0245.134] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.134] Sleep (dwMilliseconds=0xa) [0245.158] timeGetTime () returned 0x4f604 [0245.158] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.158] Sleep (dwMilliseconds=0xa) [0245.172] timeGetTime () returned 0x4f613 [0245.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.172] Sleep (dwMilliseconds=0xa) [0245.187] timeGetTime () returned 0x4f623 [0245.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.187] Sleep (dwMilliseconds=0xa) [0245.203] timeGetTime () returned 0x4f632 [0245.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.203] Sleep (dwMilliseconds=0xa) [0245.219] timeGetTime () returned 0x4f642 [0245.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0245.219] TranslateMessage (lpMsg=0x8bf798) returned 0 [0245.219] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0245.219] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0245.219] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0245.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.219] Sleep (dwMilliseconds=0xa) [0245.234] timeGetTime () returned 0x4f652 [0245.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.234] Sleep (dwMilliseconds=0xa) [0245.250] timeGetTime () returned 0x4f661 [0245.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.250] Sleep (dwMilliseconds=0xa) [0245.265] timeGetTime () returned 0x4f671 [0245.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.265] Sleep (dwMilliseconds=0xa) [0245.281] timeGetTime () returned 0x4f681 [0245.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.281] Sleep (dwMilliseconds=0xa) [0245.297] timeGetTime () returned 0x4f690 [0245.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.297] Sleep (dwMilliseconds=0xa) [0245.312] timeGetTime () returned 0x4f6a0 [0245.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.312] Sleep (dwMilliseconds=0xa) [0245.328] timeGetTime () returned 0x4f6af [0245.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.328] Sleep (dwMilliseconds=0xa) [0245.344] timeGetTime () returned 0x4f6bf [0245.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.344] Sleep (dwMilliseconds=0xa) [0245.359] timeGetTime () returned 0x4f6cf [0245.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.360] Sleep (dwMilliseconds=0xa) [0245.376] timeGetTime () returned 0x4f6de [0245.376] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.376] Sleep (dwMilliseconds=0xa) [0245.390] timeGetTime () returned 0x4f6ee [0245.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.390] Sleep (dwMilliseconds=0xa) [0245.406] timeGetTime () returned 0x4f6fe [0245.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.406] Sleep (dwMilliseconds=0xa) [0245.422] timeGetTime () returned 0x4f70d [0245.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.422] Sleep (dwMilliseconds=0xa) [0245.437] timeGetTime () returned 0x4f71d [0245.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.437] Sleep (dwMilliseconds=0xa) [0245.453] timeGetTime () returned 0x4f72c [0245.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.453] Sleep (dwMilliseconds=0xa) [0245.469] timeGetTime () returned 0x4f73c [0245.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.469] Sleep (dwMilliseconds=0xa) [0245.484] timeGetTime () returned 0x4f74c [0245.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.484] Sleep (dwMilliseconds=0xa) [0245.500] timeGetTime () returned 0x4f75b [0245.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.500] Sleep (dwMilliseconds=0xa) [0245.515] timeGetTime () returned 0x4f76b [0245.515] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.516] Sleep (dwMilliseconds=0xa) [0245.531] timeGetTime () returned 0x4f77b [0245.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.531] Sleep (dwMilliseconds=0xa) [0245.547] timeGetTime () returned 0x4f78a [0245.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.547] Sleep (dwMilliseconds=0xa) [0245.570] timeGetTime () returned 0x4f79a [0245.570] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.570] Sleep (dwMilliseconds=0xa) [0245.594] timeGetTime () returned 0x4f7b9 [0245.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.594] Sleep (dwMilliseconds=0xa) [0245.610] timeGetTime () returned 0x4f7c9 [0245.610] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.610] Sleep (dwMilliseconds=0xa) [0245.625] timeGetTime () returned 0x4f7d8 [0245.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.625] Sleep (dwMilliseconds=0xa) [0245.640] timeGetTime () returned 0x4f7e8 [0245.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.641] Sleep (dwMilliseconds=0xa) [0245.656] timeGetTime () returned 0x4f7f8 [0245.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.656] Sleep (dwMilliseconds=0xa) [0245.672] timeGetTime () returned 0x4f807 [0245.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.672] Sleep (dwMilliseconds=0xa) [0245.687] timeGetTime () returned 0x4f817 [0245.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.687] Sleep (dwMilliseconds=0xa) [0245.703] timeGetTime () returned 0x4f827 [0245.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.703] Sleep (dwMilliseconds=0xa) [0245.718] timeGetTime () returned 0x4f836 [0245.718] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.719] Sleep (dwMilliseconds=0xa) [0245.734] timeGetTime () returned 0x4f846 [0245.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.734] Sleep (dwMilliseconds=0xa) [0245.750] timeGetTime () returned 0x4f855 [0245.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.750] Sleep (dwMilliseconds=0xa) [0245.765] timeGetTime () returned 0x4f865 [0245.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.766] Sleep (dwMilliseconds=0xa) [0245.781] timeGetTime () returned 0x4f875 [0245.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.781] Sleep (dwMilliseconds=0xa) [0245.797] timeGetTime () returned 0x4f884 [0245.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.797] Sleep (dwMilliseconds=0xa) [0245.812] timeGetTime () returned 0x4f894 [0245.813] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0245.813] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0245.813] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0245.813] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0245.813] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0245.813] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0245.813] RegCloseKey (hKey=0x240) returned 0x0 [0245.813] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0245.813] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0245.813] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0245.813] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0245.813] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0245.813] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0245.813] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0245.813] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0245.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0245.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9b8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0245.814] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0245.814] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0245.906] FreeLibrary (hLibModule=0x77150000) returned 1 [0245.906] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0245.906] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0245.906] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0245.906] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0245.907] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0245.907] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0245.907] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0245.907] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0245.907] timeGetTime () returned 0x4f8f2 [0245.907] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.907] Sleep (dwMilliseconds=0xa) [0245.953] timeGetTime () returned 0x4f920 [0245.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0245.953] Sleep (dwMilliseconds=0xa) [0246.001] timeGetTime () returned 0x4f94f [0246.001] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0246.001] TranslateMessage (lpMsg=0x8bf798) returned 0 [0246.001] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0246.001] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0246.001] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0246.001] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.001] Sleep (dwMilliseconds=0xa) [0246.051] timeGetTime () returned 0x4f97e [0246.051] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.051] Sleep (dwMilliseconds=0xa) [0246.128] timeGetTime () returned 0x4f9cc [0246.128] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.128] Sleep (dwMilliseconds=0xa) [0246.175] timeGetTime () returned 0x4f9fb [0246.175] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.175] Sleep (dwMilliseconds=0xa) [0246.215] timeGetTime () returned 0x4fa1a [0246.215] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.215] Sleep (dwMilliseconds=0xa) [0246.235] timeGetTime () returned 0x4fa3a [0246.235] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.235] Sleep (dwMilliseconds=0xa) [0246.260] timeGetTime () returned 0x4fa49 [0246.260] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.260] Sleep (dwMilliseconds=0xa) [0246.293] timeGetTime () returned 0x4fa69 [0246.293] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.293] Sleep (dwMilliseconds=0xa) [0246.312] timeGetTime () returned 0x4fa88 [0246.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.312] Sleep (dwMilliseconds=0xa) [0246.328] timeGetTime () returned 0x4fa97 [0246.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.328] Sleep (dwMilliseconds=0xa) [0246.344] timeGetTime () returned 0x4faa7 [0246.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.344] Sleep (dwMilliseconds=0xa) [0246.359] timeGetTime () returned 0x4fab7 [0246.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.359] Sleep (dwMilliseconds=0xa) [0246.375] timeGetTime () returned 0x4fac6 [0246.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.375] Sleep (dwMilliseconds=0xa) [0246.390] timeGetTime () returned 0x4fad6 [0246.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.391] Sleep (dwMilliseconds=0xa) [0246.406] timeGetTime () returned 0x4fae6 [0246.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.406] Sleep (dwMilliseconds=0xa) [0246.422] timeGetTime () returned 0x4faf5 [0246.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.422] Sleep (dwMilliseconds=0xa) [0246.437] timeGetTime () returned 0x4fb05 [0246.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.437] Sleep (dwMilliseconds=0xa) [0246.453] timeGetTime () returned 0x4fb14 [0246.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.453] Sleep (dwMilliseconds=0xa) [0246.469] timeGetTime () returned 0x4fb24 [0246.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.469] Sleep (dwMilliseconds=0xa) [0246.484] timeGetTime () returned 0x4fb34 [0246.485] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.485] Sleep (dwMilliseconds=0xa) [0246.500] timeGetTime () returned 0x4fb43 [0246.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.500] Sleep (dwMilliseconds=0xa) [0246.516] timeGetTime () returned 0x4fb53 [0246.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.516] Sleep (dwMilliseconds=0xa) [0246.531] timeGetTime () returned 0x4fb63 [0246.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.531] Sleep (dwMilliseconds=0xa) [0246.547] timeGetTime () returned 0x4fb72 [0246.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.547] Sleep (dwMilliseconds=0xa) [0246.568] timeGetTime () returned 0x4fb82 [0246.568] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.568] Sleep (dwMilliseconds=0xa) [0246.593] timeGetTime () returned 0x4fba1 [0246.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.594] Sleep (dwMilliseconds=0xa) [0246.609] timeGetTime () returned 0x4fbb1 [0246.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.609] Sleep (dwMilliseconds=0xa) [0246.625] timeGetTime () returned 0x4fbc0 [0246.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.625] Sleep (dwMilliseconds=0xa) [0246.641] timeGetTime () returned 0x4fbd0 [0246.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.641] Sleep (dwMilliseconds=0xa) [0246.656] timeGetTime () returned 0x4fbe0 [0246.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.656] Sleep (dwMilliseconds=0xa) [0246.672] timeGetTime () returned 0x4fbef [0246.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.672] Sleep (dwMilliseconds=0xa) [0246.687] timeGetTime () returned 0x4fbff [0246.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.687] Sleep (dwMilliseconds=0xa) [0246.703] timeGetTime () returned 0x4fc0e [0246.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.703] Sleep (dwMilliseconds=0xa) [0246.720] timeGetTime () returned 0x4fc1e [0246.720] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.720] Sleep (dwMilliseconds=0xa) [0246.734] timeGetTime () returned 0x4fc2e [0246.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.734] Sleep (dwMilliseconds=0xa) [0246.751] timeGetTime () returned 0x4fc3f [0246.751] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0246.751] TranslateMessage (lpMsg=0x8bf798) returned 0 [0246.751] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0246.751] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0246.751] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0246.751] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.751] Sleep (dwMilliseconds=0xa) [0246.765] timeGetTime () returned 0x4fc4d [0246.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.765] Sleep (dwMilliseconds=0xa) [0246.781] timeGetTime () returned 0x4fc5d [0246.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.781] Sleep (dwMilliseconds=0xa) [0246.797] timeGetTime () returned 0x4fc6c [0246.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.797] Sleep (dwMilliseconds=0xa) [0246.813] timeGetTime () returned 0x4fc7c [0246.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.813] Sleep (dwMilliseconds=0xa) [0246.828] timeGetTime () returned 0x4fc8b [0246.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.828] Sleep (dwMilliseconds=0xa) [0246.844] timeGetTime () returned 0x4fc9b [0246.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.844] Sleep (dwMilliseconds=0xa) [0246.859] timeGetTime () returned 0x4fcab [0246.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.859] Sleep (dwMilliseconds=0xa) [0246.875] timeGetTime () returned 0x4fcba [0246.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.875] Sleep (dwMilliseconds=0xa) [0246.890] timeGetTime () returned 0x4fcca [0246.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0246.891] Sleep (dwMilliseconds=0xa) [0246.906] timeGetTime () returned 0x4fcda [0246.906] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0246.906] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0246.906] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0246.906] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0246.906] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0246.907] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0246.907] RegCloseKey (hKey=0x240) returned 0x0 [0246.907] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0246.907] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0246.907] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0246.907] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0246.907] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0246.907] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0246.907] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0246.907] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0246.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0246.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0246.908] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0246.908] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0247.000] FreeLibrary (hLibModule=0x77150000) returned 1 [0247.000] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0247.000] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0247.000] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0247.000] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0247.000] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0247.000] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.000] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0247.000] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0247.001] timeGetTime () returned 0x4fd37 [0247.001] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.001] Sleep (dwMilliseconds=0xa) [0247.047] timeGetTime () returned 0x4fd66 [0247.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.047] Sleep (dwMilliseconds=0xa) [0247.125] timeGetTime () returned 0x4fdb4 [0247.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.125] Sleep (dwMilliseconds=0xa) [0247.172] timeGetTime () returned 0x4fde3 [0247.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.172] Sleep (dwMilliseconds=0xa) [0247.218] timeGetTime () returned 0x4fe12 [0247.218] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.219] Sleep (dwMilliseconds=0xa) [0247.265] timeGetTime () returned 0x4fe41 [0247.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.265] Sleep (dwMilliseconds=0xa) [0247.296] timeGetTime () returned 0x4fe51 [0247.296] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.296] Sleep (dwMilliseconds=0xa) [0247.313] timeGetTime () returned 0x4fe70 [0247.313] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.313] Sleep (dwMilliseconds=0xa) [0247.328] timeGetTime () returned 0x4fe7f [0247.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.328] Sleep (dwMilliseconds=0xa) [0247.352] timeGetTime () returned 0x4fe8f [0247.352] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.352] Sleep (dwMilliseconds=0xa) [0247.379] timeGetTime () returned 0x4feae [0247.379] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.379] Sleep (dwMilliseconds=0xa) [0247.391] timeGetTime () returned 0x4febe [0247.391] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.391] Sleep (dwMilliseconds=0xa) [0247.406] timeGetTime () returned 0x4fece [0247.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.406] Sleep (dwMilliseconds=0xa) [0247.422] timeGetTime () returned 0x4fedd [0247.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.422] Sleep (dwMilliseconds=0xa) [0247.438] timeGetTime () returned 0x4feed [0247.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.438] Sleep (dwMilliseconds=0xa) [0247.453] timeGetTime () returned 0x4fefd [0247.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.453] Sleep (dwMilliseconds=0xa) [0247.468] timeGetTime () returned 0x4ff0c [0247.468] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.468] Sleep (dwMilliseconds=0xa) [0247.484] timeGetTime () returned 0x4ff1c [0247.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.484] Sleep (dwMilliseconds=0xa) [0247.500] timeGetTime () returned 0x4ff2b [0247.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.500] Sleep (dwMilliseconds=0xa) [0247.515] timeGetTime () returned 0x4ff3b [0247.515] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.516] Sleep (dwMilliseconds=0xa) [0247.532] timeGetTime () returned 0x4ff4b [0247.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0247.532] TranslateMessage (lpMsg=0x8bf798) returned 0 [0247.532] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0247.532] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0247.532] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0247.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.532] Sleep (dwMilliseconds=0xa) [0247.547] timeGetTime () returned 0x4ff5a [0247.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.547] Sleep (dwMilliseconds=0xa) [0247.568] timeGetTime () returned 0x4ff6a [0247.568] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.568] Sleep (dwMilliseconds=0xa) [0247.594] timeGetTime () returned 0x4ff89 [0247.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.594] Sleep (dwMilliseconds=0xa) [0247.609] timeGetTime () returned 0x4ff99 [0247.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.609] Sleep (dwMilliseconds=0xa) [0247.625] timeGetTime () returned 0x4ffa8 [0247.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.625] Sleep (dwMilliseconds=0xa) [0247.641] timeGetTime () returned 0x4ffb8 [0247.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.641] Sleep (dwMilliseconds=0xa) [0247.656] timeGetTime () returned 0x4ffc8 [0247.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.656] Sleep (dwMilliseconds=0xa) [0247.672] timeGetTime () returned 0x4ffd7 [0247.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.672] Sleep (dwMilliseconds=0xa) [0247.688] timeGetTime () returned 0x4ffe7 [0247.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.688] Sleep (dwMilliseconds=0xa) [0247.703] timeGetTime () returned 0x4fff6 [0247.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.703] Sleep (dwMilliseconds=0xa) [0247.719] timeGetTime () returned 0x50006 [0247.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.719] Sleep (dwMilliseconds=0xa) [0247.734] timeGetTime () returned 0x50016 [0247.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.734] Sleep (dwMilliseconds=0xa) [0247.750] timeGetTime () returned 0x50025 [0247.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.750] Sleep (dwMilliseconds=0xa) [0247.765] timeGetTime () returned 0x50035 [0247.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.765] Sleep (dwMilliseconds=0xa) [0247.781] timeGetTime () returned 0x50045 [0247.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.781] Sleep (dwMilliseconds=0xa) [0247.797] timeGetTime () returned 0x50054 [0247.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.797] Sleep (dwMilliseconds=0xa) [0247.813] timeGetTime () returned 0x50064 [0247.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.813] Sleep (dwMilliseconds=0xa) [0247.828] timeGetTime () returned 0x50073 [0247.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.828] Sleep (dwMilliseconds=0xa) [0247.844] timeGetTime () returned 0x50083 [0247.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.844] Sleep (dwMilliseconds=0xa) [0247.861] timeGetTime () returned 0x50094 [0247.861] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.861] Sleep (dwMilliseconds=0xa) [0247.875] timeGetTime () returned 0x500a2 [0247.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.875] Sleep (dwMilliseconds=0xa) [0247.890] timeGetTime () returned 0x500b2 [0247.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.891] Sleep (dwMilliseconds=0xa) [0247.906] timeGetTime () returned 0x500c2 [0247.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.906] Sleep (dwMilliseconds=0xa) [0247.922] timeGetTime () returned 0x500d1 [0247.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.922] Sleep (dwMilliseconds=0xa) [0247.939] timeGetTime () returned 0x500e1 [0247.939] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.939] Sleep (dwMilliseconds=0xa) [0247.953] timeGetTime () returned 0x500f0 [0247.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.953] Sleep (dwMilliseconds=0xa) [0247.969] timeGetTime () returned 0x50100 [0247.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.969] Sleep (dwMilliseconds=0xa) [0247.984] timeGetTime () returned 0x50110 [0247.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0247.984] Sleep (dwMilliseconds=0xa) [0248.000] timeGetTime () returned 0x5011f [0248.000] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0248.000] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0248.000] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.001] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0248.001] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0248.001] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0248.001] RegCloseKey (hKey=0x240) returned 0x0 [0248.001] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0248.001] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0248.001] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0248.001] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0248.001] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0248.001] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0248.001] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0248.001] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0248.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0248.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9b8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0248.002] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0248.002] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0248.123] FreeLibrary (hLibModule=0x77150000) returned 1 [0248.123] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0248.123] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0248.123] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0248.123] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0248.123] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0248.123] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.123] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0248.124] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0248.124] timeGetTime () returned 0x5018d [0248.124] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.124] Sleep (dwMilliseconds=0xa) [0248.172] timeGetTime () returned 0x501cb [0248.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.172] Sleep (dwMilliseconds=0xa) [0248.219] timeGetTime () returned 0x501fa [0248.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.219] Sleep (dwMilliseconds=0xa) [0248.265] timeGetTime () returned 0x50229 [0248.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.266] Sleep (dwMilliseconds=0xa) [0248.300] timeGetTime () returned 0x50248 [0248.300] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0248.300] TranslateMessage (lpMsg=0x8bf798) returned 0 [0248.300] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0248.300] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0248.300] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0248.300] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.300] Sleep (dwMilliseconds=0xa) [0248.344] timeGetTime () returned 0x50277 [0248.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.344] Sleep (dwMilliseconds=0xa) [0248.390] timeGetTime () returned 0x502a6 [0248.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.390] Sleep (dwMilliseconds=0xa) [0248.423] timeGetTime () returned 0x502c5 [0248.424] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.424] Sleep (dwMilliseconds=0xa) [0248.438] timeGetTime () returned 0x502d5 [0248.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.438] Sleep (dwMilliseconds=0xa) [0248.464] timeGetTime () returned 0x502e4 [0248.464] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.464] Sleep (dwMilliseconds=0xa) [0248.497] timeGetTime () returned 0x50304 [0248.497] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.497] Sleep (dwMilliseconds=0xa) [0248.516] timeGetTime () returned 0x50323 [0248.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.516] Sleep (dwMilliseconds=0xa) [0248.531] timeGetTime () returned 0x50333 [0248.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.531] Sleep (dwMilliseconds=0xa) [0248.549] timeGetTime () returned 0x50344 [0248.549] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.549] Sleep (dwMilliseconds=0xa) [0248.571] timeGetTime () returned 0x50352 [0248.571] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.572] Sleep (dwMilliseconds=0xa) [0248.594] timeGetTime () returned 0x50371 [0248.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.594] Sleep (dwMilliseconds=0xa) [0248.610] timeGetTime () returned 0x50381 [0248.610] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.610] Sleep (dwMilliseconds=0xa) [0248.625] timeGetTime () returned 0x50390 [0248.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.625] Sleep (dwMilliseconds=0xa) [0248.640] timeGetTime () returned 0x503a0 [0248.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.641] Sleep (dwMilliseconds=0xa) [0248.656] timeGetTime () returned 0x503b0 [0248.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.656] Sleep (dwMilliseconds=0xa) [0248.673] timeGetTime () returned 0x503bf [0248.673] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.673] Sleep (dwMilliseconds=0xa) [0248.687] timeGetTime () returned 0x503cf [0248.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.687] Sleep (dwMilliseconds=0xa) [0248.703] timeGetTime () returned 0x503de [0248.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.703] Sleep (dwMilliseconds=0xa) [0248.719] timeGetTime () returned 0x503ee [0248.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.719] Sleep (dwMilliseconds=0xa) [0248.735] timeGetTime () returned 0x503fe [0248.735] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.735] Sleep (dwMilliseconds=0xa) [0248.750] timeGetTime () returned 0x5040d [0248.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.750] Sleep (dwMilliseconds=0xa) [0248.766] timeGetTime () returned 0x5041d [0248.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.766] Sleep (dwMilliseconds=0xa) [0248.781] timeGetTime () returned 0x5042d [0248.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.781] Sleep (dwMilliseconds=0xa) [0248.797] timeGetTime () returned 0x5043c [0248.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.797] Sleep (dwMilliseconds=0xa) [0248.813] timeGetTime () returned 0x5044c [0248.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.813] Sleep (dwMilliseconds=0xa) [0248.828] timeGetTime () returned 0x5045b [0248.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.828] Sleep (dwMilliseconds=0xa) [0248.844] timeGetTime () returned 0x5046b [0248.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.844] Sleep (dwMilliseconds=0xa) [0248.860] timeGetTime () returned 0x5047b [0248.860] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.860] Sleep (dwMilliseconds=0xa) [0248.877] timeGetTime () returned 0x5048c [0248.877] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.877] Sleep (dwMilliseconds=0xa) [0248.891] timeGetTime () returned 0x5049a [0248.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.891] Sleep (dwMilliseconds=0xa) [0248.906] timeGetTime () returned 0x504aa [0248.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.906] Sleep (dwMilliseconds=0xa) [0248.922] timeGetTime () returned 0x504b9 [0248.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.922] Sleep (dwMilliseconds=0xa) [0248.937] timeGetTime () returned 0x504c9 [0248.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.937] Sleep (dwMilliseconds=0xa) [0248.954] timeGetTime () returned 0x504d8 [0248.954] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.954] Sleep (dwMilliseconds=0xa) [0248.968] timeGetTime () returned 0x504e8 [0248.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.969] Sleep (dwMilliseconds=0xa) [0248.984] timeGetTime () returned 0x504f8 [0248.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0248.984] Sleep (dwMilliseconds=0xa) [0249.000] timeGetTime () returned 0x50507 [0249.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.000] Sleep (dwMilliseconds=0xa) [0249.015] timeGetTime () returned 0x50517 [0249.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.015] Sleep (dwMilliseconds=0xa) [0249.031] timeGetTime () returned 0x50527 [0249.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.031] Sleep (dwMilliseconds=0xa) [0249.047] timeGetTime () returned 0x50536 [0249.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0249.047] TranslateMessage (lpMsg=0x8bf798) returned 0 [0249.047] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0249.047] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0249.047] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0249.048] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.048] Sleep (dwMilliseconds=0xa) [0249.062] timeGetTime () returned 0x50546 [0249.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.062] Sleep (dwMilliseconds=0xa) [0249.078] timeGetTime () returned 0x50555 [0249.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.078] Sleep (dwMilliseconds=0xa) [0249.094] timeGetTime () returned 0x50565 [0249.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.094] Sleep (dwMilliseconds=0xa) [0249.109] timeGetTime () returned 0x50575 [0249.109] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0249.109] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0249.110] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.110] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0249.110] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0249.110] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0249.110] RegCloseKey (hKey=0x240) returned 0x0 [0249.110] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0249.110] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0249.110] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0249.110] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0249.110] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0249.110] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0249.110] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0249.110] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0249.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0249.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0249.111] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0249.111] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0249.219] FreeLibrary (hLibModule=0x77150000) returned 1 [0249.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0249.219] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0249.219] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0249.219] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0249.219] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0249.219] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.219] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0249.219] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0249.219] timeGetTime () returned 0x505e2 [0249.220] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.220] Sleep (dwMilliseconds=0xa) [0249.268] timeGetTime () returned 0x50613 [0249.268] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.268] Sleep (dwMilliseconds=0xa) [0249.313] timeGetTime () returned 0x50640 [0249.313] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.313] Sleep (dwMilliseconds=0xa) [0249.359] timeGetTime () returned 0x5066f [0249.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.359] Sleep (dwMilliseconds=0xa) [0249.406] timeGetTime () returned 0x5069e [0249.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.406] Sleep (dwMilliseconds=0xa) [0249.453] timeGetTime () returned 0x506cc [0249.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.453] Sleep (dwMilliseconds=0xa) [0249.496] timeGetTime () returned 0x506ec [0249.496] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.496] Sleep (dwMilliseconds=0xa) [0249.516] timeGetTime () returned 0x5070b [0249.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.516] Sleep (dwMilliseconds=0xa) [0249.531] timeGetTime () returned 0x5071b [0249.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.531] Sleep (dwMilliseconds=0xa) [0249.559] timeGetTime () returned 0x5072a [0249.559] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.559] Sleep (dwMilliseconds=0xa) [0249.589] timeGetTime () returned 0x50749 [0249.589] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.589] Sleep (dwMilliseconds=0xa) [0249.634] timeGetTime () returned 0x50778 [0249.634] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.634] Sleep (dwMilliseconds=0xa) [0249.656] timeGetTime () returned 0x50798 [0249.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.656] Sleep (dwMilliseconds=0xa) [0249.674] timeGetTime () returned 0x507a7 [0249.674] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.674] Sleep (dwMilliseconds=0xa) [0249.688] timeGetTime () returned 0x507b7 [0249.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.688] Sleep (dwMilliseconds=0xa) [0249.703] timeGetTime () returned 0x507c6 [0249.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.703] Sleep (dwMilliseconds=0xa) [0249.719] timeGetTime () returned 0x507d6 [0249.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.719] Sleep (dwMilliseconds=0xa) [0249.734] timeGetTime () returned 0x507e6 [0249.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.734] Sleep (dwMilliseconds=0xa) [0249.750] timeGetTime () returned 0x507f5 [0249.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.750] Sleep (dwMilliseconds=0xa) [0249.766] timeGetTime () returned 0x50805 [0249.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.766] Sleep (dwMilliseconds=0xa) [0249.785] timeGetTime () returned 0x50815 [0249.785] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.785] Sleep (dwMilliseconds=0xa) [0249.797] timeGetTime () returned 0x50824 [0249.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0249.797] TranslateMessage (lpMsg=0x8bf798) returned 0 [0249.797] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0249.797] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0249.797] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0249.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.797] Sleep (dwMilliseconds=0xa) [0249.813] timeGetTime () returned 0x50834 [0249.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.813] Sleep (dwMilliseconds=0xa) [0249.828] timeGetTime () returned 0x50843 [0249.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.828] Sleep (dwMilliseconds=0xa) [0249.844] timeGetTime () returned 0x50853 [0249.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.844] Sleep (dwMilliseconds=0xa) [0249.859] timeGetTime () returned 0x50863 [0249.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.859] Sleep (dwMilliseconds=0xa) [0249.875] timeGetTime () returned 0x50872 [0249.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.875] Sleep (dwMilliseconds=0xa) [0249.890] timeGetTime () returned 0x50882 [0249.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.890] Sleep (dwMilliseconds=0xa) [0249.907] timeGetTime () returned 0x50892 [0249.907] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.907] Sleep (dwMilliseconds=0xa) [0249.922] timeGetTime () returned 0x508a1 [0249.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.922] Sleep (dwMilliseconds=0xa) [0249.938] timeGetTime () returned 0x508b1 [0249.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.938] Sleep (dwMilliseconds=0xa) [0249.954] timeGetTime () returned 0x508c0 [0249.954] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.954] Sleep (dwMilliseconds=0xa) [0249.969] timeGetTime () returned 0x508d0 [0249.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.969] Sleep (dwMilliseconds=0xa) [0249.984] timeGetTime () returned 0x508e0 [0249.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0249.984] Sleep (dwMilliseconds=0xa) [0250.001] timeGetTime () returned 0x508ef [0250.001] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.001] Sleep (dwMilliseconds=0xa) [0250.015] timeGetTime () returned 0x508ff [0250.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.015] Sleep (dwMilliseconds=0xa) [0250.031] timeGetTime () returned 0x5090f [0250.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.031] Sleep (dwMilliseconds=0xa) [0250.047] timeGetTime () returned 0x5091e [0250.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.047] Sleep (dwMilliseconds=0xa) [0250.062] timeGetTime () returned 0x5092e [0250.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.063] Sleep (dwMilliseconds=0xa) [0250.078] timeGetTime () returned 0x5093d [0250.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.078] Sleep (dwMilliseconds=0xa) [0250.094] timeGetTime () returned 0x5094d [0250.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.094] Sleep (dwMilliseconds=0xa) [0250.109] timeGetTime () returned 0x5095d [0250.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.109] Sleep (dwMilliseconds=0xa) [0250.125] timeGetTime () returned 0x5096c [0250.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.125] Sleep (dwMilliseconds=0xa) [0250.159] timeGetTime () returned 0x5098c [0250.159] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.159] Sleep (dwMilliseconds=0xa) [0250.172] timeGetTime () returned 0x5099b [0250.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.172] Sleep (dwMilliseconds=0xa) [0250.187] timeGetTime () returned 0x509ab [0250.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.187] Sleep (dwMilliseconds=0xa) [0250.203] timeGetTime () returned 0x509ba [0250.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.203] Sleep (dwMilliseconds=0xa) [0250.219] timeGetTime () returned 0x509ca [0250.219] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0250.219] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0250.219] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.219] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0250.220] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0250.220] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0250.220] RegCloseKey (hKey=0x240) returned 0x0 [0250.220] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0250.220] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0250.220] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0250.220] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0250.220] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0250.220] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0250.220] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0250.220] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0250.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0250.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9f8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0250.221] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0250.221] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0250.328] FreeLibrary (hLibModule=0x77150000) returned 1 [0250.328] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0250.328] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0250.328] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0250.328] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0250.328] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0250.328] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.328] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0250.329] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0250.329] timeGetTime () returned 0x50a37 [0250.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.329] Sleep (dwMilliseconds=0xa) [0250.375] timeGetTime () returned 0x50a66 [0250.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.375] Sleep (dwMilliseconds=0xa) [0250.422] timeGetTime () returned 0x50a95 [0250.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.422] Sleep (dwMilliseconds=0xa) [0250.471] timeGetTime () returned 0x50ac4 [0250.471] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.471] Sleep (dwMilliseconds=0xa) [0250.516] timeGetTime () returned 0x50af3 [0250.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.516] Sleep (dwMilliseconds=0xa) [0250.569] timeGetTime () returned 0x50b28 [0250.569] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0250.569] TranslateMessage (lpMsg=0x8bf798) returned 0 [0250.569] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0250.569] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0250.569] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0250.569] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.570] Sleep (dwMilliseconds=0xa) [0250.604] timeGetTime () returned 0x50b41 [0250.604] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.604] Sleep (dwMilliseconds=0xa) [0250.625] timeGetTime () returned 0x50b60 [0250.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.625] Sleep (dwMilliseconds=0xa) [0250.640] timeGetTime () returned 0x50b70 [0250.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.640] Sleep (dwMilliseconds=0xa) [0250.666] timeGetTime () returned 0x50b80 [0250.666] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.666] Sleep (dwMilliseconds=0xa) [0250.703] timeGetTime () returned 0x50baf [0250.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.703] Sleep (dwMilliseconds=0xa) [0250.719] timeGetTime () returned 0x50bbe [0250.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.719] Sleep (dwMilliseconds=0xa) [0250.734] timeGetTime () returned 0x50bce [0250.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.734] Sleep (dwMilliseconds=0xa) [0250.750] timeGetTime () returned 0x50bdd [0250.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.750] Sleep (dwMilliseconds=0xa) [0250.766] timeGetTime () returned 0x50bed [0250.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.766] Sleep (dwMilliseconds=0xa) [0250.781] timeGetTime () returned 0x50bfd [0250.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.781] Sleep (dwMilliseconds=0xa) [0250.808] timeGetTime () returned 0x50c17 [0250.808] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.808] Sleep (dwMilliseconds=0xa) [0250.829] timeGetTime () returned 0x50c2c [0250.829] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.829] Sleep (dwMilliseconds=0xa) [0250.844] timeGetTime () returned 0x50c3b [0250.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.844] Sleep (dwMilliseconds=0xa) [0250.860] timeGetTime () returned 0x50c4b [0250.860] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.860] Sleep (dwMilliseconds=0xa) [0250.875] timeGetTime () returned 0x50c5a [0250.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.875] Sleep (dwMilliseconds=0xa) [0250.892] timeGetTime () returned 0x50c6b [0250.892] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.892] Sleep (dwMilliseconds=0xa) [0250.906] timeGetTime () returned 0x50c7a [0250.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.906] Sleep (dwMilliseconds=0xa) [0250.923] timeGetTime () returned 0x50c89 [0250.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.923] Sleep (dwMilliseconds=0xa) [0250.938] timeGetTime () returned 0x50c99 [0250.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.938] Sleep (dwMilliseconds=0xa) [0250.955] timeGetTime () returned 0x50ca8 [0250.955] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.955] Sleep (dwMilliseconds=0xa) [0250.968] timeGetTime () returned 0x50cb8 [0250.968] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.969] Sleep (dwMilliseconds=0xa) [0250.985] timeGetTime () returned 0x50cc8 [0250.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0250.985] Sleep (dwMilliseconds=0xa) [0251.000] timeGetTime () returned 0x50cd7 [0251.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.000] Sleep (dwMilliseconds=0xa) [0251.017] timeGetTime () returned 0x50ce7 [0251.017] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.017] Sleep (dwMilliseconds=0xa) [0251.031] timeGetTime () returned 0x50cf7 [0251.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.031] Sleep (dwMilliseconds=0xa) [0251.047] timeGetTime () returned 0x50d06 [0251.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.047] Sleep (dwMilliseconds=0xa) [0251.063] timeGetTime () returned 0x50d16 [0251.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.063] Sleep (dwMilliseconds=0xa) [0251.079] timeGetTime () returned 0x50d25 [0251.079] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.079] Sleep (dwMilliseconds=0xa) [0251.093] timeGetTime () returned 0x50d35 [0251.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.094] Sleep (dwMilliseconds=0xa) [0251.109] timeGetTime () returned 0x50d45 [0251.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.109] Sleep (dwMilliseconds=0xa) [0251.126] timeGetTime () returned 0x50d55 [0251.126] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.126] Sleep (dwMilliseconds=0xa) [0251.141] timeGetTime () returned 0x50d64 [0251.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.141] Sleep (dwMilliseconds=0xa) [0251.156] timeGetTime () returned 0x50d74 [0251.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.156] Sleep (dwMilliseconds=0xa) [0251.194] timeGetTime () returned 0x50d93 [0251.195] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.195] Sleep (dwMilliseconds=0xa) [0251.218] timeGetTime () returned 0x50db2 [0251.218] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.219] Sleep (dwMilliseconds=0xa) [0251.234] timeGetTime () returned 0x50dc2 [0251.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.234] Sleep (dwMilliseconds=0xa) [0251.250] timeGetTime () returned 0x50dd1 [0251.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.250] Sleep (dwMilliseconds=0xa) [0251.266] timeGetTime () returned 0x50de1 [0251.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.266] Sleep (dwMilliseconds=0xa) [0251.281] timeGetTime () returned 0x50df1 [0251.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.281] Sleep (dwMilliseconds=0xa) [0251.297] timeGetTime () returned 0x50e00 [0251.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.297] Sleep (dwMilliseconds=0xa) [0251.312] timeGetTime () returned 0x50e10 [0251.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.312] Sleep (dwMilliseconds=0xa) [0251.328] timeGetTime () returned 0x50e20 [0251.329] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 1 [0251.329] TranslateMessage (lpMsg=0x8bf968) returned 0 [0251.329] DispatchMessageW (lpMsg=0x8bf968) returned 0x0 [0251.329] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0251.329] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0251.329] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0251.329] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0251.329] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.329] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0251.329] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0251.329] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0251.329] RegCloseKey (hKey=0x240) returned 0x0 [0251.329] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0251.329] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0251.329] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0251.330] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0251.330] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0251.330] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0251.330] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0251.330] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0251.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0251.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0251.330] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0251.330] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0251.422] FreeLibrary (hLibModule=0x77150000) returned 1 [0251.422] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0251.422] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0251.422] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0251.422] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0251.422] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0251.422] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.423] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0251.423] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0251.423] timeGetTime () returned 0x50e7d [0251.423] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.423] Sleep (dwMilliseconds=0xa) [0251.469] timeGetTime () returned 0x50eac [0251.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.469] Sleep (dwMilliseconds=0xa) [0251.515] timeGetTime () returned 0x50edb [0251.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.516] Sleep (dwMilliseconds=0xa) [0251.572] timeGetTime () returned 0x50f0a [0251.572] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.572] Sleep (dwMilliseconds=0xa) [0251.610] timeGetTime () returned 0x50f39 [0251.610] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.610] Sleep (dwMilliseconds=0xa) [0251.656] timeGetTime () returned 0x50f68 [0251.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.656] Sleep (dwMilliseconds=0xa) [0251.687] timeGetTime () returned 0x50f87 [0251.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.687] Sleep (dwMilliseconds=0xa) [0251.704] timeGetTime () returned 0x50f96 [0251.704] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.704] Sleep (dwMilliseconds=0xa) [0251.738] timeGetTime () returned 0x50fb6 [0251.739] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.739] Sleep (dwMilliseconds=0xa) [0251.750] timeGetTime () returned 0x50fc5 [0251.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.750] Sleep (dwMilliseconds=0xa) [0251.777] timeGetTime () returned 0x50fd5 [0251.777] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.777] Sleep (dwMilliseconds=0xa) [0251.809] timeGetTime () returned 0x50ff5 [0251.809] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.809] Sleep (dwMilliseconds=0xa) [0251.828] timeGetTime () returned 0x51013 [0251.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.828] Sleep (dwMilliseconds=0xa) [0251.844] timeGetTime () returned 0x51023 [0251.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.844] Sleep (dwMilliseconds=0xa) [0251.860] timeGetTime () returned 0x51033 [0251.860] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.860] Sleep (dwMilliseconds=0xa) [0251.875] timeGetTime () returned 0x51042 [0251.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.875] Sleep (dwMilliseconds=0xa) [0251.890] timeGetTime () returned 0x51052 [0251.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.890] Sleep (dwMilliseconds=0xa) [0251.906] timeGetTime () returned 0x51062 [0251.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.906] Sleep (dwMilliseconds=0xa) [0251.922] timeGetTime () returned 0x51071 [0251.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.922] Sleep (dwMilliseconds=0xa) [0251.937] timeGetTime () returned 0x51081 [0251.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.937] Sleep (dwMilliseconds=0xa) [0251.954] timeGetTime () returned 0x51090 [0251.954] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.954] Sleep (dwMilliseconds=0xa) [0251.969] timeGetTime () returned 0x510a0 [0251.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.969] Sleep (dwMilliseconds=0xa) [0251.984] timeGetTime () returned 0x510b0 [0251.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0251.985] Sleep (dwMilliseconds=0xa) [0252.006] timeGetTime () returned 0x510bf [0252.006] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.006] Sleep (dwMilliseconds=0xa) [0252.031] timeGetTime () returned 0x510df [0252.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.031] Sleep (dwMilliseconds=0xa) [0252.047] timeGetTime () returned 0x510ee [0252.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.047] Sleep (dwMilliseconds=0xa) [0252.063] timeGetTime () returned 0x510fe [0252.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.063] Sleep (dwMilliseconds=0xa) [0252.078] timeGetTime () returned 0x5110d [0252.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0252.078] TranslateMessage (lpMsg=0x8bf798) returned 0 [0252.078] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0252.078] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0252.079] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0252.079] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.079] Sleep (dwMilliseconds=0xa) [0252.095] timeGetTime () returned 0x5111d [0252.095] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.095] Sleep (dwMilliseconds=0xa) [0252.109] timeGetTime () returned 0x5112d [0252.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.109] Sleep (dwMilliseconds=0xa) [0252.125] timeGetTime () returned 0x5113c [0252.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.125] Sleep (dwMilliseconds=0xa) [0252.140] timeGetTime () returned 0x5114c [0252.140] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.140] Sleep (dwMilliseconds=0xa) [0252.156] timeGetTime () returned 0x5115c [0252.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.156] Sleep (dwMilliseconds=0xa) [0252.191] timeGetTime () returned 0x5117b [0252.191] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.191] Sleep (dwMilliseconds=0xa) [0252.203] timeGetTime () returned 0x5118a [0252.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.203] Sleep (dwMilliseconds=0xa) [0252.219] timeGetTime () returned 0x5119a [0252.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.219] Sleep (dwMilliseconds=0xa) [0252.234] timeGetTime () returned 0x511aa [0252.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.234] Sleep (dwMilliseconds=0xa) [0252.250] timeGetTime () returned 0x511b9 [0252.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.250] Sleep (dwMilliseconds=0xa) [0252.265] timeGetTime () returned 0x511c9 [0252.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.265] Sleep (dwMilliseconds=0xa) [0252.281] timeGetTime () returned 0x511d9 [0252.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.281] Sleep (dwMilliseconds=0xa) [0252.297] timeGetTime () returned 0x511e8 [0252.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.297] Sleep (dwMilliseconds=0xa) [0252.312] timeGetTime () returned 0x511f8 [0252.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.313] Sleep (dwMilliseconds=0xa) [0252.328] timeGetTime () returned 0x51207 [0252.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.328] Sleep (dwMilliseconds=0xa) [0252.344] timeGetTime () returned 0x51217 [0252.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.344] Sleep (dwMilliseconds=0xa) [0252.359] timeGetTime () returned 0x51227 [0252.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.359] Sleep (dwMilliseconds=0xa) [0252.375] timeGetTime () returned 0x51236 [0252.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.375] Sleep (dwMilliseconds=0xa) [0252.390] timeGetTime () returned 0x51246 [0252.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.390] Sleep (dwMilliseconds=0xa) [0252.406] timeGetTime () returned 0x51256 [0252.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.406] Sleep (dwMilliseconds=0xa) [0252.422] timeGetTime () returned 0x51265 [0252.422] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0252.422] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0252.422] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.422] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0252.422] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0252.422] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0252.422] RegCloseKey (hKey=0x240) returned 0x0 [0252.422] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0252.423] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0252.423] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0252.423] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0252.423] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0252.423] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0252.423] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0252.423] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0252.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0252.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0252.423] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0252.423] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0252.531] FreeLibrary (hLibModule=0x77150000) returned 1 [0252.531] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0252.531] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0252.531] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0252.531] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0252.532] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0252.532] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.532] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0252.532] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0252.532] timeGetTime () returned 0x512d3 [0252.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.532] Sleep (dwMilliseconds=0xa) [0252.578] timeGetTime () returned 0x51301 [0252.578] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.578] Sleep (dwMilliseconds=0xa) [0252.625] timeGetTime () returned 0x51330 [0252.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.625] Sleep (dwMilliseconds=0xa) [0252.672] timeGetTime () returned 0x5135f [0252.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.672] Sleep (dwMilliseconds=0xa) [0252.718] timeGetTime () returned 0x5138e [0252.718] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.718] Sleep (dwMilliseconds=0xa) [0252.765] timeGetTime () returned 0x513bd [0252.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.765] Sleep (dwMilliseconds=0xa) [0252.781] timeGetTime () returned 0x513cd [0252.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.781] Sleep (dwMilliseconds=0xa) [0252.797] timeGetTime () returned 0x513dc [0252.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.797] Sleep (dwMilliseconds=0xa) [0252.812] timeGetTime () returned 0x513ec [0252.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.812] Sleep (dwMilliseconds=0xa) [0252.837] timeGetTime () returned 0x513fc [0252.837] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0252.837] TranslateMessage (lpMsg=0x8bf798) returned 0 [0252.837] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0252.837] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0252.837] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0252.837] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.837] Sleep (dwMilliseconds=0xa) [0252.970] timeGetTime () returned 0x51488 [0252.970] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.970] Sleep (dwMilliseconds=0xa) [0252.984] timeGetTime () returned 0x51498 [0252.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0252.985] Sleep (dwMilliseconds=0xa) [0253.000] timeGetTime () returned 0x514a7 [0253.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.000] Sleep (dwMilliseconds=0xa) [0253.015] timeGetTime () returned 0x514b7 [0253.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.015] Sleep (dwMilliseconds=0xa) [0253.031] timeGetTime () returned 0x514c7 [0253.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.031] Sleep (dwMilliseconds=0xa) [0253.047] timeGetTime () returned 0x514d6 [0253.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.047] Sleep (dwMilliseconds=0xa) [0253.062] timeGetTime () returned 0x514e6 [0253.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.062] Sleep (dwMilliseconds=0xa) [0253.078] timeGetTime () returned 0x514f5 [0253.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.078] Sleep (dwMilliseconds=0xa) [0253.094] timeGetTime () returned 0x51505 [0253.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.094] Sleep (dwMilliseconds=0xa) [0253.109] timeGetTime () returned 0x51515 [0253.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.109] Sleep (dwMilliseconds=0xa) [0253.125] timeGetTime () returned 0x51524 [0253.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.125] Sleep (dwMilliseconds=0xa) [0253.140] timeGetTime () returned 0x51534 [0253.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.141] Sleep (dwMilliseconds=0xa) [0253.156] timeGetTime () returned 0x51544 [0253.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.156] Sleep (dwMilliseconds=0xa) [0253.191] timeGetTime () returned 0x51563 [0253.191] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.191] Sleep (dwMilliseconds=0xa) [0253.203] timeGetTime () returned 0x51572 [0253.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.203] Sleep (dwMilliseconds=0xa) [0253.219] timeGetTime () returned 0x51582 [0253.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.219] Sleep (dwMilliseconds=0xa) [0253.235] timeGetTime () returned 0x51593 [0253.235] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.235] Sleep (dwMilliseconds=0xa) [0253.250] timeGetTime () returned 0x515a1 [0253.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.250] Sleep (dwMilliseconds=0xa) [0253.266] timeGetTime () returned 0x515b1 [0253.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.266] Sleep (dwMilliseconds=0xa) [0253.282] timeGetTime () returned 0x515c1 [0253.282] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.282] Sleep (dwMilliseconds=0xa) [0253.297] timeGetTime () returned 0x515d1 [0253.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.297] Sleep (dwMilliseconds=0xa) [0253.312] timeGetTime () returned 0x515e0 [0253.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.312] Sleep (dwMilliseconds=0xa) [0253.328] timeGetTime () returned 0x515ef [0253.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.328] Sleep (dwMilliseconds=0xa) [0253.344] timeGetTime () returned 0x515ff [0253.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.344] Sleep (dwMilliseconds=0xa) [0253.360] timeGetTime () returned 0x5160f [0253.360] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.360] Sleep (dwMilliseconds=0xa) [0253.375] timeGetTime () returned 0x5161e [0253.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.375] Sleep (dwMilliseconds=0xa) [0253.390] timeGetTime () returned 0x5162e [0253.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.390] Sleep (dwMilliseconds=0xa) [0253.407] timeGetTime () returned 0x5163e [0253.407] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.407] Sleep (dwMilliseconds=0xa) [0253.424] timeGetTime () returned 0x5164d [0253.424] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.424] Sleep (dwMilliseconds=0xa) [0253.438] timeGetTime () returned 0x5165d [0253.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.438] Sleep (dwMilliseconds=0xa) [0253.453] timeGetTime () returned 0x5166c [0253.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.453] Sleep (dwMilliseconds=0xa) [0253.469] timeGetTime () returned 0x5167c [0253.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.469] Sleep (dwMilliseconds=0xa) [0253.484] timeGetTime () returned 0x5168c [0253.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.484] Sleep (dwMilliseconds=0xa) [0253.500] timeGetTime () returned 0x5169b [0253.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.500] Sleep (dwMilliseconds=0xa) [0253.516] timeGetTime () returned 0x516ab [0253.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.516] Sleep (dwMilliseconds=0xa) [0253.531] timeGetTime () returned 0x516bb [0253.531] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0253.531] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0253.531] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.532] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0253.532] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0253.532] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0253.532] RegCloseKey (hKey=0x240) returned 0x0 [0253.532] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0253.532] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0253.532] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0253.532] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0253.532] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0253.532] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0253.532] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0253.532] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0253.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0253.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ac78, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0253.533] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0253.533] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0253.609] FreeLibrary (hLibModule=0x77150000) returned 1 [0253.609] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0253.609] TranslateMessage (lpMsg=0x8bf708) returned 0 [0253.609] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0253.609] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0253.610] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0253.610] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0253.610] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0253.610] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0253.610] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0253.610] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0253.610] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.610] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0253.610] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0253.610] timeGetTime () returned 0x51709 [0253.610] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.610] Sleep (dwMilliseconds=0xa) [0253.656] timeGetTime () returned 0x51738 [0253.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.656] Sleep (dwMilliseconds=0xa) [0253.703] timeGetTime () returned 0x51766 [0253.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.703] Sleep (dwMilliseconds=0xa) [0253.753] timeGetTime () returned 0x51797 [0253.753] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.753] Sleep (dwMilliseconds=0xa) [0253.797] timeGetTime () returned 0x517c4 [0253.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.797] Sleep (dwMilliseconds=0xa) [0253.844] timeGetTime () returned 0x517f3 [0253.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.844] Sleep (dwMilliseconds=0xa) [0253.859] timeGetTime () returned 0x51803 [0253.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.860] Sleep (dwMilliseconds=0xa) [0253.882] timeGetTime () returned 0x51812 [0253.882] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.882] Sleep (dwMilliseconds=0xa) [0253.914] timeGetTime () returned 0x51832 [0253.914] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.914] Sleep (dwMilliseconds=0xa) [0253.947] timeGetTime () returned 0x51851 [0253.947] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.947] Sleep (dwMilliseconds=0xa) [0253.970] timeGetTime () returned 0x51870 [0253.970] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.970] Sleep (dwMilliseconds=0xa) [0253.984] timeGetTime () returned 0x51880 [0253.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0253.984] Sleep (dwMilliseconds=0xa) [0254.000] timeGetTime () returned 0x5188f [0254.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.000] Sleep (dwMilliseconds=0xa) [0254.015] timeGetTime () returned 0x5189f [0254.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.016] Sleep (dwMilliseconds=0xa) [0254.031] timeGetTime () returned 0x518af [0254.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.031] Sleep (dwMilliseconds=0xa) [0254.047] timeGetTime () returned 0x518be [0254.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.047] Sleep (dwMilliseconds=0xa) [0254.062] timeGetTime () returned 0x518ce [0254.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.063] Sleep (dwMilliseconds=0xa) [0254.079] timeGetTime () returned 0x518dd [0254.079] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.079] Sleep (dwMilliseconds=0xa) [0254.094] timeGetTime () returned 0x518ed [0254.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.094] Sleep (dwMilliseconds=0xa) [0254.109] timeGetTime () returned 0x518fd [0254.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.109] Sleep (dwMilliseconds=0xa) [0254.125] timeGetTime () returned 0x5190c [0254.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.125] Sleep (dwMilliseconds=0xa) [0254.142] timeGetTime () returned 0x5191d [0254.142] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.142] Sleep (dwMilliseconds=0xa) [0254.156] timeGetTime () returned 0x5192c [0254.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.156] Sleep (dwMilliseconds=0xa) [0254.172] timeGetTime () returned 0x5193b [0254.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.172] Sleep (dwMilliseconds=0xa) [0254.187] timeGetTime () returned 0x5194b [0254.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.188] Sleep (dwMilliseconds=0xa) [0254.203] timeGetTime () returned 0x5195a [0254.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.203] Sleep (dwMilliseconds=0xa) [0254.219] timeGetTime () returned 0x5196a [0254.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.219] Sleep (dwMilliseconds=0xa) [0254.252] timeGetTime () returned 0x51989 [0254.252] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.252] Sleep (dwMilliseconds=0xa) [0254.265] timeGetTime () returned 0x51999 [0254.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.266] Sleep (dwMilliseconds=0xa) [0254.281] timeGetTime () returned 0x519a9 [0254.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.281] Sleep (dwMilliseconds=0xa) [0254.297] timeGetTime () returned 0x519b8 [0254.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.297] Sleep (dwMilliseconds=0xa) [0254.313] timeGetTime () returned 0x519c8 [0254.313] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.313] Sleep (dwMilliseconds=0xa) [0254.328] timeGetTime () returned 0x519d7 [0254.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.328] Sleep (dwMilliseconds=0xa) [0254.344] timeGetTime () returned 0x519e7 [0254.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.344] Sleep (dwMilliseconds=0xa) [0254.359] timeGetTime () returned 0x519f7 [0254.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.359] Sleep (dwMilliseconds=0xa) [0254.375] timeGetTime () returned 0x51a06 [0254.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0254.375] TranslateMessage (lpMsg=0x8bf798) returned 0 [0254.375] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0254.375] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0254.375] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0254.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.375] Sleep (dwMilliseconds=0xa) [0254.391] timeGetTime () returned 0x51a16 [0254.391] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.391] Sleep (dwMilliseconds=0xa) [0254.406] timeGetTime () returned 0x51a26 [0254.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.406] Sleep (dwMilliseconds=0xa) [0254.422] timeGetTime () returned 0x51a35 [0254.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.422] Sleep (dwMilliseconds=0xa) [0254.437] timeGetTime () returned 0x51a45 [0254.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.438] Sleep (dwMilliseconds=0xa) [0254.453] timeGetTime () returned 0x51a54 [0254.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.453] Sleep (dwMilliseconds=0xa) [0254.469] timeGetTime () returned 0x51a64 [0254.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.469] Sleep (dwMilliseconds=0xa) [0254.484] timeGetTime () returned 0x51a74 [0254.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.484] Sleep (dwMilliseconds=0xa) [0254.500] timeGetTime () returned 0x51a83 [0254.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.500] Sleep (dwMilliseconds=0xa) [0254.515] timeGetTime () returned 0x51a93 [0254.515] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.516] Sleep (dwMilliseconds=0xa) [0254.532] timeGetTime () returned 0x51aa3 [0254.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.532] Sleep (dwMilliseconds=0xa) [0254.547] timeGetTime () returned 0x51ab2 [0254.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.547] Sleep (dwMilliseconds=0xa) [0254.569] timeGetTime () returned 0x51ac2 [0254.569] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.569] Sleep (dwMilliseconds=0xa) [0254.594] timeGetTime () returned 0x51ae1 [0254.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.594] Sleep (dwMilliseconds=0xa) [0254.609] timeGetTime () returned 0x51af1 [0254.610] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0254.610] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0254.610] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.610] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0254.610] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0254.610] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0254.610] RegCloseKey (hKey=0x240) returned 0x0 [0254.610] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0254.610] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0254.610] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0254.610] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0254.610] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0254.610] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0254.610] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0254.610] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0254.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0254.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acf8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0254.611] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0254.611] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0254.719] FreeLibrary (hLibModule=0x77150000) returned 1 [0254.719] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0254.719] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0254.719] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0254.719] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0254.719] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0254.719] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.719] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0254.720] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0254.720] timeGetTime () returned 0x51b5e [0254.720] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.720] Sleep (dwMilliseconds=0xa) [0254.766] timeGetTime () returned 0x51b8d [0254.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.766] Sleep (dwMilliseconds=0xa) [0254.812] timeGetTime () returned 0x51bbc [0254.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.813] Sleep (dwMilliseconds=0xa) [0254.860] timeGetTime () returned 0x51beb [0254.860] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.860] Sleep (dwMilliseconds=0xa) [0254.906] timeGetTime () returned 0x51c1a [0254.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.906] Sleep (dwMilliseconds=0xa) [0254.933] timeGetTime () returned 0x51c29 [0254.933] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.933] Sleep (dwMilliseconds=0xa) [0254.962] timeGetTime () returned 0x51c48 [0254.962] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.962] Sleep (dwMilliseconds=0xa) [0254.984] timeGetTime () returned 0x51c68 [0254.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0254.984] Sleep (dwMilliseconds=0xa) [0255.000] timeGetTime () returned 0x51c77 [0255.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.000] Sleep (dwMilliseconds=0xa) [0255.015] timeGetTime () returned 0x51c87 [0255.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.015] Sleep (dwMilliseconds=0xa) [0255.032] timeGetTime () returned 0x51c97 [0255.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.032] Sleep (dwMilliseconds=0xa) [0255.047] timeGetTime () returned 0x51ca6 [0255.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.047] Sleep (dwMilliseconds=0xa) [0255.062] timeGetTime () returned 0x51cb6 [0255.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.062] Sleep (dwMilliseconds=0xa) [0255.078] timeGetTime () returned 0x51cc5 [0255.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.078] Sleep (dwMilliseconds=0xa) [0255.094] timeGetTime () returned 0x51cd5 [0255.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.094] Sleep (dwMilliseconds=0xa) [0255.109] timeGetTime () returned 0x51ce5 [0255.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.109] Sleep (dwMilliseconds=0xa) [0255.125] timeGetTime () returned 0x51cf4 [0255.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.125] Sleep (dwMilliseconds=0xa) [0255.141] timeGetTime () returned 0x51d04 [0255.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0255.141] TranslateMessage (lpMsg=0x8bf798) returned 0 [0255.141] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0255.141] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0255.141] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0255.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.141] Sleep (dwMilliseconds=0xa) [0255.156] timeGetTime () returned 0x51d14 [0255.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.156] Sleep (dwMilliseconds=0xa) [0255.172] timeGetTime () returned 0x51d23 [0255.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.172] Sleep (dwMilliseconds=0xa) [0255.187] timeGetTime () returned 0x51d33 [0255.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.187] Sleep (dwMilliseconds=0xa) [0255.203] timeGetTime () returned 0x51d42 [0255.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.203] Sleep (dwMilliseconds=0xa) [0255.219] timeGetTime () returned 0x51d52 [0255.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.219] Sleep (dwMilliseconds=0xa) [0255.278] timeGetTime () returned 0x51d81 [0255.278] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.278] Sleep (dwMilliseconds=0xa) [0255.298] timeGetTime () returned 0x51da0 [0255.298] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.298] Sleep (dwMilliseconds=0xa) [0255.312] timeGetTime () returned 0x51db0 [0255.313] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.313] Sleep (dwMilliseconds=0xa) [0255.328] timeGetTime () returned 0x51dbf [0255.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.328] Sleep (dwMilliseconds=0xa) [0255.344] timeGetTime () returned 0x51dcf [0255.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.344] Sleep (dwMilliseconds=0xa) [0255.359] timeGetTime () returned 0x51ddf [0255.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.359] Sleep (dwMilliseconds=0xa) [0255.375] timeGetTime () returned 0x51dee [0255.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.375] Sleep (dwMilliseconds=0xa) [0255.390] timeGetTime () returned 0x51dfe [0255.391] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.391] Sleep (dwMilliseconds=0xa) [0255.406] timeGetTime () returned 0x51e0e [0255.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.406] Sleep (dwMilliseconds=0xa) [0255.422] timeGetTime () returned 0x51e1d [0255.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.422] Sleep (dwMilliseconds=0xa) [0255.437] timeGetTime () returned 0x51e2d [0255.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.437] Sleep (dwMilliseconds=0xa) [0255.453] timeGetTime () returned 0x51e3c [0255.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.453] Sleep (dwMilliseconds=0xa) [0255.468] timeGetTime () returned 0x51e4c [0255.468] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.469] Sleep (dwMilliseconds=0xa) [0255.484] timeGetTime () returned 0x51e5c [0255.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.484] Sleep (dwMilliseconds=0xa) [0255.500] timeGetTime () returned 0x51e6b [0255.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.500] Sleep (dwMilliseconds=0xa) [0255.516] timeGetTime () returned 0x51e7b [0255.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.516] Sleep (dwMilliseconds=0xa) [0255.531] timeGetTime () returned 0x51e8b [0255.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.531] Sleep (dwMilliseconds=0xa) [0255.547] timeGetTime () returned 0x51e9a [0255.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.547] Sleep (dwMilliseconds=0xa) [0255.568] timeGetTime () returned 0x51eaa [0255.568] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.568] Sleep (dwMilliseconds=0xa) [0255.594] timeGetTime () returned 0x51ec9 [0255.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.594] Sleep (dwMilliseconds=0xa) [0255.609] timeGetTime () returned 0x51ed9 [0255.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.609] Sleep (dwMilliseconds=0xa) [0255.625] timeGetTime () returned 0x51ee8 [0255.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.625] Sleep (dwMilliseconds=0xa) [0255.641] timeGetTime () returned 0x51ef8 [0255.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.641] Sleep (dwMilliseconds=0xa) [0255.656] timeGetTime () returned 0x51f08 [0255.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.656] Sleep (dwMilliseconds=0xa) [0255.672] timeGetTime () returned 0x51f17 [0255.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.672] Sleep (dwMilliseconds=0xa) [0255.687] timeGetTime () returned 0x51f27 [0255.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.687] Sleep (dwMilliseconds=0xa) [0255.704] timeGetTime () returned 0x51f36 [0255.704] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.704] Sleep (dwMilliseconds=0xa) [0255.718] timeGetTime () returned 0x51f46 [0255.719] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0255.719] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0255.719] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.719] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0255.719] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0255.719] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0255.719] RegCloseKey (hKey=0x240) returned 0x0 [0255.719] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0255.719] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0255.719] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0255.719] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0255.719] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0255.719] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0255.719] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0255.719] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0255.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0255.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0255.720] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0255.720] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0255.828] FreeLibrary (hLibModule=0x77150000) returned 1 [0255.829] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0255.829] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0255.829] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0255.829] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0255.829] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0255.829] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.829] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0255.829] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0255.829] timeGetTime () returned 0x51fb3 [0255.829] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.829] Sleep (dwMilliseconds=0xa) [0255.844] timeGetTime () returned 0x51fc3 [0255.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.844] Sleep (dwMilliseconds=0xa) [0255.875] timeGetTime () returned 0x51fe2 [0255.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.875] Sleep (dwMilliseconds=0xa) [0255.923] timeGetTime () returned 0x52011 [0255.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0255.923] TranslateMessage (lpMsg=0x8bf798) returned 0 [0255.923] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0255.923] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0255.923] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0255.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.923] Sleep (dwMilliseconds=0xa) [0255.973] timeGetTime () returned 0x52040 [0255.973] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0255.973] Sleep (dwMilliseconds=0xa) [0256.016] timeGetTime () returned 0x5206f [0256.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.016] Sleep (dwMilliseconds=0xa) [0256.058] timeGetTime () returned 0x5208e [0256.058] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.058] Sleep (dwMilliseconds=0xa) [0256.079] timeGetTime () returned 0x520ae [0256.079] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.079] Sleep (dwMilliseconds=0xa) [0256.094] timeGetTime () returned 0x520bd [0256.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.094] Sleep (dwMilliseconds=0xa) [0256.120] timeGetTime () returned 0x520cd [0256.120] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.121] Sleep (dwMilliseconds=0xa) [0256.152] timeGetTime () returned 0x520ec [0256.152] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.152] Sleep (dwMilliseconds=0xa) [0256.172] timeGetTime () returned 0x5210b [0256.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.172] Sleep (dwMilliseconds=0xa) [0256.187] timeGetTime () returned 0x5211b [0256.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.187] Sleep (dwMilliseconds=0xa) [0256.203] timeGetTime () returned 0x5212a [0256.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.203] Sleep (dwMilliseconds=0xa) [0256.218] timeGetTime () returned 0x5213a [0256.218] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.219] Sleep (dwMilliseconds=0xa) [0256.271] timeGetTime () returned 0x52169 [0256.271] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.271] Sleep (dwMilliseconds=0xa) [0256.297] timeGetTime () returned 0x52188 [0256.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.297] Sleep (dwMilliseconds=0xa) [0256.312] timeGetTime () returned 0x52198 [0256.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.312] Sleep (dwMilliseconds=0xa) [0256.329] timeGetTime () returned 0x521a8 [0256.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.329] Sleep (dwMilliseconds=0xa) [0256.344] timeGetTime () returned 0x521b7 [0256.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.344] Sleep (dwMilliseconds=0xa) [0256.359] timeGetTime () returned 0x521c7 [0256.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.359] Sleep (dwMilliseconds=0xa) [0256.375] timeGetTime () returned 0x521d6 [0256.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.375] Sleep (dwMilliseconds=0xa) [0256.391] timeGetTime () returned 0x521e6 [0256.391] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.391] Sleep (dwMilliseconds=0xa) [0256.411] timeGetTime () returned 0x521fa [0256.411] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.411] Sleep (dwMilliseconds=0xa) [0256.423] timeGetTime () returned 0x52206 [0256.423] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.423] Sleep (dwMilliseconds=0xa) [0256.437] timeGetTime () returned 0x52215 [0256.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.437] Sleep (dwMilliseconds=0xa) [0256.454] timeGetTime () returned 0x52224 [0256.454] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.454] Sleep (dwMilliseconds=0xa) [0256.468] timeGetTime () returned 0x52234 [0256.468] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.469] Sleep (dwMilliseconds=0xa) [0256.484] timeGetTime () returned 0x52244 [0256.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.484] Sleep (dwMilliseconds=0xa) [0256.500] timeGetTime () returned 0x52253 [0256.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.500] Sleep (dwMilliseconds=0xa) [0256.516] timeGetTime () returned 0x52263 [0256.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.516] Sleep (dwMilliseconds=0xa) [0256.531] timeGetTime () returned 0x52273 [0256.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.531] Sleep (dwMilliseconds=0xa) [0256.547] timeGetTime () returned 0x52282 [0256.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.547] Sleep (dwMilliseconds=0xa) [0256.570] timeGetTime () returned 0x52292 [0256.570] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.570] Sleep (dwMilliseconds=0xa) [0256.594] timeGetTime () returned 0x522b1 [0256.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.594] Sleep (dwMilliseconds=0xa) [0256.609] timeGetTime () returned 0x522c1 [0256.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.609] Sleep (dwMilliseconds=0xa) [0256.626] timeGetTime () returned 0x522d0 [0256.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.626] Sleep (dwMilliseconds=0xa) [0256.641] timeGetTime () returned 0x522e0 [0256.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.641] Sleep (dwMilliseconds=0xa) [0256.656] timeGetTime () returned 0x522f0 [0256.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.656] Sleep (dwMilliseconds=0xa) [0256.672] timeGetTime () returned 0x522ff [0256.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.672] Sleep (dwMilliseconds=0xa) [0256.687] timeGetTime () returned 0x5230f [0256.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0256.688] TranslateMessage (lpMsg=0x8bf798) returned 0 [0256.688] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0256.688] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0256.688] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0256.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.688] Sleep (dwMilliseconds=0xa) [0256.703] timeGetTime () returned 0x5231e [0256.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.703] Sleep (dwMilliseconds=0xa) [0256.718] timeGetTime () returned 0x5232e [0256.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.719] Sleep (dwMilliseconds=0xa) [0256.734] timeGetTime () returned 0x5233e [0256.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.734] Sleep (dwMilliseconds=0xa) [0256.750] timeGetTime () returned 0x5234d [0256.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.750] Sleep (dwMilliseconds=0xa) [0256.766] timeGetTime () returned 0x5235d [0256.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.766] Sleep (dwMilliseconds=0xa) [0256.781] timeGetTime () returned 0x5236d [0256.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.781] Sleep (dwMilliseconds=0xa) [0256.798] timeGetTime () returned 0x5237d [0256.798] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.798] Sleep (dwMilliseconds=0xa) [0256.812] timeGetTime () returned 0x5238c [0256.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.812] Sleep (dwMilliseconds=0xa) [0256.828] timeGetTime () returned 0x5239b [0256.828] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0256.828] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0256.828] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.828] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0256.828] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0256.828] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0256.829] RegCloseKey (hKey=0x240) returned 0x0 [0256.829] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0256.829] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0256.829] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0256.829] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0256.829] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0256.829] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0256.829] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0256.829] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0256.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0256.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aad8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0256.830] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0256.830] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0256.937] FreeLibrary (hLibModule=0x77150000) returned 1 [0256.937] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0256.937] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0256.938] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0256.938] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0256.938] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0256.938] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.938] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0256.938] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0256.938] timeGetTime () returned 0x52409 [0256.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.938] Sleep (dwMilliseconds=0xa) [0256.985] timeGetTime () returned 0x52438 [0256.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0256.985] Sleep (dwMilliseconds=0xa) [0257.031] timeGetTime () returned 0x52467 [0257.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.031] Sleep (dwMilliseconds=0xa) [0257.125] timeGetTime () returned 0x524c4 [0257.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.125] Sleep (dwMilliseconds=0xa) [0257.153] timeGetTime () returned 0x524d4 [0257.153] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.153] Sleep (dwMilliseconds=0xa) [0257.181] timeGetTime () returned 0x524f4 [0257.181] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.181] Sleep (dwMilliseconds=0xa) [0257.203] timeGetTime () returned 0x52513 [0257.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.203] Sleep (dwMilliseconds=0xa) [0257.219] timeGetTime () returned 0x52522 [0257.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.219] Sleep (dwMilliseconds=0xa) [0257.234] timeGetTime () returned 0x52532 [0257.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.234] Sleep (dwMilliseconds=0xa) [0257.250] timeGetTime () returned 0x52541 [0257.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.250] Sleep (dwMilliseconds=0xa) [0257.303] timeGetTime () returned 0x52570 [0257.303] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.303] Sleep (dwMilliseconds=0xa) [0257.328] timeGetTime () returned 0x5258f [0257.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.328] Sleep (dwMilliseconds=0xa) [0257.343] timeGetTime () returned 0x5259f [0257.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.344] Sleep (dwMilliseconds=0xa) [0257.359] timeGetTime () returned 0x525af [0257.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.359] Sleep (dwMilliseconds=0xa) [0257.375] timeGetTime () returned 0x525be [0257.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.375] Sleep (dwMilliseconds=0xa) [0257.390] timeGetTime () returned 0x525ce [0257.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.390] Sleep (dwMilliseconds=0xa) [0257.406] timeGetTime () returned 0x525de [0257.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.406] Sleep (dwMilliseconds=0xa) [0257.422] timeGetTime () returned 0x525ed [0257.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.422] Sleep (dwMilliseconds=0xa) [0257.438] timeGetTime () returned 0x525fd [0257.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.438] Sleep (dwMilliseconds=0xa) [0257.453] timeGetTime () returned 0x5260d [0257.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0257.453] TranslateMessage (lpMsg=0x8bf798) returned 0 [0257.453] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0257.453] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0257.453] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0257.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.453] Sleep (dwMilliseconds=0xa) [0257.469] timeGetTime () returned 0x5261c [0257.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.469] Sleep (dwMilliseconds=0xa) [0257.484] timeGetTime () returned 0x5262c [0257.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.484] Sleep (dwMilliseconds=0xa) [0257.500] timeGetTime () returned 0x5263b [0257.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.500] Sleep (dwMilliseconds=0xa) [0257.516] timeGetTime () returned 0x5264b [0257.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.516] Sleep (dwMilliseconds=0xa) [0257.531] timeGetTime () returned 0x5265b [0257.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.531] Sleep (dwMilliseconds=0xa) [0257.547] timeGetTime () returned 0x5266a [0257.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.547] Sleep (dwMilliseconds=0xa) [0257.570] timeGetTime () returned 0x5267a [0257.570] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.570] Sleep (dwMilliseconds=0xa) [0257.594] timeGetTime () returned 0x52699 [0257.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.594] Sleep (dwMilliseconds=0xa) [0257.609] timeGetTime () returned 0x526a9 [0257.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.609] Sleep (dwMilliseconds=0xa) [0257.625] timeGetTime () returned 0x526b8 [0257.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.625] Sleep (dwMilliseconds=0xa) [0257.640] timeGetTime () returned 0x526c8 [0257.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.641] Sleep (dwMilliseconds=0xa) [0257.656] timeGetTime () returned 0x526d8 [0257.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.656] Sleep (dwMilliseconds=0xa) [0257.672] timeGetTime () returned 0x526e7 [0257.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.672] Sleep (dwMilliseconds=0xa) [0257.687] timeGetTime () returned 0x526f7 [0257.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.687] Sleep (dwMilliseconds=0xa) [0257.703] timeGetTime () returned 0x52706 [0257.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.703] Sleep (dwMilliseconds=0xa) [0257.719] timeGetTime () returned 0x52716 [0257.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.719] Sleep (dwMilliseconds=0xa) [0257.734] timeGetTime () returned 0x52726 [0257.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.734] Sleep (dwMilliseconds=0xa) [0257.750] timeGetTime () returned 0x52735 [0257.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.750] Sleep (dwMilliseconds=0xa) [0257.765] timeGetTime () returned 0x52745 [0257.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.765] Sleep (dwMilliseconds=0xa) [0257.781] timeGetTime () returned 0x52755 [0257.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.781] Sleep (dwMilliseconds=0xa) [0257.797] timeGetTime () returned 0x52764 [0257.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.797] Sleep (dwMilliseconds=0xa) [0257.813] timeGetTime () returned 0x52774 [0257.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.813] Sleep (dwMilliseconds=0xa) [0257.828] timeGetTime () returned 0x52783 [0257.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.828] Sleep (dwMilliseconds=0xa) [0257.844] timeGetTime () returned 0x52793 [0257.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.844] Sleep (dwMilliseconds=0xa) [0257.859] timeGetTime () returned 0x527a3 [0257.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.860] Sleep (dwMilliseconds=0xa) [0257.875] timeGetTime () returned 0x527b2 [0257.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.876] Sleep (dwMilliseconds=0xa) [0257.890] timeGetTime () returned 0x527c2 [0257.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.890] Sleep (dwMilliseconds=0xa) [0257.906] timeGetTime () returned 0x527d2 [0257.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.906] Sleep (dwMilliseconds=0xa) [0257.922] timeGetTime () returned 0x527e1 [0257.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0257.922] Sleep (dwMilliseconds=0xa) [0257.938] timeGetTime () returned 0x527f1 [0257.938] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0257.938] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0257.938] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.938] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0257.938] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0257.939] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0257.939] RegCloseKey (hKey=0x240) returned 0x0 [0257.939] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0257.939] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0257.939] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0257.939] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0257.939] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0257.939] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0257.939] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0257.939] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0257.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0257.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0257.939] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0257.939] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0258.031] FreeLibrary (hLibModule=0x77150000) returned 1 [0258.031] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0258.031] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0258.031] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0258.031] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0258.031] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0258.031] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.031] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0258.032] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0258.032] timeGetTime () returned 0x5284f [0258.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.032] Sleep (dwMilliseconds=0xa) [0258.078] timeGetTime () returned 0x5287d [0258.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.078] Sleep (dwMilliseconds=0xa) [0258.125] timeGetTime () returned 0x528ac [0258.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.125] Sleep (dwMilliseconds=0xa) [0258.160] timeGetTime () returned 0x528cc [0258.160] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.160] Sleep (dwMilliseconds=0xa) [0258.203] timeGetTime () returned 0x528fa [0258.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0258.203] TranslateMessage (lpMsg=0x8bf798) returned 0 [0258.203] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0258.203] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0258.203] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0258.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.203] Sleep (dwMilliseconds=0xa) [0258.246] timeGetTime () returned 0x5291a [0258.246] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.246] Sleep (dwMilliseconds=0xa) [0258.265] timeGetTime () returned 0x52939 [0258.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.266] Sleep (dwMilliseconds=0xa) [0258.331] timeGetTime () returned 0x52977 [0258.331] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.331] Sleep (dwMilliseconds=0xa) [0258.344] timeGetTime () returned 0x52987 [0258.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.344] Sleep (dwMilliseconds=0xa) [0258.359] timeGetTime () returned 0x52997 [0258.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.359] Sleep (dwMilliseconds=0xa) [0258.375] timeGetTime () returned 0x529a6 [0258.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.375] Sleep (dwMilliseconds=0xa) [0258.391] timeGetTime () returned 0x529b6 [0258.391] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.391] Sleep (dwMilliseconds=0xa) [0258.406] timeGetTime () returned 0x529c6 [0258.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.406] Sleep (dwMilliseconds=0xa) [0258.423] timeGetTime () returned 0x529d6 [0258.423] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.423] Sleep (dwMilliseconds=0xa) [0258.447] timeGetTime () returned 0x529e5 [0258.447] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.447] Sleep (dwMilliseconds=0xa) [0258.469] timeGetTime () returned 0x52a04 [0258.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.469] Sleep (dwMilliseconds=0xa) [0258.484] timeGetTime () returned 0x52a14 [0258.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.484] Sleep (dwMilliseconds=0xa) [0258.500] timeGetTime () returned 0x52a23 [0258.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.500] Sleep (dwMilliseconds=0xa) [0258.516] timeGetTime () returned 0x52a33 [0258.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.516] Sleep (dwMilliseconds=0xa) [0258.531] timeGetTime () returned 0x52a43 [0258.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.531] Sleep (dwMilliseconds=0xa) [0258.547] timeGetTime () returned 0x52a52 [0258.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.547] Sleep (dwMilliseconds=0xa) [0258.571] timeGetTime () returned 0x52a62 [0258.571] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.571] Sleep (dwMilliseconds=0xa) [0258.594] timeGetTime () returned 0x52a81 [0258.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.594] Sleep (dwMilliseconds=0xa) [0258.609] timeGetTime () returned 0x52a91 [0258.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.609] Sleep (dwMilliseconds=0xa) [0258.625] timeGetTime () returned 0x52aa0 [0258.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.625] Sleep (dwMilliseconds=0xa) [0258.641] timeGetTime () returned 0x52ab0 [0258.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.641] Sleep (dwMilliseconds=0xa) [0258.656] timeGetTime () returned 0x52ac0 [0258.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.656] Sleep (dwMilliseconds=0xa) [0258.672] timeGetTime () returned 0x52acf [0258.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.672] Sleep (dwMilliseconds=0xa) [0258.687] timeGetTime () returned 0x52adf [0258.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.687] Sleep (dwMilliseconds=0xa) [0258.703] timeGetTime () returned 0x52aee [0258.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.703] Sleep (dwMilliseconds=0xa) [0258.718] timeGetTime () returned 0x52afe [0258.718] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.718] Sleep (dwMilliseconds=0xa) [0258.734] timeGetTime () returned 0x52b0e [0258.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.734] Sleep (dwMilliseconds=0xa) [0258.750] timeGetTime () returned 0x52b1d [0258.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.750] Sleep (dwMilliseconds=0xa) [0258.766] timeGetTime () returned 0x52b2d [0258.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.766] Sleep (dwMilliseconds=0xa) [0258.781] timeGetTime () returned 0x52b3d [0258.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.781] Sleep (dwMilliseconds=0xa) [0258.797] timeGetTime () returned 0x52b4c [0258.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.797] Sleep (dwMilliseconds=0xa) [0258.813] timeGetTime () returned 0x52b5d [0258.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.813] Sleep (dwMilliseconds=0xa) [0258.828] timeGetTime () returned 0x52b6b [0258.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.828] Sleep (dwMilliseconds=0xa) [0258.843] timeGetTime () returned 0x52b7b [0258.843] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.844] Sleep (dwMilliseconds=0xa) [0258.859] timeGetTime () returned 0x52b8b [0258.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.859] Sleep (dwMilliseconds=0xa) [0258.875] timeGetTime () returned 0x52b9a [0258.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.875] Sleep (dwMilliseconds=0xa) [0258.890] timeGetTime () returned 0x52baa [0258.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.891] Sleep (dwMilliseconds=0xa) [0258.906] timeGetTime () returned 0x52bba [0258.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.906] Sleep (dwMilliseconds=0xa) [0258.922] timeGetTime () returned 0x52bc9 [0258.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.922] Sleep (dwMilliseconds=0xa) [0258.937] timeGetTime () returned 0x52bd9 [0258.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.937] Sleep (dwMilliseconds=0xa) [0258.953] timeGetTime () returned 0x52be8 [0258.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0258.953] TranslateMessage (lpMsg=0x8bf798) returned 0 [0258.953] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0258.953] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0258.953] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0258.954] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.954] Sleep (dwMilliseconds=0xa) [0258.969] timeGetTime () returned 0x52bf8 [0258.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.969] Sleep (dwMilliseconds=0xa) [0258.985] timeGetTime () returned 0x52c08 [0258.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0258.985] Sleep (dwMilliseconds=0xa) [0259.000] timeGetTime () returned 0x52c17 [0259.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.000] Sleep (dwMilliseconds=0xa) [0259.015] timeGetTime () returned 0x52c27 [0259.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.016] Sleep (dwMilliseconds=0xa) [0259.031] timeGetTime () returned 0x52c37 [0259.031] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0259.031] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0259.031] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.031] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0259.031] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0259.031] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0259.031] RegCloseKey (hKey=0x240) returned 0x0 [0259.032] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0259.032] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0259.032] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0259.032] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0259.032] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0259.032] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0259.032] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0259.032] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0259.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0259.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aab8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0259.032] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0259.032] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0259.140] FreeLibrary (hLibModule=0x77150000) returned 1 [0259.140] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0259.140] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0259.141] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0259.141] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0259.141] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0259.141] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.141] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0259.141] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0259.141] timeGetTime () returned 0x52ca4 [0259.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.141] Sleep (dwMilliseconds=0xa) [0259.187] timeGetTime () returned 0x52cd3 [0259.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.188] Sleep (dwMilliseconds=0xa) [0259.236] timeGetTime () returned 0x52d02 [0259.236] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.236] Sleep (dwMilliseconds=0xa) [0259.281] timeGetTime () returned 0x52d31 [0259.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.281] Sleep (dwMilliseconds=0xa) [0259.359] timeGetTime () returned 0x52d7f [0259.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.359] Sleep (dwMilliseconds=0xa) [0259.375] timeGetTime () returned 0x52d8e [0259.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.375] Sleep (dwMilliseconds=0xa) [0259.391] timeGetTime () returned 0x52d9e [0259.391] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.391] Sleep (dwMilliseconds=0xa) [0259.406] timeGetTime () returned 0x52dae [0259.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.406] Sleep (dwMilliseconds=0xa) [0259.429] timeGetTime () returned 0x52dbd [0259.429] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.429] Sleep (dwMilliseconds=0xa) [0259.453] timeGetTime () returned 0x52ddc [0259.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.453] Sleep (dwMilliseconds=0xa) [0259.469] timeGetTime () returned 0x52dec [0259.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.469] Sleep (dwMilliseconds=0xa) [0259.484] timeGetTime () returned 0x52dfc [0259.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.484] Sleep (dwMilliseconds=0xa) [0259.500] timeGetTime () returned 0x52e0b [0259.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.500] Sleep (dwMilliseconds=0xa) [0259.516] timeGetTime () returned 0x52e1b [0259.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.516] Sleep (dwMilliseconds=0xa) [0259.531] timeGetTime () returned 0x52e2b [0259.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.531] Sleep (dwMilliseconds=0xa) [0259.547] timeGetTime () returned 0x52e3a [0259.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.547] Sleep (dwMilliseconds=0xa) [0259.568] timeGetTime () returned 0x52e4a [0259.568] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.568] Sleep (dwMilliseconds=0xa) [0259.595] timeGetTime () returned 0x52e6a [0259.595] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.595] Sleep (dwMilliseconds=0xa) [0259.610] timeGetTime () returned 0x52e79 [0259.610] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.610] Sleep (dwMilliseconds=0xa) [0259.625] timeGetTime () returned 0x52e88 [0259.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.625] Sleep (dwMilliseconds=0xa) [0259.640] timeGetTime () returned 0x52e98 [0259.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.640] Sleep (dwMilliseconds=0xa) [0259.656] timeGetTime () returned 0x52ea8 [0259.657] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.657] Sleep (dwMilliseconds=0xa) [0259.672] timeGetTime () returned 0x52eb7 [0259.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.672] Sleep (dwMilliseconds=0xa) [0259.687] timeGetTime () returned 0x52ec7 [0259.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.688] Sleep (dwMilliseconds=0xa) [0259.703] timeGetTime () returned 0x52ed7 [0259.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0259.703] TranslateMessage (lpMsg=0x8bf798) returned 0 [0259.703] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0259.703] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0259.703] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0259.704] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.704] Sleep (dwMilliseconds=0xa) [0259.719] timeGetTime () returned 0x52ee6 [0259.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.719] Sleep (dwMilliseconds=0xa) [0259.734] timeGetTime () returned 0x52ef6 [0259.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.734] Sleep (dwMilliseconds=0xa) [0259.750] timeGetTime () returned 0x52f05 [0259.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.750] Sleep (dwMilliseconds=0xa) [0259.766] timeGetTime () returned 0x52f15 [0259.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.766] Sleep (dwMilliseconds=0xa) [0259.781] timeGetTime () returned 0x52f25 [0259.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.781] Sleep (dwMilliseconds=0xa) [0259.797] timeGetTime () returned 0x52f34 [0259.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.797] Sleep (dwMilliseconds=0xa) [0259.813] timeGetTime () returned 0x52f44 [0259.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.813] Sleep (dwMilliseconds=0xa) [0259.828] timeGetTime () returned 0x52f53 [0259.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.828] Sleep (dwMilliseconds=0xa) [0259.844] timeGetTime () returned 0x52f63 [0259.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.844] Sleep (dwMilliseconds=0xa) [0259.860] timeGetTime () returned 0x52f73 [0259.860] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.860] Sleep (dwMilliseconds=0xa) [0259.875] timeGetTime () returned 0x52f82 [0259.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.875] Sleep (dwMilliseconds=0xa) [0259.893] timeGetTime () returned 0x52f92 [0259.893] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.893] Sleep (dwMilliseconds=0xa) [0259.906] timeGetTime () returned 0x52fa2 [0259.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.906] Sleep (dwMilliseconds=0xa) [0259.922] timeGetTime () returned 0x52fb1 [0259.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.922] Sleep (dwMilliseconds=0xa) [0259.937] timeGetTime () returned 0x52fc1 [0259.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.937] Sleep (dwMilliseconds=0xa) [0259.953] timeGetTime () returned 0x52fd1 [0259.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.953] Sleep (dwMilliseconds=0xa) [0259.969] timeGetTime () returned 0x52fe0 [0259.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.969] Sleep (dwMilliseconds=0xa) [0259.985] timeGetTime () returned 0x52ff0 [0259.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0259.985] Sleep (dwMilliseconds=0xa) [0260.000] timeGetTime () returned 0x52fff [0260.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.000] Sleep (dwMilliseconds=0xa) [0260.015] timeGetTime () returned 0x5300f [0260.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.016] Sleep (dwMilliseconds=0xa) [0260.031] timeGetTime () returned 0x5301f [0260.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.031] Sleep (dwMilliseconds=0xa) [0260.047] timeGetTime () returned 0x5302e [0260.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.047] Sleep (dwMilliseconds=0xa) [0260.062] timeGetTime () returned 0x5303e [0260.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.062] Sleep (dwMilliseconds=0xa) [0260.078] timeGetTime () returned 0x5304d [0260.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.078] Sleep (dwMilliseconds=0xa) [0260.094] timeGetTime () returned 0x5305d [0260.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.094] Sleep (dwMilliseconds=0xa) [0260.110] timeGetTime () returned 0x5306d [0260.110] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.110] Sleep (dwMilliseconds=0xa) [0260.125] timeGetTime () returned 0x5307c [0260.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.125] Sleep (dwMilliseconds=0xa) [0260.140] timeGetTime () returned 0x5308c [0260.140] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0260.141] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0260.141] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.141] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0260.141] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0260.141] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0260.141] RegCloseKey (hKey=0x240) returned 0x0 [0260.141] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0260.141] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0260.141] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0260.141] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0260.141] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0260.141] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0260.141] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0260.141] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0260.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0260.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab18, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0260.142] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0260.142] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0260.250] FreeLibrary (hLibModule=0x77150000) returned 1 [0260.250] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0260.250] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0260.250] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0260.250] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0260.250] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0260.250] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.250] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0260.250] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0260.250] timeGetTime () returned 0x530f9 [0260.251] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.251] Sleep (dwMilliseconds=0xa) [0260.328] timeGetTime () returned 0x53147 [0260.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.328] Sleep (dwMilliseconds=0xa) [0260.376] timeGetTime () returned 0x53176 [0260.376] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.376] Sleep (dwMilliseconds=0xa) [0260.422] timeGetTime () returned 0x531a5 [0260.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.422] Sleep (dwMilliseconds=0xa) [0260.468] timeGetTime () returned 0x531d4 [0260.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0260.469] TranslateMessage (lpMsg=0x8bf798) returned 0 [0260.469] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0260.469] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0260.469] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0260.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.469] Sleep (dwMilliseconds=0xa) [0260.501] timeGetTime () returned 0x531f3 [0260.501] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.501] Sleep (dwMilliseconds=0xa) [0260.516] timeGetTime () returned 0x53203 [0260.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.516] Sleep (dwMilliseconds=0xa) [0260.540] timeGetTime () returned 0x53213 [0260.540] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.540] Sleep (dwMilliseconds=0xa) [0260.579] timeGetTime () returned 0x53241 [0260.579] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.579] Sleep (dwMilliseconds=0xa) [0260.594] timeGetTime () returned 0x53251 [0260.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.594] Sleep (dwMilliseconds=0xa) [0260.609] timeGetTime () returned 0x53261 [0260.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.609] Sleep (dwMilliseconds=0xa) [0260.625] timeGetTime () returned 0x53270 [0260.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.625] Sleep (dwMilliseconds=0xa) [0260.641] timeGetTime () returned 0x53280 [0260.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.641] Sleep (dwMilliseconds=0xa) [0260.656] timeGetTime () returned 0x53290 [0260.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.656] Sleep (dwMilliseconds=0xa) [0260.672] timeGetTime () returned 0x5329f [0260.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.672] Sleep (dwMilliseconds=0xa) [0260.687] timeGetTime () returned 0x532af [0260.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.687] Sleep (dwMilliseconds=0xa) [0260.703] timeGetTime () returned 0x532be [0260.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.703] Sleep (dwMilliseconds=0xa) [0260.719] timeGetTime () returned 0x532ce [0260.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.719] Sleep (dwMilliseconds=0xa) [0260.734] timeGetTime () returned 0x532de [0260.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.734] Sleep (dwMilliseconds=0xa) [0260.750] timeGetTime () returned 0x532ed [0260.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.750] Sleep (dwMilliseconds=0xa) [0260.766] timeGetTime () returned 0x532fd [0260.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.766] Sleep (dwMilliseconds=0xa) [0260.781] timeGetTime () returned 0x5330d [0260.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.781] Sleep (dwMilliseconds=0xa) [0260.797] timeGetTime () returned 0x5331c [0260.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.797] Sleep (dwMilliseconds=0xa) [0260.813] timeGetTime () returned 0x5332c [0260.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.813] Sleep (dwMilliseconds=0xa) [0260.828] timeGetTime () returned 0x5333b [0260.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.828] Sleep (dwMilliseconds=0xa) [0260.844] timeGetTime () returned 0x5334b [0260.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.844] Sleep (dwMilliseconds=0xa) [0260.859] timeGetTime () returned 0x5335b [0260.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.859] Sleep (dwMilliseconds=0xa) [0260.875] timeGetTime () returned 0x5336a [0260.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.875] Sleep (dwMilliseconds=0xa) [0260.890] timeGetTime () returned 0x5337a [0260.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.890] Sleep (dwMilliseconds=0xa) [0260.907] timeGetTime () returned 0x5338a [0260.907] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.907] Sleep (dwMilliseconds=0xa) [0260.922] timeGetTime () returned 0x53399 [0260.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.922] Sleep (dwMilliseconds=0xa) [0260.937] timeGetTime () returned 0x533a9 [0260.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.937] Sleep (dwMilliseconds=0xa) [0260.953] timeGetTime () returned 0x533b8 [0260.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.953] Sleep (dwMilliseconds=0xa) [0260.970] timeGetTime () returned 0x533c8 [0260.970] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.970] Sleep (dwMilliseconds=0xa) [0260.986] timeGetTime () returned 0x533d8 [0260.986] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0260.986] Sleep (dwMilliseconds=0xa) [0261.000] timeGetTime () returned 0x533e7 [0261.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.000] Sleep (dwMilliseconds=0xa) [0261.015] timeGetTime () returned 0x533f7 [0261.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.015] Sleep (dwMilliseconds=0xa) [0261.031] timeGetTime () returned 0x53407 [0261.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.031] Sleep (dwMilliseconds=0xa) [0261.047] timeGetTime () returned 0x53416 [0261.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.047] Sleep (dwMilliseconds=0xa) [0261.063] timeGetTime () returned 0x53426 [0261.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.063] Sleep (dwMilliseconds=0xa) [0261.078] timeGetTime () returned 0x53435 [0261.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.078] Sleep (dwMilliseconds=0xa) [0261.094] timeGetTime () returned 0x53445 [0261.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.094] Sleep (dwMilliseconds=0xa) [0261.109] timeGetTime () returned 0x53455 [0261.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.109] Sleep (dwMilliseconds=0xa) [0261.125] timeGetTime () returned 0x53464 [0261.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.125] Sleep (dwMilliseconds=0xa) [0261.140] timeGetTime () returned 0x53474 [0261.140] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.140] Sleep (dwMilliseconds=0xa) [0261.157] timeGetTime () returned 0x53484 [0261.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.157] Sleep (dwMilliseconds=0xa) [0261.172] timeGetTime () returned 0x53493 [0261.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.172] Sleep (dwMilliseconds=0xa) [0261.188] timeGetTime () returned 0x534a3 [0261.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.188] Sleep (dwMilliseconds=0xa) [0261.203] timeGetTime () returned 0x534b2 [0261.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.203] Sleep (dwMilliseconds=0xa) [0261.219] timeGetTime () returned 0x534c2 [0261.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.219] Sleep (dwMilliseconds=0xa) [0261.234] timeGetTime () returned 0x534d2 [0261.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0261.234] TranslateMessage (lpMsg=0x8bf798) returned 0 [0261.234] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0261.234] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0261.234] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0261.235] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.235] Sleep (dwMilliseconds=0xa) [0261.250] timeGetTime () returned 0x534e1 [0261.250] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0261.250] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0261.250] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.250] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0261.250] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0261.250] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0261.251] RegCloseKey (hKey=0x240) returned 0x0 [0261.251] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0261.251] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0261.251] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0261.251] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0261.251] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0261.251] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0261.251] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0261.251] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0261.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0261.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aab8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0261.251] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0261.251] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0261.468] FreeLibrary (hLibModule=0x77150000) returned 1 [0261.468] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0261.469] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0261.469] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0261.469] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0261.469] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0261.469] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.469] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0261.469] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0261.469] timeGetTime () returned 0x535bc [0261.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.469] Sleep (dwMilliseconds=0xa) [0261.516] timeGetTime () returned 0x535eb [0261.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.516] Sleep (dwMilliseconds=0xa) [0261.568] timeGetTime () returned 0x5361a [0261.568] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.568] Sleep (dwMilliseconds=0xa) [0261.612] timeGetTime () returned 0x53649 [0261.612] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.612] Sleep (dwMilliseconds=0xa) [0261.656] timeGetTime () returned 0x53678 [0261.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.656] Sleep (dwMilliseconds=0xa) [0261.703] timeGetTime () returned 0x536a6 [0261.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.703] Sleep (dwMilliseconds=0xa) [0261.719] timeGetTime () returned 0x536b6 [0261.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.719] Sleep (dwMilliseconds=0xa) [0261.734] timeGetTime () returned 0x536c6 [0261.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.734] Sleep (dwMilliseconds=0xa) [0261.759] timeGetTime () returned 0x536d6 [0261.759] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.759] Sleep (dwMilliseconds=0xa) [0261.791] timeGetTime () returned 0x536f5 [0261.791] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.791] Sleep (dwMilliseconds=0xa) [0261.812] timeGetTime () returned 0x53714 [0261.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.813] Sleep (dwMilliseconds=0xa) [0261.828] timeGetTime () returned 0x53723 [0261.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.828] Sleep (dwMilliseconds=0xa) [0261.844] timeGetTime () returned 0x53733 [0261.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.844] Sleep (dwMilliseconds=0xa) [0261.859] timeGetTime () returned 0x53743 [0261.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.859] Sleep (dwMilliseconds=0xa) [0261.876] timeGetTime () returned 0x53752 [0261.876] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.876] Sleep (dwMilliseconds=0xa) [0261.891] timeGetTime () returned 0x53762 [0261.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.891] Sleep (dwMilliseconds=0xa) [0261.911] timeGetTime () returned 0x53772 [0261.911] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.911] Sleep (dwMilliseconds=0xa) [0261.922] timeGetTime () returned 0x53781 [0261.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.922] Sleep (dwMilliseconds=0xa) [0261.937] timeGetTime () returned 0x53791 [0261.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.937] Sleep (dwMilliseconds=0xa) [0261.953] timeGetTime () returned 0x537a1 [0261.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.953] Sleep (dwMilliseconds=0xa) [0261.969] timeGetTime () returned 0x537b0 [0261.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.969] Sleep (dwMilliseconds=0xa) [0261.984] timeGetTime () returned 0x537c0 [0261.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0261.984] Sleep (dwMilliseconds=0xa) [0262.000] timeGetTime () returned 0x537cf [0262.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0262.000] TranslateMessage (lpMsg=0x8bf798) returned 0 [0262.000] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0262.000] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0262.000] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0262.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.000] Sleep (dwMilliseconds=0xa) [0262.016] timeGetTime () returned 0x537df [0262.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.016] Sleep (dwMilliseconds=0xa) [0262.032] timeGetTime () returned 0x537ef [0262.032] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.032] Sleep (dwMilliseconds=0xa) [0262.047] timeGetTime () returned 0x537fe [0262.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.047] Sleep (dwMilliseconds=0xa) [0262.063] timeGetTime () returned 0x5380e [0262.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.063] Sleep (dwMilliseconds=0xa) [0262.078] timeGetTime () returned 0x5381d [0262.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.078] Sleep (dwMilliseconds=0xa) [0262.094] timeGetTime () returned 0x5382d [0262.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.094] Sleep (dwMilliseconds=0xa) [0262.110] timeGetTime () returned 0x5383d [0262.110] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.110] Sleep (dwMilliseconds=0xa) [0262.125] timeGetTime () returned 0x5384c [0262.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.125] Sleep (dwMilliseconds=0xa) [0262.141] timeGetTime () returned 0x5385c [0262.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.141] Sleep (dwMilliseconds=0xa) [0262.156] timeGetTime () returned 0x5386c [0262.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.156] Sleep (dwMilliseconds=0xa) [0262.172] timeGetTime () returned 0x5387b [0262.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.172] Sleep (dwMilliseconds=0xa) [0262.187] timeGetTime () returned 0x5388b [0262.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.187] Sleep (dwMilliseconds=0xa) [0262.203] timeGetTime () returned 0x5389b [0262.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.203] Sleep (dwMilliseconds=0xa) [0262.219] timeGetTime () returned 0x538aa [0262.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.219] Sleep (dwMilliseconds=0xa) [0262.234] timeGetTime () returned 0x538ba [0262.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.234] Sleep (dwMilliseconds=0xa) [0262.251] timeGetTime () returned 0x538ca [0262.251] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.251] Sleep (dwMilliseconds=0xa) [0262.266] timeGetTime () returned 0x538d9 [0262.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.266] Sleep (dwMilliseconds=0xa) [0262.281] timeGetTime () returned 0x538e9 [0262.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.281] Sleep (dwMilliseconds=0xa) [0262.297] timeGetTime () returned 0x538f8 [0262.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.297] Sleep (dwMilliseconds=0xa) [0262.334] timeGetTime () returned 0x53917 [0262.334] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.334] Sleep (dwMilliseconds=0xa) [0262.359] timeGetTime () returned 0x53937 [0262.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.359] Sleep (dwMilliseconds=0xa) [0262.375] timeGetTime () returned 0x53946 [0262.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.375] Sleep (dwMilliseconds=0xa) [0262.390] timeGetTime () returned 0x53956 [0262.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.390] Sleep (dwMilliseconds=0xa) [0262.406] timeGetTime () returned 0x53966 [0262.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.406] Sleep (dwMilliseconds=0xa) [0262.422] timeGetTime () returned 0x53975 [0262.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.422] Sleep (dwMilliseconds=0xa) [0262.437] timeGetTime () returned 0x53985 [0262.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.437] Sleep (dwMilliseconds=0xa) [0262.453] timeGetTime () returned 0x53994 [0262.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.453] Sleep (dwMilliseconds=0xa) [0262.469] timeGetTime () returned 0x539a4 [0262.469] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0262.469] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0262.469] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.469] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0262.469] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0262.469] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0262.469] RegCloseKey (hKey=0x240) returned 0x0 [0262.469] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0262.469] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0262.469] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0262.469] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0262.469] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0262.470] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0262.470] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0262.470] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0262.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0262.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0262.470] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0262.470] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0262.578] FreeLibrary (hLibModule=0x77150000) returned 1 [0262.578] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0262.578] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0262.578] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0262.578] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0262.578] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0262.578] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.578] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0262.579] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0262.579] timeGetTime () returned 0x53a11 [0262.579] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.579] Sleep (dwMilliseconds=0xa) [0262.625] timeGetTime () returned 0x53a40 [0262.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.625] Sleep (dwMilliseconds=0xa) [0262.672] timeGetTime () returned 0x53a6f [0262.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.672] Sleep (dwMilliseconds=0xa) [0262.719] timeGetTime () returned 0x53a9e [0262.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.719] Sleep (dwMilliseconds=0xa) [0262.766] timeGetTime () returned 0x53acd [0262.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0262.766] TranslateMessage (lpMsg=0x8bf798) returned 0 [0262.766] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0262.766] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0262.766] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0262.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.766] Sleep (dwMilliseconds=0xa) [0262.799] timeGetTime () returned 0x53aee [0262.799] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.799] Sleep (dwMilliseconds=0xa) [0262.812] timeGetTime () returned 0x53afc [0262.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.812] Sleep (dwMilliseconds=0xa) [0262.828] timeGetTime () returned 0x53b0b [0262.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.828] Sleep (dwMilliseconds=0xa) [0262.844] timeGetTime () returned 0x53b1b [0262.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.844] Sleep (dwMilliseconds=0xa) [0262.867] timeGetTime () returned 0x53b2b [0262.867] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.867] Sleep (dwMilliseconds=0xa) [0262.901] timeGetTime () returned 0x53b4a [0262.901] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.901] Sleep (dwMilliseconds=0xa) [0262.922] timeGetTime () returned 0x53b69 [0262.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.922] Sleep (dwMilliseconds=0xa) [0262.937] timeGetTime () returned 0x53b79 [0262.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.937] Sleep (dwMilliseconds=0xa) [0262.953] timeGetTime () returned 0x53b88 [0262.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.953] Sleep (dwMilliseconds=0xa) [0262.969] timeGetTime () returned 0x53b98 [0262.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.969] Sleep (dwMilliseconds=0xa) [0262.984] timeGetTime () returned 0x53ba8 [0262.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0262.984] Sleep (dwMilliseconds=0xa) [0263.000] timeGetTime () returned 0x53bb7 [0263.001] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.001] Sleep (dwMilliseconds=0xa) [0263.016] timeGetTime () returned 0x53bc7 [0263.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.016] Sleep (dwMilliseconds=0xa) [0263.031] timeGetTime () returned 0x53bd7 [0263.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.031] Sleep (dwMilliseconds=0xa) [0263.047] timeGetTime () returned 0x53be6 [0263.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.047] Sleep (dwMilliseconds=0xa) [0263.062] timeGetTime () returned 0x53bf6 [0263.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.062] Sleep (dwMilliseconds=0xa) [0263.079] timeGetTime () returned 0x53c05 [0263.079] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.079] Sleep (dwMilliseconds=0xa) [0263.093] timeGetTime () returned 0x53c15 [0263.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.094] Sleep (dwMilliseconds=0xa) [0263.110] timeGetTime () returned 0x53c25 [0263.110] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.110] Sleep (dwMilliseconds=0xa) [0263.125] timeGetTime () returned 0x53c34 [0263.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.125] Sleep (dwMilliseconds=0xa) [0263.141] timeGetTime () returned 0x53c44 [0263.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.141] Sleep (dwMilliseconds=0xa) [0263.156] timeGetTime () returned 0x53c54 [0263.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.156] Sleep (dwMilliseconds=0xa) [0263.172] timeGetTime () returned 0x53c63 [0263.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.172] Sleep (dwMilliseconds=0xa) [0263.187] timeGetTime () returned 0x53c73 [0263.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.188] Sleep (dwMilliseconds=0xa) [0263.203] timeGetTime () returned 0x53c82 [0263.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.203] Sleep (dwMilliseconds=0xa) [0263.219] timeGetTime () returned 0x53c92 [0263.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.219] Sleep (dwMilliseconds=0xa) [0263.234] timeGetTime () returned 0x53ca2 [0263.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.234] Sleep (dwMilliseconds=0xa) [0263.251] timeGetTime () returned 0x53cb2 [0263.251] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.251] Sleep (dwMilliseconds=0xa) [0263.266] timeGetTime () returned 0x53cc1 [0263.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.266] Sleep (dwMilliseconds=0xa) [0263.281] timeGetTime () returned 0x53cd1 [0263.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.281] Sleep (dwMilliseconds=0xa) [0263.297] timeGetTime () returned 0x53ce0 [0263.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.297] Sleep (dwMilliseconds=0xa) [0263.312] timeGetTime () returned 0x53cf0 [0263.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.312] Sleep (dwMilliseconds=0xa) [0263.369] timeGetTime () returned 0x53d1f [0263.369] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.369] Sleep (dwMilliseconds=0xa) [0263.390] timeGetTime () returned 0x53d3e [0263.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.390] Sleep (dwMilliseconds=0xa) [0263.406] timeGetTime () returned 0x53d4e [0263.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.406] Sleep (dwMilliseconds=0xa) [0263.422] timeGetTime () returned 0x53d5d [0263.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.422] Sleep (dwMilliseconds=0xa) [0263.437] timeGetTime () returned 0x53d6d [0263.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.437] Sleep (dwMilliseconds=0xa) [0263.453] timeGetTime () returned 0x53d7c [0263.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.453] Sleep (dwMilliseconds=0xa) [0263.469] timeGetTime () returned 0x53d8c [0263.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.469] Sleep (dwMilliseconds=0xa) [0263.485] timeGetTime () returned 0x53d9c [0263.485] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.485] Sleep (dwMilliseconds=0xa) [0263.501] timeGetTime () returned 0x53dac [0263.501] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.501] Sleep (dwMilliseconds=0xa) [0263.515] timeGetTime () returned 0x53dbb [0263.515] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.515] Sleep (dwMilliseconds=0xa) [0263.531] timeGetTime () returned 0x53dcb [0263.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0263.531] TranslateMessage (lpMsg=0x8bf798) returned 0 [0263.531] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0263.531] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0263.531] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0263.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.531] Sleep (dwMilliseconds=0xa) [0263.547] timeGetTime () returned 0x53dda [0263.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.547] Sleep (dwMilliseconds=0xa) [0263.571] timeGetTime () returned 0x53dea [0263.571] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.571] Sleep (dwMilliseconds=0xa) [0263.595] timeGetTime () returned 0x53e09 [0263.595] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0263.595] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0263.595] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.595] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0263.595] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0263.595] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0263.595] RegCloseKey (hKey=0x240) returned 0x0 [0263.596] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0263.596] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0263.596] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0263.596] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0263.596] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0263.596] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0263.596] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0263.596] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0263.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0263.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0263.597] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0263.597] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0263.687] FreeLibrary (hLibModule=0x77150000) returned 1 [0263.687] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0263.687] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0263.688] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0263.688] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0263.688] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0263.688] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.688] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0263.688] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0263.688] timeGetTime () returned 0x53e67 [0263.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.688] Sleep (dwMilliseconds=0xa) [0263.734] timeGetTime () returned 0x53e96 [0263.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.734] Sleep (dwMilliseconds=0xa) [0263.781] timeGetTime () returned 0x53ec5 [0263.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.781] Sleep (dwMilliseconds=0xa) [0263.830] timeGetTime () returned 0x53ef3 [0263.830] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.830] Sleep (dwMilliseconds=0xa) [0263.875] timeGetTime () returned 0x53f22 [0263.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.875] Sleep (dwMilliseconds=0xa) [0263.922] timeGetTime () returned 0x53f51 [0263.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.922] Sleep (dwMilliseconds=0xa) [0263.937] timeGetTime () returned 0x53f61 [0263.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.937] Sleep (dwMilliseconds=0xa) [0263.960] timeGetTime () returned 0x53f70 [0263.960] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.960] Sleep (dwMilliseconds=0xa) [0263.984] timeGetTime () returned 0x53f90 [0263.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0263.985] Sleep (dwMilliseconds=0xa) [0264.012] timeGetTime () returned 0x53f9f [0264.013] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.013] Sleep (dwMilliseconds=0xa) [0264.031] timeGetTime () returned 0x53fbf [0264.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.031] Sleep (dwMilliseconds=0xa) [0264.047] timeGetTime () returned 0x53fce [0264.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.047] Sleep (dwMilliseconds=0xa) [0264.062] timeGetTime () returned 0x53fde [0264.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.063] Sleep (dwMilliseconds=0xa) [0264.078] timeGetTime () returned 0x53fed [0264.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.078] Sleep (dwMilliseconds=0xa) [0264.094] timeGetTime () returned 0x53ffd [0264.094] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.094] Sleep (dwMilliseconds=0xa) [0264.110] timeGetTime () returned 0x5400d [0264.110] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.110] Sleep (dwMilliseconds=0xa) [0264.125] timeGetTime () returned 0x5401c [0264.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.125] Sleep (dwMilliseconds=0xa) [0264.141] timeGetTime () returned 0x5402c [0264.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.141] Sleep (dwMilliseconds=0xa) [0264.162] timeGetTime () returned 0x54041 [0264.162] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.162] Sleep (dwMilliseconds=0xa) [0264.187] timeGetTime () returned 0x5405b [0264.187] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.187] Sleep (dwMilliseconds=0xa) [0264.203] timeGetTime () returned 0x5406a [0264.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.203] Sleep (dwMilliseconds=0xa) [0264.219] timeGetTime () returned 0x5407a [0264.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.219] Sleep (dwMilliseconds=0xa) [0264.234] timeGetTime () returned 0x5408a [0264.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.234] Sleep (dwMilliseconds=0xa) [0264.250] timeGetTime () returned 0x54099 [0264.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.250] Sleep (dwMilliseconds=0xa) [0264.266] timeGetTime () returned 0x540a9 [0264.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.266] Sleep (dwMilliseconds=0xa) [0264.281] timeGetTime () returned 0x540b9 [0264.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.281] Sleep (dwMilliseconds=0xa) [0264.297] timeGetTime () returned 0x540c8 [0264.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0264.297] TranslateMessage (lpMsg=0x8bf798) returned 0 [0264.297] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0264.297] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0264.297] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0264.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.297] Sleep (dwMilliseconds=0xa) [0264.312] timeGetTime () returned 0x540d8 [0264.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.312] Sleep (dwMilliseconds=0xa) [0264.328] timeGetTime () returned 0x540e7 [0264.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.328] Sleep (dwMilliseconds=0xa) [0264.374] timeGetTime () returned 0x54107 [0264.374] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.374] Sleep (dwMilliseconds=0xa) [0264.391] timeGetTime () returned 0x54126 [0264.391] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.391] Sleep (dwMilliseconds=0xa) [0264.406] timeGetTime () returned 0x54136 [0264.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.406] Sleep (dwMilliseconds=0xa) [0264.423] timeGetTime () returned 0x54146 [0264.423] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.423] Sleep (dwMilliseconds=0xa) [0264.440] timeGetTime () returned 0x54157 [0264.440] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.440] Sleep (dwMilliseconds=0xa) [0264.453] timeGetTime () returned 0x54164 [0264.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.453] Sleep (dwMilliseconds=0xa) [0264.470] timeGetTime () returned 0x54176 [0264.470] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.470] Sleep (dwMilliseconds=0xa) [0264.489] timeGetTime () returned 0x54188 [0264.489] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.489] Sleep (dwMilliseconds=0xa) [0264.500] timeGetTime () returned 0x54193 [0264.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.500] Sleep (dwMilliseconds=0xa) [0264.515] timeGetTime () returned 0x541a3 [0264.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.516] Sleep (dwMilliseconds=0xa) [0264.532] timeGetTime () returned 0x541b3 [0264.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.532] Sleep (dwMilliseconds=0xa) [0264.547] timeGetTime () returned 0x541c2 [0264.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.547] Sleep (dwMilliseconds=0xa) [0264.573] timeGetTime () returned 0x541d3 [0264.573] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.573] Sleep (dwMilliseconds=0xa) [0264.594] timeGetTime () returned 0x541f1 [0264.594] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.594] Sleep (dwMilliseconds=0xa) [0264.609] timeGetTime () returned 0x54201 [0264.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.609] Sleep (dwMilliseconds=0xa) [0264.627] timeGetTime () returned 0x54212 [0264.627] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.627] Sleep (dwMilliseconds=0xa) [0264.642] timeGetTime () returned 0x54220 [0264.642] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.642] Sleep (dwMilliseconds=0xa) [0264.656] timeGetTime () returned 0x54230 [0264.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.656] Sleep (dwMilliseconds=0xa) [0264.672] timeGetTime () returned 0x5423f [0264.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.672] Sleep (dwMilliseconds=0xa) [0264.687] timeGetTime () returned 0x5424f [0264.687] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0264.688] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0264.688] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.688] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0264.688] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0264.688] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0264.688] RegCloseKey (hKey=0x240) returned 0x0 [0264.688] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0264.688] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0264.688] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0264.688] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0264.688] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0264.688] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0264.688] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0264.689] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0264.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0264.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0264.689] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0264.689] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0264.781] FreeLibrary (hLibModule=0x77150000) returned 1 [0264.781] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0264.781] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0264.781] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0264.782] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0264.782] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0264.782] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.782] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0264.782] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0264.782] timeGetTime () returned 0x542ad [0264.782] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.782] Sleep (dwMilliseconds=0xa) [0264.828] timeGetTime () returned 0x542dc [0264.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.828] Sleep (dwMilliseconds=0xa) [0264.875] timeGetTime () returned 0x5430a [0264.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.875] Sleep (dwMilliseconds=0xa) [0264.922] timeGetTime () returned 0x54339 [0264.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.922] Sleep (dwMilliseconds=0xa) [0264.972] timeGetTime () returned 0x54368 [0264.972] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0264.972] Sleep (dwMilliseconds=0xa) [0265.016] timeGetTime () returned 0x54397 [0265.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.016] Sleep (dwMilliseconds=0xa) [0265.062] timeGetTime () returned 0x543c6 [0265.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0265.062] TranslateMessage (lpMsg=0x8bf798) returned 0 [0265.062] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0265.062] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0265.063] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0265.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.063] Sleep (dwMilliseconds=0xa) [0265.103] timeGetTime () returned 0x543e5 [0265.103] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.103] Sleep (dwMilliseconds=0xa) [0265.126] timeGetTime () returned 0x54404 [0265.126] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.126] Sleep (dwMilliseconds=0xa) [0265.141] timeGetTime () returned 0x54414 [0265.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.141] Sleep (dwMilliseconds=0xa) [0265.167] timeGetTime () returned 0x54424 [0265.167] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.167] Sleep (dwMilliseconds=0xa) [0265.188] timeGetTime () returned 0x54443 [0265.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.188] Sleep (dwMilliseconds=0xa) [0265.203] timeGetTime () returned 0x54453 [0265.203] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.203] Sleep (dwMilliseconds=0xa) [0265.220] timeGetTime () returned 0x54462 [0265.220] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.220] Sleep (dwMilliseconds=0xa) [0265.234] timeGetTime () returned 0x54472 [0265.234] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.234] Sleep (dwMilliseconds=0xa) [0265.250] timeGetTime () returned 0x54481 [0265.250] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.250] Sleep (dwMilliseconds=0xa) [0265.266] timeGetTime () returned 0x54491 [0265.266] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.266] Sleep (dwMilliseconds=0xa) [0265.281] timeGetTime () returned 0x544a1 [0265.281] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.281] Sleep (dwMilliseconds=0xa) [0265.309] timeGetTime () returned 0x544b0 [0265.309] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.309] Sleep (dwMilliseconds=0xa) [0265.328] timeGetTime () returned 0x544cf [0265.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.328] Sleep (dwMilliseconds=0xa) [0265.344] timeGetTime () returned 0x544df [0265.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.344] Sleep (dwMilliseconds=0xa) [0265.359] timeGetTime () returned 0x544ef [0265.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.359] Sleep (dwMilliseconds=0xa) [0265.375] timeGetTime () returned 0x544fe [0265.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.375] Sleep (dwMilliseconds=0xa) [0265.391] timeGetTime () returned 0x5450f [0265.391] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.391] Sleep (dwMilliseconds=0xa) [0265.406] timeGetTime () returned 0x5451e [0265.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.406] Sleep (dwMilliseconds=0xa) [0265.423] timeGetTime () returned 0x5452d [0265.423] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.423] Sleep (dwMilliseconds=0xa) [0265.437] timeGetTime () returned 0x5453d [0265.437] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.437] Sleep (dwMilliseconds=0xa) [0265.479] timeGetTime () returned 0x5455c [0265.479] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.479] Sleep (dwMilliseconds=0xa) [0265.500] timeGetTime () returned 0x5457b [0265.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.500] Sleep (dwMilliseconds=0xa) [0265.516] timeGetTime () returned 0x5458b [0265.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.516] Sleep (dwMilliseconds=0xa) [0265.531] timeGetTime () returned 0x5459b [0265.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.531] Sleep (dwMilliseconds=0xa) [0265.548] timeGetTime () returned 0x545aa [0265.548] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.548] Sleep (dwMilliseconds=0xa) [0265.562] timeGetTime () returned 0x545ba [0265.562] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.562] Sleep (dwMilliseconds=0xa) [0265.586] timeGetTime () returned 0x545ca [0265.586] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.587] Sleep (dwMilliseconds=0xa) [0265.610] timeGetTime () returned 0x545e9 [0265.610] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.610] Sleep (dwMilliseconds=0xa) [0265.625] timeGetTime () returned 0x545f8 [0265.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.625] Sleep (dwMilliseconds=0xa) [0265.642] timeGetTime () returned 0x54608 [0265.642] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.642] Sleep (dwMilliseconds=0xa) [0265.661] timeGetTime () returned 0x54618 [0265.661] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.661] Sleep (dwMilliseconds=0xa) [0265.672] timeGetTime () returned 0x54627 [0265.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.672] Sleep (dwMilliseconds=0xa) [0265.689] timeGetTime () returned 0x54637 [0265.689] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.689] Sleep (dwMilliseconds=0xa) [0265.726] timeGetTime () returned 0x54656 [0265.726] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.726] Sleep (dwMilliseconds=0xa) [0265.753] timeGetTime () returned 0x54675 [0265.753] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.753] Sleep (dwMilliseconds=0xa) [0265.766] timeGetTime () returned 0x54685 [0265.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.766] Sleep (dwMilliseconds=0xa) [0265.791] timeGetTime () returned 0x54695 [0265.791] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0265.791] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0265.791] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.791] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0265.791] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0265.791] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0265.792] RegCloseKey (hKey=0x240) returned 0x0 [0265.792] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0265.792] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0265.792] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0265.792] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0265.792] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0265.792] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0265.792] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0265.792] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0265.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0265.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aa38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0265.793] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0265.793] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0265.877] FreeLibrary (hLibModule=0x77150000) returned 1 [0265.877] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0265.877] TranslateMessage (lpMsg=0x8bf708) returned 0 [0265.877] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0265.877] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0265.878] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0265.878] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0265.878] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0265.878] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0265.878] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0265.878] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0265.878] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.878] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0265.878] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0265.878] timeGetTime () returned 0x546f2 [0265.878] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.878] Sleep (dwMilliseconds=0xa) [0265.922] timeGetTime () returned 0x54721 [0265.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.922] Sleep (dwMilliseconds=0xa) [0265.969] timeGetTime () returned 0x54750 [0265.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0265.969] Sleep (dwMilliseconds=0xa) [0266.018] timeGetTime () returned 0x5477f [0266.018] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.018] Sleep (dwMilliseconds=0xa) [0266.067] timeGetTime () returned 0x547ae [0266.067] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.067] Sleep (dwMilliseconds=0xa) [0266.136] timeGetTime () returned 0x547ec [0266.136] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.136] Sleep (dwMilliseconds=0xa) [0266.167] timeGetTime () returned 0x5480c [0266.167] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.167] Sleep (dwMilliseconds=0xa) [0266.188] timeGetTime () returned 0x5482b [0266.189] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.189] Sleep (dwMilliseconds=0xa) [0266.209] timeGetTime () returned 0x5483a [0266.209] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.209] Sleep (dwMilliseconds=0xa) [0266.221] timeGetTime () returned 0x5484b [0266.221] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.221] Sleep (dwMilliseconds=0xa) [0266.241] timeGetTime () returned 0x5485a [0266.241] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.242] Sleep (dwMilliseconds=0xa) [0266.279] timeGetTime () returned 0x54879 [0266.279] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.279] Sleep (dwMilliseconds=0xa) [0266.297] timeGetTime () returned 0x54898 [0266.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.297] Sleep (dwMilliseconds=0xa) [0266.316] timeGetTime () returned 0x548a8 [0266.316] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.316] Sleep (dwMilliseconds=0xa) [0266.329] timeGetTime () returned 0x548b7 [0266.329] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.329] Sleep (dwMilliseconds=0xa) [0266.407] timeGetTime () returned 0x54906 [0266.407] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.407] Sleep (dwMilliseconds=0xa) [0266.493] timeGetTime () returned 0x54954 [0266.493] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.493] Sleep (dwMilliseconds=0xa) [0266.521] timeGetTime () returned 0x54973 [0266.521] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.522] Sleep (dwMilliseconds=0xa) [0266.547] timeGetTime () returned 0x54992 [0266.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.547] Sleep (dwMilliseconds=0xa) [0266.562] timeGetTime () returned 0x549a2 [0266.562] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.562] Sleep (dwMilliseconds=0xa) [0266.584] timeGetTime () returned 0x549b1 [0266.584] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.584] Sleep (dwMilliseconds=0xa) [0266.609] timeGetTime () returned 0x549d1 [0266.609] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.609] Sleep (dwMilliseconds=0xa) [0266.625] timeGetTime () returned 0x549e0 [0266.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0266.625] TranslateMessage (lpMsg=0x8bf798) returned 0 [0266.625] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0266.625] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0266.625] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0266.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.625] Sleep (dwMilliseconds=0xa) [0266.641] timeGetTime () returned 0x549f0 [0266.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.641] Sleep (dwMilliseconds=0xa) [0266.656] timeGetTime () returned 0x54a00 [0266.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.656] Sleep (dwMilliseconds=0xa) [0266.672] timeGetTime () returned 0x54a0f [0266.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.672] Sleep (dwMilliseconds=0xa) [0266.688] timeGetTime () returned 0x54a1f [0266.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.688] Sleep (dwMilliseconds=0xa) [0266.731] timeGetTime () returned 0x54a3e [0266.731] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.731] Sleep (dwMilliseconds=0xa) [0266.765] timeGetTime () returned 0x54a5d [0266.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.765] Sleep (dwMilliseconds=0xa) [0266.784] timeGetTime () returned 0x54a7d [0266.784] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.784] Sleep (dwMilliseconds=0xa) [0266.797] timeGetTime () returned 0x54a8c [0266.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.797] Sleep (dwMilliseconds=0xa) [0266.814] timeGetTime () returned 0x54a9c [0266.814] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.814] Sleep (dwMilliseconds=0xa) [0266.845] timeGetTime () returned 0x54abb [0266.845] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.845] Sleep (dwMilliseconds=0xa) [0266.888] timeGetTime () returned 0x54ada [0266.888] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0266.888] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0266.888] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0266.888] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0266.888] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0266.888] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0266.888] RegCloseKey (hKey=0x240) returned 0x0 [0266.888] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0266.888] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0266.889] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0266.889] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0266.889] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0266.889] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0266.889] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0266.889] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0266.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0266.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0266.889] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0266.889] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0266.987] FreeLibrary (hLibModule=0x77150000) returned 1 [0266.987] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0266.987] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0266.987] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0266.987] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0266.987] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0266.988] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0266.988] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0266.988] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0266.988] timeGetTime () returned 0x54b48 [0266.988] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0266.988] Sleep (dwMilliseconds=0xa) [0267.048] timeGetTime () returned 0x54b86 [0267.048] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0267.048] Sleep (dwMilliseconds=0xa) [0267.127] timeGetTime () returned 0x54bd4 [0267.127] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0267.127] Sleep (dwMilliseconds=0xa) [0267.204] timeGetTime () returned 0x54c23 [0267.204] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0267.204] Sleep (dwMilliseconds=0xa) [0267.345] timeGetTime () returned 0x54caf [0267.345] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0267.345] Sleep (dwMilliseconds=0xa) [0267.545] timeGetTime () returned 0x54d6b [0267.545] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0267.545] TranslateMessage (lpMsg=0x8bf798) returned 0 [0267.545] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0267.545] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0267.545] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0267.545] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0267.545] Sleep (dwMilliseconds=0xa) [0267.637] timeGetTime () returned 0x54dc9 [0267.637] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0267.637] Sleep (dwMilliseconds=0xa) [0267.715] timeGetTime () returned 0x54e16 [0267.715] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0267.715] Sleep (dwMilliseconds=0xa) [0267.781] timeGetTime () returned 0x54e65 [0267.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0267.781] Sleep (dwMilliseconds=0xa) [0267.835] timeGetTime () returned 0x54e94 [0267.835] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0267.835] Sleep (dwMilliseconds=0xa) [0267.882] timeGetTime () returned 0x54ec2 [0267.882] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0267.882] Sleep (dwMilliseconds=0xa) [0267.924] timeGetTime () returned 0x54ef2 [0267.924] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0267.924] Sleep (dwMilliseconds=0xa) [0267.969] timeGetTime () returned 0x54f20 [0267.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0267.969] Sleep (dwMilliseconds=0xa) [0268.018] timeGetTime () returned 0x54f4f [0268.018] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0268.018] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0268.018] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0268.018] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0268.018] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0268.018] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0268.018] RegCloseKey (hKey=0x240) returned 0x0 [0268.018] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0268.019] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0268.019] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0268.019] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0268.019] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0268.019] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0268.019] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0268.019] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0268.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0268.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7ab38, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0268.019] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0268.020] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0268.112] FreeLibrary (hLibModule=0x77150000) returned 1 [0268.112] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0268.112] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0268.112] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0268.112] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0268.112] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0268.112] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0268.112] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0268.112] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0268.112] timeGetTime () returned 0x54fad [0268.112] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0268.112] Sleep (dwMilliseconds=0xa) [0268.206] timeGetTime () returned 0x5500d [0268.206] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0268.206] Sleep (dwMilliseconds=0xa) [0268.297] timeGetTime () returned 0x55068 [0268.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0268.297] TranslateMessage (lpMsg=0x8bf798) returned 0 [0268.297] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0268.297] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0268.297] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0268.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0268.297] Sleep (dwMilliseconds=0xa) [0268.394] timeGetTime () returned 0x550c6 [0268.394] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0268.394] Sleep (dwMilliseconds=0xa) [0268.484] timeGetTime () returned 0x55124 [0268.484] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0268.484] Sleep (dwMilliseconds=0xa) [0268.625] timeGetTime () returned 0x551b0 [0268.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0268.625] Sleep (dwMilliseconds=0xa) [0268.700] timeGetTime () returned 0x551ef [0268.700] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0268.700] Sleep (dwMilliseconds=0xa) [0268.746] timeGetTime () returned 0x5521e [0268.746] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0268.746] Sleep (dwMilliseconds=0xa) [0268.800] timeGetTime () returned 0x5525c [0268.800] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0268.800] Sleep (dwMilliseconds=0xa) [0268.851] timeGetTime () returned 0x5528b [0268.851] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0268.851] Sleep (dwMilliseconds=0xa) [0268.920] timeGetTime () returned 0x552ca [0268.920] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0268.920] Sleep (dwMilliseconds=0xa) [0268.967] timeGetTime () returned 0x552f8 [0268.967] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0268.967] Sleep (dwMilliseconds=0xa) [0269.538] timeGetTime () returned 0x5553e [0269.538] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 1 [0269.538] TranslateMessage (lpMsg=0x8bf968) returned 0 [0269.538] DispatchMessageW (lpMsg=0x8bf968) returned 0x0 [0269.538] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0269.538] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0269.538] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0269.539] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0269.539] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0269.539] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0269.539] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0269.539] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0269.539] RegCloseKey (hKey=0x240) returned 0x0 [0269.539] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0269.539] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0269.539] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0269.539] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0269.539] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0269.539] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0269.539] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0269.539] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0269.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0269.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0269.540] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0269.540] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0269.625] FreeLibrary (hLibModule=0x77150000) returned 1 [0269.625] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0269.625] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0269.625] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0269.625] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0269.625] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0269.625] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0269.625] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0269.626] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0269.626] timeGetTime () returned 0x55598 [0269.626] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0269.626] Sleep (dwMilliseconds=0xa) [0269.797] timeGetTime () returned 0x55645 [0269.798] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0269.798] Sleep (dwMilliseconds=0xa) [0269.875] timeGetTime () returned 0x55692 [0269.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0269.875] Sleep (dwMilliseconds=0xa) [0269.959] timeGetTime () returned 0x556e0 [0269.959] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0269.959] Sleep (dwMilliseconds=0xa) [0270.036] timeGetTime () returned 0x5572f [0270.036] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0270.036] Sleep (dwMilliseconds=0xa) [0270.095] timeGetTime () returned 0x5576d [0270.095] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0270.095] Sleep (dwMilliseconds=0xa) [0270.219] timeGetTime () returned 0x557ea [0270.219] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0270.219] Sleep (dwMilliseconds=0xa) [0270.314] timeGetTime () returned 0x55848 [0270.314] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0270.314] TranslateMessage (lpMsg=0x8bf798) returned 0 [0270.314] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0270.314] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0270.314] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0270.315] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0270.315] Sleep (dwMilliseconds=0xa) [0270.380] timeGetTime () returned 0x55886 [0270.380] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0270.380] Sleep (dwMilliseconds=0xa) [0270.416] timeGetTime () returned 0x558a6 [0270.416] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0270.416] Sleep (dwMilliseconds=0xa) [0270.510] timeGetTime () returned 0x55903 [0270.510] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0270.510] Sleep (dwMilliseconds=0xa) [0270.604] timeGetTime () returned 0x55961 [0270.604] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0270.604] Sleep (dwMilliseconds=0xa) [0270.679] timeGetTime () returned 0x559af [0270.679] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0270.679] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0270.679] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0270.679] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0270.679] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0270.679] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0270.679] RegCloseKey (hKey=0x240) returned 0x0 [0270.679] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0270.679] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0270.679] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0270.680] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0270.680] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0270.680] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0270.680] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0270.680] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0270.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0270.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7a9d8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0270.680] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0270.680] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0270.766] FreeLibrary (hLibModule=0x77150000) returned 1 [0270.766] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0270.766] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0270.766] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0270.766] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0270.766] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0270.766] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0270.766] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0270.766] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0270.766] timeGetTime () returned 0x55a0d [0270.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0270.766] Sleep (dwMilliseconds=0xa) [0270.860] timeGetTime () returned 0x55a6b [0270.860] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0270.860] Sleep (dwMilliseconds=0xa) [0270.971] timeGetTime () returned 0x55ad8 [0270.971] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0270.971] Sleep (dwMilliseconds=0xa) [0271.018] timeGetTime () returned 0x55b07 [0271.018] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.018] Sleep (dwMilliseconds=0xa) [0271.071] timeGetTime () returned 0x55b36 [0271.071] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0271.071] TranslateMessage (lpMsg=0x8bf798) returned 0 [0271.071] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0271.071] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0271.071] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0271.071] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.071] Sleep (dwMilliseconds=0xa) [0271.110] timeGetTime () returned 0x55b65 [0271.110] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.110] Sleep (dwMilliseconds=0xa) [0271.157] timeGetTime () returned 0x55b94 [0271.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.157] Sleep (dwMilliseconds=0xa) [0271.225] timeGetTime () returned 0x55bd2 [0271.225] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.225] Sleep (dwMilliseconds=0xa) [0271.277] timeGetTime () returned 0x55c01 [0271.277] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.277] Sleep (dwMilliseconds=0xa) [0271.305] timeGetTime () returned 0x55c20 [0271.305] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.305] Sleep (dwMilliseconds=0xa) [0271.335] timeGetTime () returned 0x55c3f [0271.335] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.335] Sleep (dwMilliseconds=0xa) [0271.360] timeGetTime () returned 0x55c5f [0271.360] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.360] Sleep (dwMilliseconds=0xa) [0271.375] timeGetTime () returned 0x55c6e [0271.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.375] Sleep (dwMilliseconds=0xa) [0271.390] timeGetTime () returned 0x55c7e [0271.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.390] Sleep (dwMilliseconds=0xa) [0271.408] timeGetTime () returned 0x55c8e [0271.408] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.408] Sleep (dwMilliseconds=0xa) [0271.422] timeGetTime () returned 0x55c9d [0271.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.422] Sleep (dwMilliseconds=0xa) [0271.465] timeGetTime () returned 0x55cbc [0271.465] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.465] Sleep (dwMilliseconds=0xa) [0271.500] timeGetTime () returned 0x55ceb [0271.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.500] Sleep (dwMilliseconds=0xa) [0271.534] timeGetTime () returned 0x55d0b [0271.534] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.534] Sleep (dwMilliseconds=0xa) [0271.578] timeGetTime () returned 0x55d39 [0271.578] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.578] Sleep (dwMilliseconds=0xa) [0271.622] timeGetTime () returned 0x55d59 [0271.622] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.622] Sleep (dwMilliseconds=0xa) [0271.641] timeGetTime () returned 0x55d78 [0271.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.641] Sleep (dwMilliseconds=0xa) [0271.656] timeGetTime () returned 0x55d88 [0271.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.656] Sleep (dwMilliseconds=0xa) [0271.672] timeGetTime () returned 0x55d97 [0271.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.672] Sleep (dwMilliseconds=0xa) [0271.687] timeGetTime () returned 0x55da7 [0271.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.687] Sleep (dwMilliseconds=0xa) [0271.750] timeGetTime () returned 0x55de5 [0271.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.750] Sleep (dwMilliseconds=0xa) [0271.797] timeGetTime () returned 0x55e14 [0271.797] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0271.797] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0271.797] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0271.797] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0271.798] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0271.798] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0271.798] RegCloseKey (hKey=0x240) returned 0x0 [0271.798] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0271.798] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0271.798] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0271.798] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0271.798] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0271.798] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0271.798] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0271.798] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0271.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0271.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7abf8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0271.799] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0271.799] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0271.890] FreeLibrary (hLibModule=0x77150000) returned 1 [0271.891] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 1 [0271.891] TranslateMessage (lpMsg=0x8bf708) returned 0 [0271.891] DispatchMessageW (lpMsg=0x8bf708) returned 0x0 [0271.891] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0271.891] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0271.891] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0271.891] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0271.891] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0271.891] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0271.891] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0271.891] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0271.891] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0271.891] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0271.891] timeGetTime () returned 0x55e72 [0271.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.891] Sleep (dwMilliseconds=0xa) [0271.984] timeGetTime () returned 0x55ed0 [0271.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0271.984] Sleep (dwMilliseconds=0xa) [0272.143] timeGetTime () returned 0x55f6c [0272.143] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.143] Sleep (dwMilliseconds=0xa) [0272.345] timeGetTime () returned 0x56037 [0272.345] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.345] Sleep (dwMilliseconds=0xa) [0272.392] timeGetTime () returned 0x56067 [0272.392] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.392] Sleep (dwMilliseconds=0xa) [0272.436] timeGetTime () returned 0x56085 [0272.436] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.436] Sleep (dwMilliseconds=0xa) [0272.453] timeGetTime () returned 0x560a4 [0272.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.453] Sleep (dwMilliseconds=0xa) [0272.468] timeGetTime () returned 0x560b4 [0272.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.469] Sleep (dwMilliseconds=0xa) [0272.493] timeGetTime () returned 0x560c4 [0272.493] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.493] Sleep (dwMilliseconds=0xa) [0272.525] timeGetTime () returned 0x560e3 [0272.525] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.525] Sleep (dwMilliseconds=0xa) [0272.547] timeGetTime () returned 0x56102 [0272.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.547] Sleep (dwMilliseconds=0xa) [0272.562] timeGetTime () returned 0x56112 [0272.562] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.562] Sleep (dwMilliseconds=0xa) [0272.578] timeGetTime () returned 0x56121 [0272.578] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.578] Sleep (dwMilliseconds=0xa) [0272.599] timeGetTime () returned 0x56131 [0272.599] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.599] Sleep (dwMilliseconds=0xa) [0272.625] timeGetTime () returned 0x56150 [0272.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.625] Sleep (dwMilliseconds=0xa) [0272.641] timeGetTime () returned 0x56160 [0272.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.641] Sleep (dwMilliseconds=0xa) [0272.656] timeGetTime () returned 0x56170 [0272.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0272.656] TranslateMessage (lpMsg=0x8bf798) returned 0 [0272.656] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0272.656] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0272.656] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0272.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.656] Sleep (dwMilliseconds=0xa) [0272.672] timeGetTime () returned 0x5617f [0272.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.672] Sleep (dwMilliseconds=0xa) [0272.688] timeGetTime () returned 0x5618f [0272.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.688] Sleep (dwMilliseconds=0xa) [0272.703] timeGetTime () returned 0x5619e [0272.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.704] Sleep (dwMilliseconds=0xa) [0272.719] timeGetTime () returned 0x561ae [0272.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.719] Sleep (dwMilliseconds=0xa) [0272.734] timeGetTime () returned 0x561be [0272.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.734] Sleep (dwMilliseconds=0xa) [0272.751] timeGetTime () returned 0x561cd [0272.751] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.751] Sleep (dwMilliseconds=0xa) [0272.766] timeGetTime () returned 0x561dd [0272.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.766] Sleep (dwMilliseconds=0xa) [0272.781] timeGetTime () returned 0x561ed [0272.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.781] Sleep (dwMilliseconds=0xa) [0272.797] timeGetTime () returned 0x561fc [0272.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.797] Sleep (dwMilliseconds=0xa) [0272.813] timeGetTime () returned 0x5620c [0272.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.813] Sleep (dwMilliseconds=0xa) [0272.851] timeGetTime () returned 0x5622b [0272.851] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.851] Sleep (dwMilliseconds=0xa) [0272.875] timeGetTime () returned 0x5624a [0272.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.875] Sleep (dwMilliseconds=0xa) [0272.891] timeGetTime () returned 0x5625a [0272.891] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0272.891] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0272.891] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0272.891] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0272.891] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0272.891] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0272.891] RegCloseKey (hKey=0x240) returned 0x0 [0272.891] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0272.891] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0272.891] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0272.891] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0272.891] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0272.891] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0272.891] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0272.892] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0272.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0272.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aaf8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0272.892] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0272.892] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0272.984] FreeLibrary (hLibModule=0x77150000) returned 1 [0272.984] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0272.984] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0272.984] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0272.984] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0272.985] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0272.985] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0272.985] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0272.985] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0272.985] timeGetTime () returned 0x562b8 [0272.985] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0272.985] Sleep (dwMilliseconds=0xa) [0273.031] timeGetTime () returned 0x562e7 [0273.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.031] Sleep (dwMilliseconds=0xa) [0273.062] timeGetTime () returned 0x56306 [0273.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.062] Sleep (dwMilliseconds=0xa) [0273.078] timeGetTime () returned 0x56315 [0273.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.078] Sleep (dwMilliseconds=0xa) [0273.111] timeGetTime () returned 0x56335 [0273.111] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.111] Sleep (dwMilliseconds=0xa) [0273.157] timeGetTime () returned 0x56364 [0273.157] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.157] Sleep (dwMilliseconds=0xa) [0273.242] timeGetTime () returned 0x563b2 [0273.242] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.242] Sleep (dwMilliseconds=0xa) [0273.265] timeGetTime () returned 0x563d1 [0273.265] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.266] Sleep (dwMilliseconds=0xa) [0273.288] timeGetTime () returned 0x563e1 [0273.288] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.288] Sleep (dwMilliseconds=0xa) [0273.312] timeGetTime () returned 0x56400 [0273.312] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.312] Sleep (dwMilliseconds=0xa) [0273.328] timeGetTime () returned 0x56410 [0273.328] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.328] Sleep (dwMilliseconds=0xa) [0273.344] timeGetTime () returned 0x5641f [0273.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.344] Sleep (dwMilliseconds=0xa) [0273.359] timeGetTime () returned 0x5642f [0273.359] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.359] Sleep (dwMilliseconds=0xa) [0273.375] timeGetTime () returned 0x5643e [0273.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.375] Sleep (dwMilliseconds=0xa) [0273.392] timeGetTime () returned 0x5644e [0273.392] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.392] Sleep (dwMilliseconds=0xa) [0273.406] timeGetTime () returned 0x5645e [0273.406] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.406] Sleep (dwMilliseconds=0xa) [0273.422] timeGetTime () returned 0x5646d [0273.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0273.422] TranslateMessage (lpMsg=0x8bf798) returned 0 [0273.422] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0273.422] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0273.422] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0273.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.422] Sleep (dwMilliseconds=0xa) [0273.438] timeGetTime () returned 0x5647d [0273.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.438] Sleep (dwMilliseconds=0xa) [0273.453] timeGetTime () returned 0x5648c [0273.453] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.453] Sleep (dwMilliseconds=0xa) [0273.469] timeGetTime () returned 0x5649c [0273.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.469] Sleep (dwMilliseconds=0xa) [0273.485] timeGetTime () returned 0x564ac [0273.485] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.485] Sleep (dwMilliseconds=0xa) [0273.500] timeGetTime () returned 0x564bb [0273.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.500] Sleep (dwMilliseconds=0xa) [0273.515] timeGetTime () returned 0x564cb [0273.515] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.515] Sleep (dwMilliseconds=0xa) [0273.531] timeGetTime () returned 0x564db [0273.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.531] Sleep (dwMilliseconds=0xa) [0273.548] timeGetTime () returned 0x564ea [0273.548] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.548] Sleep (dwMilliseconds=0xa) [0273.563] timeGetTime () returned 0x564fa [0273.563] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.563] Sleep (dwMilliseconds=0xa) [0273.578] timeGetTime () returned 0x56509 [0273.578] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.578] Sleep (dwMilliseconds=0xa) [0273.600] timeGetTime () returned 0x56519 [0273.600] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.600] Sleep (dwMilliseconds=0xa) [0273.625] timeGetTime () returned 0x56538 [0273.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.625] Sleep (dwMilliseconds=0xa) [0273.640] timeGetTime () returned 0x56548 [0273.640] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.640] Sleep (dwMilliseconds=0xa) [0273.656] timeGetTime () returned 0x56558 [0273.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.656] Sleep (dwMilliseconds=0xa) [0273.672] timeGetTime () returned 0x56567 [0273.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.672] Sleep (dwMilliseconds=0xa) [0273.687] timeGetTime () returned 0x56577 [0273.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.687] Sleep (dwMilliseconds=0xa) [0273.704] timeGetTime () returned 0x56587 [0273.704] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.704] Sleep (dwMilliseconds=0xa) [0273.718] timeGetTime () returned 0x56596 [0273.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.719] Sleep (dwMilliseconds=0xa) [0273.734] timeGetTime () returned 0x565a6 [0273.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.734] Sleep (dwMilliseconds=0xa) [0273.750] timeGetTime () returned 0x565b5 [0273.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.750] Sleep (dwMilliseconds=0xa) [0273.765] timeGetTime () returned 0x565c5 [0273.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.765] Sleep (dwMilliseconds=0xa) [0273.781] timeGetTime () returned 0x565d5 [0273.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.781] Sleep (dwMilliseconds=0xa) [0273.797] timeGetTime () returned 0x565e4 [0273.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.797] Sleep (dwMilliseconds=0xa) [0273.813] timeGetTime () returned 0x565f4 [0273.813] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.813] Sleep (dwMilliseconds=0xa) [0273.828] timeGetTime () returned 0x56603 [0273.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.828] Sleep (dwMilliseconds=0xa) [0273.843] timeGetTime () returned 0x56613 [0273.843] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.844] Sleep (dwMilliseconds=0xa) [0273.859] timeGetTime () returned 0x56623 [0273.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.859] Sleep (dwMilliseconds=0xa) [0273.875] timeGetTime () returned 0x56632 [0273.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.875] Sleep (dwMilliseconds=0xa) [0273.890] timeGetTime () returned 0x56642 [0273.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.890] Sleep (dwMilliseconds=0xa) [0273.906] timeGetTime () returned 0x56652 [0273.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.906] Sleep (dwMilliseconds=0xa) [0273.922] timeGetTime () returned 0x56661 [0273.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.922] Sleep (dwMilliseconds=0xa) [0273.937] timeGetTime () returned 0x56671 [0273.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.937] Sleep (dwMilliseconds=0xa) [0273.953] timeGetTime () returned 0x56680 [0273.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.953] Sleep (dwMilliseconds=0xa) [0273.968] timeGetTime () returned 0x56690 [0273.968] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0273.968] Sleep (dwMilliseconds=0xa) [0273.984] timeGetTime () returned 0x566a0 [0273.984] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0273.984] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0273.985] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0273.985] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0273.985] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0273.985] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0273.985] RegCloseKey (hKey=0x240) returned 0x0 [0273.985] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0273.985] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0273.985] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0273.985] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0273.985] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0273.985] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0273.985] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0273.985] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0273.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0273.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aad8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0273.986] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0273.986] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0274.078] FreeLibrary (hLibModule=0x77150000) returned 1 [0274.078] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0274.078] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0274.078] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0274.078] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0274.078] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0274.078] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0274.079] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0274.079] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0274.079] timeGetTime () returned 0x566fd [0274.079] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.079] Sleep (dwMilliseconds=0xa) [0274.125] timeGetTime () returned 0x5672c [0274.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.125] Sleep (dwMilliseconds=0xa) [0274.172] timeGetTime () returned 0x5675b [0274.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0274.172] TranslateMessage (lpMsg=0x8bf798) returned 0 [0274.172] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0274.172] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0274.172] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0274.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.172] Sleep (dwMilliseconds=0xa) [0274.252] timeGetTime () returned 0x567a9 [0274.252] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.252] Sleep (dwMilliseconds=0xa) [0274.297] timeGetTime () returned 0x567d8 [0274.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.297] Sleep (dwMilliseconds=0xa) [0274.336] timeGetTime () returned 0x567f8 [0274.336] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.336] Sleep (dwMilliseconds=0xa) [0274.360] timeGetTime () returned 0x56817 [0274.360] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.360] Sleep (dwMilliseconds=0xa) [0274.375] timeGetTime () returned 0x56826 [0274.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.375] Sleep (dwMilliseconds=0xa) [0274.400] timeGetTime () returned 0x56836 [0274.400] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.400] Sleep (dwMilliseconds=0xa) [0274.422] timeGetTime () returned 0x56855 [0274.422] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.422] Sleep (dwMilliseconds=0xa) [0274.438] timeGetTime () returned 0x56865 [0274.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.438] Sleep (dwMilliseconds=0xa) [0274.454] timeGetTime () returned 0x56874 [0274.455] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.455] Sleep (dwMilliseconds=0xa) [0274.469] timeGetTime () returned 0x56884 [0274.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.469] Sleep (dwMilliseconds=0xa) [0274.486] timeGetTime () returned 0x56896 [0274.487] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.487] Sleep (dwMilliseconds=0xa) [0274.500] timeGetTime () returned 0x568a3 [0274.500] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.500] Sleep (dwMilliseconds=0xa) [0274.516] timeGetTime () returned 0x568b3 [0274.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.516] Sleep (dwMilliseconds=0xa) [0274.532] timeGetTime () returned 0x568c3 [0274.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.532] Sleep (dwMilliseconds=0xa) [0274.548] timeGetTime () returned 0x568d2 [0274.548] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.548] Sleep (dwMilliseconds=0xa) [0274.562] timeGetTime () returned 0x568e2 [0274.562] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.562] Sleep (dwMilliseconds=0xa) [0274.578] timeGetTime () returned 0x568f1 [0274.578] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.578] Sleep (dwMilliseconds=0xa) [0274.600] timeGetTime () returned 0x56901 [0274.600] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.600] Sleep (dwMilliseconds=0xa) [0274.625] timeGetTime () returned 0x56920 [0274.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.625] Sleep (dwMilliseconds=0xa) [0274.641] timeGetTime () returned 0x56930 [0274.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.641] Sleep (dwMilliseconds=0xa) [0274.656] timeGetTime () returned 0x56940 [0274.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.656] Sleep (dwMilliseconds=0xa) [0274.672] timeGetTime () returned 0x5694f [0274.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.672] Sleep (dwMilliseconds=0xa) [0274.687] timeGetTime () returned 0x5695f [0274.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.687] Sleep (dwMilliseconds=0xa) [0274.703] timeGetTime () returned 0x5696e [0274.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.703] Sleep (dwMilliseconds=0xa) [0274.718] timeGetTime () returned 0x5697e [0274.718] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.718] Sleep (dwMilliseconds=0xa) [0274.734] timeGetTime () returned 0x5698e [0274.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.734] Sleep (dwMilliseconds=0xa) [0274.750] timeGetTime () returned 0x5699d [0274.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.750] Sleep (dwMilliseconds=0xa) [0274.766] timeGetTime () returned 0x569ad [0274.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.766] Sleep (dwMilliseconds=0xa) [0274.781] timeGetTime () returned 0x569bd [0274.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.781] Sleep (dwMilliseconds=0xa) [0274.797] timeGetTime () returned 0x569cc [0274.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.797] Sleep (dwMilliseconds=0xa) [0274.812] timeGetTime () returned 0x569dc [0274.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.812] Sleep (dwMilliseconds=0xa) [0274.828] timeGetTime () returned 0x569eb [0274.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.828] Sleep (dwMilliseconds=0xa) [0274.844] timeGetTime () returned 0x569fb [0274.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.844] Sleep (dwMilliseconds=0xa) [0274.859] timeGetTime () returned 0x56a0b [0274.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.859] Sleep (dwMilliseconds=0xa) [0274.876] timeGetTime () returned 0x56a1c [0274.876] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.876] Sleep (dwMilliseconds=0xa) [0274.890] timeGetTime () returned 0x56a2a [0274.890] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.890] Sleep (dwMilliseconds=0xa) [0274.906] timeGetTime () returned 0x56a3a [0274.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.906] Sleep (dwMilliseconds=0xa) [0274.921] timeGetTime () returned 0x56a49 [0274.922] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.922] Sleep (dwMilliseconds=0xa) [0274.938] timeGetTime () returned 0x56a59 [0274.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0274.938] TranslateMessage (lpMsg=0x8bf798) returned 0 [0274.938] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0274.938] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0274.938] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0274.938] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.938] Sleep (dwMilliseconds=0xa) [0274.953] timeGetTime () returned 0x56a68 [0274.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.953] Sleep (dwMilliseconds=0xa) [0274.968] timeGetTime () returned 0x56a78 [0274.969] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.969] Sleep (dwMilliseconds=0xa) [0274.984] timeGetTime () returned 0x56a88 [0274.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0274.984] Sleep (dwMilliseconds=0xa) [0275.000] timeGetTime () returned 0x56a97 [0275.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.000] Sleep (dwMilliseconds=0xa) [0275.015] timeGetTime () returned 0x56aa7 [0275.016] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.016] Sleep (dwMilliseconds=0xa) [0275.031] timeGetTime () returned 0x56ab7 [0275.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.031] Sleep (dwMilliseconds=0xa) [0275.047] timeGetTime () returned 0x56ac6 [0275.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.047] Sleep (dwMilliseconds=0xa) [0275.062] timeGetTime () returned 0x56ad6 [0275.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.062] Sleep (dwMilliseconds=0xa) [0275.078] timeGetTime () returned 0x56ae5 [0275.078] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0275.078] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0275.078] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0275.079] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0275.079] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0275.079] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0275.079] RegCloseKey (hKey=0x240) returned 0x0 [0275.079] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0275.079] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0275.079] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0275.079] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0275.079] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0275.079] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0275.079] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0275.079] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0275.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0275.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7aab8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0275.080] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0275.080] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0275.188] FreeLibrary (hLibModule=0x77150000) returned 1 [0275.188] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0275.188] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0275.188] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0275.188] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0275.188] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0275.188] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0275.188] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0275.188] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0275.188] timeGetTime () returned 0x56b53 [0275.188] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.188] Sleep (dwMilliseconds=0xa) [0275.264] timeGetTime () returned 0x56b91 [0275.264] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.264] Sleep (dwMilliseconds=0xa) [0275.297] timeGetTime () returned 0x56bc0 [0275.297] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.297] Sleep (dwMilliseconds=0xa) [0275.330] timeGetTime () returned 0x56bdf [0275.330] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.330] Sleep (dwMilliseconds=0xa) [0275.375] timeGetTime () returned 0x56c0e [0275.375] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.375] Sleep (dwMilliseconds=0xa) [0275.419] timeGetTime () returned 0x56c2e [0275.419] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.419] Sleep (dwMilliseconds=0xa) [0275.438] timeGetTime () returned 0x56c4d [0275.438] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.438] Sleep (dwMilliseconds=0xa) [0275.460] timeGetTime () returned 0x56c5c [0275.460] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.461] Sleep (dwMilliseconds=0xa) [0275.493] timeGetTime () returned 0x56c7c [0275.493] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.493] Sleep (dwMilliseconds=0xa) [0275.516] timeGetTime () returned 0x56c9b [0275.516] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.516] Sleep (dwMilliseconds=0xa) [0275.531] timeGetTime () returned 0x56cab [0275.531] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.531] Sleep (dwMilliseconds=0xa) [0275.548] timeGetTime () returned 0x56cba [0275.548] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.548] Sleep (dwMilliseconds=0xa) [0275.562] timeGetTime () returned 0x56cca [0275.562] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.562] Sleep (dwMilliseconds=0xa) [0275.578] timeGetTime () returned 0x56cd9 [0275.578] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.578] Sleep (dwMilliseconds=0xa) [0275.600] timeGetTime () returned 0x56ce9 [0275.600] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.600] Sleep (dwMilliseconds=0xa) [0275.625] timeGetTime () returned 0x56d08 [0275.625] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.626] Sleep (dwMilliseconds=0xa) [0275.640] timeGetTime () returned 0x56d18 [0275.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.641] Sleep (dwMilliseconds=0xa) [0275.656] timeGetTime () returned 0x56d28 [0275.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.656] Sleep (dwMilliseconds=0xa) [0275.674] timeGetTime () returned 0x56d37 [0275.674] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.674] Sleep (dwMilliseconds=0xa) [0275.687] timeGetTime () returned 0x56d47 [0275.687] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.687] Sleep (dwMilliseconds=0xa) [0275.703] timeGetTime () returned 0x56d56 [0275.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0275.703] TranslateMessage (lpMsg=0x8bf798) returned 0 [0275.703] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0275.703] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0275.703] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0275.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.703] Sleep (dwMilliseconds=0xa) [0275.719] timeGetTime () returned 0x56d66 [0275.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.719] Sleep (dwMilliseconds=0xa) [0275.734] timeGetTime () returned 0x56d76 [0275.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.734] Sleep (dwMilliseconds=0xa) [0275.750] timeGetTime () returned 0x56d85 [0275.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.750] Sleep (dwMilliseconds=0xa) [0275.765] timeGetTime () returned 0x56d95 [0275.765] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.765] Sleep (dwMilliseconds=0xa) [0275.781] timeGetTime () returned 0x56da5 [0275.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.781] Sleep (dwMilliseconds=0xa) [0275.797] timeGetTime () returned 0x56db4 [0275.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.797] Sleep (dwMilliseconds=0xa) [0275.829] timeGetTime () returned 0x56dd3 [0275.829] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.829] Sleep (dwMilliseconds=0xa) [0275.845] timeGetTime () returned 0x56de3 [0275.845] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.845] Sleep (dwMilliseconds=0xa) [0275.859] timeGetTime () returned 0x56df3 [0275.859] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.859] Sleep (dwMilliseconds=0xa) [0275.875] timeGetTime () returned 0x56e02 [0275.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.875] Sleep (dwMilliseconds=0xa) [0275.890] timeGetTime () returned 0x56e12 [0275.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.891] Sleep (dwMilliseconds=0xa) [0275.937] timeGetTime () returned 0x56e41 [0275.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.938] Sleep (dwMilliseconds=0xa) [0275.953] timeGetTime () returned 0x56e50 [0275.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.953] Sleep (dwMilliseconds=0xa) [0275.968] timeGetTime () returned 0x56e60 [0275.968] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.969] Sleep (dwMilliseconds=0xa) [0275.984] timeGetTime () returned 0x56e70 [0275.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0275.984] Sleep (dwMilliseconds=0xa) [0276.000] timeGetTime () returned 0x56e7f [0276.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.000] Sleep (dwMilliseconds=0xa) [0276.015] timeGetTime () returned 0x56e8f [0276.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.015] Sleep (dwMilliseconds=0xa) [0276.031] timeGetTime () returned 0x56e9f [0276.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.031] Sleep (dwMilliseconds=0xa) [0276.047] timeGetTime () returned 0x56eae [0276.047] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.047] Sleep (dwMilliseconds=0xa) [0276.063] timeGetTime () returned 0x56ebe [0276.063] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.063] Sleep (dwMilliseconds=0xa) [0276.078] timeGetTime () returned 0x56ecd [0276.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.078] Sleep (dwMilliseconds=0xa) [0276.093] timeGetTime () returned 0x56edd [0276.093] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.094] Sleep (dwMilliseconds=0xa) [0276.109] timeGetTime () returned 0x56eed [0276.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.109] Sleep (dwMilliseconds=0xa) [0276.125] timeGetTime () returned 0x56efc [0276.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.125] Sleep (dwMilliseconds=0xa) [0276.141] timeGetTime () returned 0x56f0c [0276.141] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.141] Sleep (dwMilliseconds=0xa) [0276.156] timeGetTime () returned 0x56f1c [0276.156] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.156] Sleep (dwMilliseconds=0xa) [0276.172] timeGetTime () returned 0x56f2b [0276.172] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.172] Sleep (dwMilliseconds=0xa) [0276.187] timeGetTime () returned 0x56f3b [0276.187] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0276.187] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0276.187] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf438 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0276.187] CharUpperBuffW (in: lpsz="HKCU", cchLength=0x4 | out: lpsz="HKCU") returned 0x4 [0276.188] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Desktop", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x8bf850, lpdwDisposition=0x8bf86c | out: phkResult=0x8bf850*=0x240, lpdwDisposition=0x8bf86c*=0x2) returned 0x0 [0276.188] RegSetValueExW (in: hKey=0x240, lpValueName="Wallpaper", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg", cbData=0x58 | out: lpData="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\wl.jpg") returned 0x0 [0276.188] RegCloseKey (hKey=0x240) returned 0x0 [0276.188] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0276.188] CharUpperBuffW (in: lpsz="A4C00F03061", cchLength=0xb | out: lpsz="A4C00F03061") returned 0xb [0276.188] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0276.188] CharUpperBuffW (in: lpsz="SSA4C00F03061", cchLength=0xd | out: lpsz="SSA4C00F03061") returned 0xd [0276.188] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0276.188] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0276.188] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0276.188] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77150000 [0276.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0276.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemParametersInfoW", cchWideChar=22, lpMultiByteStr=0x2c7acf8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemParametersInfoW", lpUsedDefaultChar=0x0) returned 22 [0276.189] GetProcAddress (hModule=0x77150000, lpProcName="SystemParametersInfoW") returned 0x7716bea0 [0276.189] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0276.297] FreeLibrary (hLibModule=0x77150000) returned 1 [0276.297] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0276.297] PeekMessageW (in: lpMsg=0x8bf708, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf708) returned 0 [0276.297] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0276.297] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0276.297] CharUpperBuffW (in: lpsz="tempdir", cchLength=0x7 | out: lpsz="TEMPDIR") returned 0x7 [0276.297] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8bf298 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0276.297] GetFileAttributesW (lpFileName="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp/8x8x8" (normalized: "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8x8x8")) returned 0x20 [0276.297] PeekMessageW (in: lpMsg=0x8bf968, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf968) returned 0 [0276.298] timeGetTime () returned 0x56fa8 [0276.298] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.298] Sleep (dwMilliseconds=0xa) [0276.344] timeGetTime () returned 0x56fd7 [0276.344] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.344] Sleep (dwMilliseconds=0xa) [0276.390] timeGetTime () returned 0x57006 [0276.390] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.390] Sleep (dwMilliseconds=0xa) [0276.424] timeGetTime () returned 0x57025 [0276.424] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.424] Sleep (dwMilliseconds=0xa) [0276.469] timeGetTime () returned 0x57054 [0276.469] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 1 [0276.469] TranslateMessage (lpMsg=0x8bf798) returned 0 [0276.469] DispatchMessageW (lpMsg=0x8bf798) returned 0x0 [0276.469] KillTimer (hWnd=0x3021a, uIDEvent=0x1) returned 1 [0276.469] SetTimer (hWnd=0x3021a, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0276.470] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.470] Sleep (dwMilliseconds=0xa) [0276.515] timeGetTime () returned 0x57083 [0276.515] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.515] Sleep (dwMilliseconds=0xa) [0276.532] timeGetTime () returned 0x57093 [0276.532] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.532] Sleep (dwMilliseconds=0xa) [0276.547] timeGetTime () returned 0x570a2 [0276.547] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.547] Sleep (dwMilliseconds=0xa) [0276.570] timeGetTime () returned 0x570b2 [0276.570] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.570] Sleep (dwMilliseconds=0xa) [0276.610] timeGetTime () returned 0x570e1 [0276.610] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.610] Sleep (dwMilliseconds=0xa) [0276.630] timeGetTime () returned 0x570f0 [0276.630] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.630] Sleep (dwMilliseconds=0xa) [0276.641] timeGetTime () returned 0x57100 [0276.641] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.641] Sleep (dwMilliseconds=0xa) [0276.656] timeGetTime () returned 0x57110 [0276.656] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.656] Sleep (dwMilliseconds=0xa) [0276.672] timeGetTime () returned 0x5711f [0276.672] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.672] Sleep (dwMilliseconds=0xa) [0276.688] timeGetTime () returned 0x5712f [0276.688] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.688] Sleep (dwMilliseconds=0xa) [0276.703] timeGetTime () returned 0x5713e [0276.703] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.703] Sleep (dwMilliseconds=0xa) [0276.719] timeGetTime () returned 0x5714e [0276.719] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.719] Sleep (dwMilliseconds=0xa) [0276.734] timeGetTime () returned 0x5715e [0276.734] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.734] Sleep (dwMilliseconds=0xa) [0276.750] timeGetTime () returned 0x5716d [0276.750] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.750] Sleep (dwMilliseconds=0xa) [0276.766] timeGetTime () returned 0x5717d [0276.766] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.766] Sleep (dwMilliseconds=0xa) [0276.781] timeGetTime () returned 0x5718d [0276.781] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.781] Sleep (dwMilliseconds=0xa) [0276.797] timeGetTime () returned 0x5719c [0276.797] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.797] Sleep (dwMilliseconds=0xa) [0276.812] timeGetTime () returned 0x571ac [0276.812] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.812] Sleep (dwMilliseconds=0xa) [0276.828] timeGetTime () returned 0x571bb [0276.828] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.828] Sleep (dwMilliseconds=0xa) [0276.844] timeGetTime () returned 0x571cb [0276.844] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.844] Sleep (dwMilliseconds=0xa) [0276.860] timeGetTime () returned 0x571db [0276.860] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.860] Sleep (dwMilliseconds=0xa) [0276.875] timeGetTime () returned 0x571ea [0276.875] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.875] Sleep (dwMilliseconds=0xa) [0276.891] timeGetTime () returned 0x571fa [0276.891] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.891] Sleep (dwMilliseconds=0xa) [0276.906] timeGetTime () returned 0x5720a [0276.906] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.906] Sleep (dwMilliseconds=0xa) [0276.923] timeGetTime () returned 0x57219 [0276.923] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.923] Sleep (dwMilliseconds=0xa) [0276.937] timeGetTime () returned 0x57229 [0276.937] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.937] Sleep (dwMilliseconds=0xa) [0276.953] timeGetTime () returned 0x57238 [0276.953] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.953] Sleep (dwMilliseconds=0xa) [0276.968] timeGetTime () returned 0x57248 [0276.968] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.969] Sleep (dwMilliseconds=0xa) [0276.984] timeGetTime () returned 0x57258 [0276.984] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0276.984] Sleep (dwMilliseconds=0xa) [0277.000] timeGetTime () returned 0x57267 [0277.000] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0277.000] Sleep (dwMilliseconds=0xa) [0277.015] timeGetTime () returned 0x57277 [0277.015] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0277.016] Sleep (dwMilliseconds=0xa) [0277.031] timeGetTime () returned 0x57287 [0277.031] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0277.031] Sleep (dwMilliseconds=0xa) [0277.062] timeGetTime () returned 0x572a6 [0277.062] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0277.062] Sleep (dwMilliseconds=0xa) [0277.078] timeGetTime () returned 0x572b5 [0277.078] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0277.078] Sleep (dwMilliseconds=0xa) [0277.095] timeGetTime () returned 0x572c6 [0277.095] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0277.095] Sleep (dwMilliseconds=0xa) [0277.109] timeGetTime () returned 0x572d5 [0277.109] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0277.109] Sleep (dwMilliseconds=0xa) [0277.125] timeGetTime () returned 0x572e4 [0277.125] PeekMessageW (in: lpMsg=0x8bf798, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x8bf798) returned 0 [0277.125] Sleep (dwMilliseconds=0xa) Thread: id = 14 os_tid = 0xf88 Thread: id = 15 os_tid = 0xf8c Thread: id = 16 os_tid = 0xf90 Thread: id = 17 os_tid = 0xf94 Process: id = "3" image_name = "openwith.exe" filename = "c:\\windows\\system32\\openwith.exe" page_root = "0x14173000" os_pid = "0xfb8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xdd4" cmd_line = "C:\\Windows\\system32\\OpenWith.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 475 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 476 start_va = 0xc386370000 end_va = 0xc38637ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c386370000" filename = "" Region: id = 477 start_va = 0xc386380000 end_va = 0xc386386fff entry_point = 0x0 region_type = private name = "private_0x000000c386380000" filename = "" Region: id = 478 start_va = 0xc386390000 end_va = 0xc3863a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c386390000" filename = "" Region: id = 479 start_va = 0xc3863b0000 end_va = 0xc38642ffff entry_point = 0x0 region_type = private name = "private_0x000000c3863b0000" filename = "" Region: id = 480 start_va = 0xc386430000 end_va = 0xc386433fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c386430000" filename = "" Region: id = 481 start_va = 0xc386440000 end_va = 0xc386442fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c386440000" filename = "" Region: id = 482 start_va = 0xc386450000 end_va = 0xc386451fff entry_point = 0x0 region_type = private name = "private_0x000000c386450000" filename = "" Region: id = 483 start_va = 0xc386460000 end_va = 0xc38651dfff entry_point = 0xc386460000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 484 start_va = 0xc386520000 end_va = 0xc38659ffff entry_point = 0x0 region_type = private name = "private_0x000000c386520000" filename = "" Region: id = 485 start_va = 0xc3865a0000 end_va = 0xc3865a6fff entry_point = 0x0 region_type = private name = "private_0x000000c3865a0000" filename = "" Region: id = 486 start_va = 0xc3865b0000 end_va = 0xc3865b0fff entry_point = 0xc3865b0000 region_type = mapped_file name = "openwith.exe.mui" filename = "\\Windows\\System32\\en-US\\OpenWith.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\openwith.exe.mui") Region: id = 487 start_va = 0xc3865c0000 end_va = 0xc3865c0fff entry_point = 0x0 region_type = private name = "private_0x000000c3865c0000" filename = "" Region: id = 488 start_va = 0xc3865d0000 end_va = 0xc3865d0fff entry_point = 0x0 region_type = private name = "private_0x000000c3865d0000" filename = "" Region: id = 489 start_va = 0xc3865e0000 end_va = 0xc3865e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c3865e0000" filename = "" Region: id = 490 start_va = 0xc3865f0000 end_va = 0xc3865f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c3865f0000" filename = "" Region: id = 491 start_va = 0xc386630000 end_va = 0xc38672ffff entry_point = 0x0 region_type = private name = "private_0x000000c386630000" filename = "" Region: id = 492 start_va = 0xc386730000 end_va = 0xc3868b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c386730000" filename = "" Region: id = 493 start_va = 0xc3868c0000 end_va = 0xc386a40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c3868c0000" filename = "" Region: id = 494 start_va = 0xc386aa0000 end_va = 0xc386aaffff entry_point = 0x0 region_type = private name = "private_0x000000c386aa0000" filename = "" Region: id = 495 start_va = 0xc386ab0000 end_va = 0xc387eaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c386ab0000" filename = "" Region: id = 496 start_va = 0xc387eb0000 end_va = 0xc387f2ffff entry_point = 0x0 region_type = private name = "private_0x000000c387eb0000" filename = "" Region: id = 497 start_va = 0xc387f80000 end_va = 0xc387f8ffff entry_point = 0x0 region_type = private name = "private_0x000000c387f80000" filename = "" Region: id = 498 start_va = 0xc387f90000 end_va = 0xc3882c6fff entry_point = 0xc387f90000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 499 start_va = 0xc3882d0000 end_va = 0xc38834ffff entry_point = 0x0 region_type = private name = "private_0x000000c3882d0000" filename = "" Region: id = 500 start_va = 0xc388350000 end_va = 0xc3883cffff entry_point = 0x0 region_type = private name = "private_0x000000c388350000" filename = "" Region: id = 501 start_va = 0xc3883d0000 end_va = 0xc38844ffff entry_point = 0x0 region_type = private name = "private_0x000000c3883d0000" filename = "" Region: id = 502 start_va = 0x7df5ff190000 end_va = 0x7ff5ff18ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff190000" filename = "" Region: id = 503 start_va = 0x7ff7bcf40000 end_va = 0x7ff7bd03ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bcf40000" filename = "" Region: id = 504 start_va = 0x7ff7bd040000 end_va = 0x7ff7bd062fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bd040000" filename = "" Region: id = 505 start_va = 0x7ff7bd063000 end_va = 0x7ff7bd064fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd063000" filename = "" Region: id = 506 start_va = 0x7ff7bd065000 end_va = 0x7ff7bd066fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd065000" filename = "" Region: id = 507 start_va = 0x7ff7bd067000 end_va = 0x7ff7bd068fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd067000" filename = "" Region: id = 508 start_va = 0x7ff7bd069000 end_va = 0x7ff7bd06afff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd069000" filename = "" Region: id = 509 start_va = 0x7ff7bd06b000 end_va = 0x7ff7bd06cfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd06b000" filename = "" Region: id = 510 start_va = 0x7ff7bd06d000 end_va = 0x7ff7bd06efff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd06d000" filename = "" Region: id = 511 start_va = 0x7ff7bd06f000 end_va = 0x7ff7bd06ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd06f000" filename = "" Region: id = 512 start_va = 0x7ff7bd650000 end_va = 0x7ff7bd669fff entry_point = 0x7ff7bd650000 region_type = mapped_file name = "openwith.exe" filename = "\\Windows\\System32\\OpenWith.exe" (normalized: "c:\\windows\\system32\\openwith.exe") Region: id = 513 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 514 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 515 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 516 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 517 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 518 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 519 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 520 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 521 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 522 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 523 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 524 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 525 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 526 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 527 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 528 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 529 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 530 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 531 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 532 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 533 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 534 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 535 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 536 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 537 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 538 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 539 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 540 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 541 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 542 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 544 start_va = 0xc386600000 end_va = 0xc386600fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c386600000" filename = "" Region: id = 545 start_va = 0xc386610000 end_va = 0xc386610fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c386610000" filename = "" Region: id = 546 start_va = 0x7ff8ddbd0000 end_va = 0x7ff8de6dcfff entry_point = 0x7ff8ddbd0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 547 start_va = 0x7ff8e9860000 end_va = 0x7ff8e994dfff entry_point = 0x7ff8e9860000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 548 start_va = 0xc386620000 end_va = 0xc386622fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c386620000" filename = "" Region: id = 549 start_va = 0x7ff8e3a70000 end_va = 0x7ff8e3c26fff entry_point = 0x7ff8e3a70000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 550 start_va = 0x7ff8e7430000 end_va = 0x7ff8e7560fff entry_point = 0x7ff8e7430000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 551 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 552 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1192 start_va = 0xc386a50000 end_va = 0xc386a79fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c386a50000" filename = "" Region: id = 1193 start_va = 0x7ff8d1330000 end_va = 0x7ff8d147bfff entry_point = 0x7ff8d1330000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 1194 start_va = 0xc386a80000 end_va = 0xc386a80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c386a80000" filename = "" Region: id = 1195 start_va = 0xc386a90000 end_va = 0xc386a91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c386a90000" filename = "" Region: id = 1196 start_va = 0x7ff8d1180000 end_va = 0x7ff8d132ffff entry_point = 0x7ff8d1180000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 1197 start_va = 0x7ff8d76a0000 end_va = 0x7ff8d7738fff entry_point = 0x7ff8d76a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 1198 start_va = 0xc387f30000 end_va = 0xc387f31fff entry_point = 0xc387f30000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 1199 start_va = 0xc387f40000 end_va = 0xc387f43fff entry_point = 0xc387f40000 region_type = mapped_file name = "windows.ui.immersive.dll.mui" filename = "\\Windows\\System32\\en-US\\Windows.UI.Immersive.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.ui.immersive.dll.mui") Region: id = 1200 start_va = 0xc388450000 end_va = 0xc3884cffff entry_point = 0x0 region_type = private name = "private_0x000000c388450000" filename = "" Region: id = 1201 start_va = 0xc3884d0000 end_va = 0xc38854ffff entry_point = 0x0 region_type = private name = "private_0x000000c3884d0000" filename = "" Region: id = 1202 start_va = 0xc388550000 end_va = 0xc3885cffff entry_point = 0x0 region_type = private name = "private_0x000000c388550000" filename = "" Region: id = 1203 start_va = 0x7ff7bcf3a000 end_va = 0x7ff7bcf3bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf3a000" filename = "" Region: id = 1204 start_va = 0x7ff7bcf3c000 end_va = 0x7ff7bcf3dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf3c000" filename = "" Region: id = 1205 start_va = 0x7ff7bcf3e000 end_va = 0x7ff7bcf3ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf3e000" filename = "" Region: id = 1206 start_va = 0x7ff8e37f0000 end_va = 0x7ff8e3a48fff entry_point = 0x7ff8e37f0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 1207 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 1208 start_va = 0xc3885d0000 end_va = 0xc3886fafff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c3885d0000" filename = "" Region: id = 1209 start_va = 0x7ff8e8650000 end_va = 0x7ff8e869afff entry_point = 0x7ff8e8650000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 1210 start_va = 0x7ff8e8c60000 end_va = 0x7ff8e8cfbfff entry_point = 0x7ff8e8c60000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 1211 start_va = 0x7ff8e8d00000 end_va = 0x7ff8e8fa2fff entry_point = 0x7ff8e8d00000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 1212 start_va = 0x7ff8e8860000 end_va = 0x7ff8e8acdfff entry_point = 0x7ff8e8860000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 1213 start_va = 0x7ff8e99e0000 end_va = 0x7ff8e9a07fff entry_point = 0x7ff8e99e0000 region_type = mapped_file name = "rmclient.dll" filename = "\\Windows\\System32\\rmclient.dll" (normalized: "c:\\windows\\system32\\rmclient.dll") Region: id = 1223 start_va = 0xc387f50000 end_va = 0xc387f50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c387f50000" filename = "" Region: id = 1224 start_va = 0xc387f60000 end_va = 0xc387f60fff entry_point = 0x0 region_type = private name = "private_0x000000c387f60000" filename = "" Region: id = 1225 start_va = 0xc387f70000 end_va = 0xc387f70fff entry_point = 0x0 region_type = private name = "private_0x000000c387f70000" filename = "" Region: id = 1226 start_va = 0xc388700000 end_va = 0xc3887fffff entry_point = 0x0 region_type = private name = "private_0x000000c388700000" filename = "" Region: id = 1227 start_va = 0xc388800000 end_va = 0xc38887ffff entry_point = 0x0 region_type = private name = "private_0x000000c388800000" filename = "" Region: id = 1228 start_va = 0x7ff7bcf38000 end_va = 0x7ff7bcf39fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf38000" filename = "" Region: id = 1229 start_va = 0x7ff8e9130000 end_va = 0x7ff8e9200fff entry_point = 0x7ff8e9130000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 1302 start_va = 0xc3885d0000 end_va = 0xc3885e3fff entry_point = 0xc3885d0000 region_type = mapped_file name = "twinui.dll.mui" filename = "\\Windows\\System32\\en-US\\twinui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\twinui.dll.mui") Region: id = 1303 start_va = 0xc388880000 end_va = 0xc388880fff entry_point = 0x0 region_type = private name = "private_0x000000c388880000" filename = "" Region: id = 1304 start_va = 0xc388890000 end_va = 0xc388890fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c388890000" filename = "" Region: id = 1305 start_va = 0x7ff8debc0000 end_va = 0x7ff8dec28fff entry_point = 0x7ff8debc0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 1318 start_va = 0xc3885f0000 end_va = 0xc3885f1fff entry_point = 0xc3885f0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 1319 start_va = 0xc388600000 end_va = 0xc388604fff entry_point = 0xc388600000 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 1320 start_va = 0xc388610000 end_va = 0xc388613fff entry_point = 0xc388610000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 1321 start_va = 0xc388620000 end_va = 0xc388632fff entry_point = 0xc388620000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 1322 start_va = 0xc388640000 end_va = 0xc388640fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c388640000" filename = "" Region: id = 1323 start_va = 0xc388650000 end_va = 0xc38866bfff entry_point = 0xc388650000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db") Region: id = 1324 start_va = 0xc388670000 end_va = 0xc3886effff entry_point = 0x0 region_type = private name = "private_0x000000c388670000" filename = "" Region: id = 1325 start_va = 0xc3888a0000 end_va = 0xc38899ffff entry_point = 0x0 region_type = private name = "private_0x000000c3888a0000" filename = "" Region: id = 1326 start_va = 0x7ff7bcf36000 end_va = 0x7ff7bcf37fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf36000" filename = "" Region: id = 1327 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1328 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 1329 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 1330 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1331 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 1332 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1333 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1334 start_va = 0x7ff8dcfd0000 end_va = 0x7ff8dd018fff entry_point = 0x7ff8dcfd0000 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 1335 start_va = 0xc3889a0000 end_va = 0xc388a1ffff entry_point = 0x0 region_type = private name = "private_0x000000c3889a0000" filename = "" Region: id = 1336 start_va = 0x7ff7bcf34000 end_va = 0x7ff7bcf35fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf34000" filename = "" Region: id = 1337 start_va = 0x7ff8dc6e0000 end_va = 0x7ff8dc778fff entry_point = 0x7ff8dc6e0000 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 1338 start_va = 0x7ff8dc780000 end_va = 0x7ff8dca11fff entry_point = 0x7ff8dc780000 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 2084 start_va = 0xc3886f0000 end_va = 0xc3886f3fff entry_point = 0xc3886f0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2085 start_va = 0xc388a20000 end_va = 0xc388a62fff entry_point = 0xc388a20000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db") Region: id = 2086 start_va = 0xc388a70000 end_va = 0xc388a73fff entry_point = 0xc388a70000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2087 start_va = 0xc388a80000 end_va = 0xc388b0afff entry_point = 0xc388a80000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 2088 start_va = 0xc388b10000 end_va = 0xc388c0ffff entry_point = 0x0 region_type = private name = "private_0x000000c388b10000" filename = "" Region: id = 2089 start_va = 0xc388c10000 end_va = 0xc388c12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c388c10000" filename = "" Region: id = 2090 start_va = 0xc388c20000 end_va = 0xc388c20fff entry_point = 0x0 region_type = private name = "private_0x000000c388c20000" filename = "" Region: id = 2091 start_va = 0xc388c30000 end_va = 0xc388c31fff entry_point = 0xc388c30000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 2092 start_va = 0xc388c40000 end_va = 0xc388c43fff entry_point = 0xc388c40000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 2093 start_va = 0xc388c50000 end_va = 0xc388c58fff entry_point = 0x0 region_type = private name = "private_0x000000c388c50000" filename = "" Region: id = 2094 start_va = 0xc388c60000 end_va = 0xc388c60fff entry_point = 0x0 region_type = private name = "private_0x000000c388c60000" filename = "" Region: id = 2095 start_va = 0xc388c70000 end_va = 0xc388c93fff entry_point = 0x0 region_type = private name = "private_0x000000c388c70000" filename = "" Region: id = 2096 start_va = 0xc388ca0000 end_va = 0xc388ca8fff entry_point = 0x0 region_type = private name = "private_0x000000c388ca0000" filename = "" Region: id = 2097 start_va = 0xc388cb0000 end_va = 0xc388daffff entry_point = 0x0 region_type = private name = "private_0x000000c388cb0000" filename = "" Region: id = 2098 start_va = 0xc388dc0000 end_va = 0xc388dc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c388dc0000" filename = "" Region: id = 2099 start_va = 0xc388dd0000 end_va = 0xc388dd1fff entry_point = 0xc388dd0000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 2100 start_va = 0xc388de0000 end_va = 0xc388edffff entry_point = 0xc388de0000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 2101 start_va = 0xc388ee0000 end_va = 0xc388f27fff entry_point = 0x0 region_type = private name = "private_0x000000c388ee0000" filename = "" Region: id = 2102 start_va = 0xc388f30000 end_va = 0xc388f40fff entry_point = 0xc388f30000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 2103 start_va = 0xc389c70000 end_va = 0xc389d6ffff entry_point = 0xc389c70000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 2104 start_va = 0x7ff8dd900000 end_va = 0x7ff8dd94afff entry_point = 0x7ff8dd900000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 2105 start_va = 0x7ff8e0a60000 end_va = 0x7ff8e0bf6fff entry_point = 0x7ff8e0a60000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 2106 start_va = 0x7ff8e86a0000 end_va = 0x7ff8e8851fff entry_point = 0x7ff8e86a0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 2109 start_va = 0xc388db0000 end_va = 0xc388db3fff entry_point = 0xc388db0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2110 start_va = 0xc388f50000 end_va = 0xc388f50fff entry_point = 0xc388f50000 region_type = mapped_file name = "microsoftedgesquare44x44.scale-100.png" filename = "\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Assets\\MicrosoftEdgeSquare44x44.scale-100.png" (normalized: "c:\\windows\\systemapps\\microsoft.microsoftedge_8wekyb3d8bbwe\\assets\\microsoftedgesquare44x44.scale-100.png") Region: id = 2111 start_va = 0x7ff8e2f70000 end_va = 0x7ff8e2fdafff entry_point = 0x7ff8e2f70000 region_type = mapped_file name = "photometadatahandler.dll" filename = "\\Windows\\System32\\PhotoMetadataHandler.dll" (normalized: "c:\\windows\\system32\\photometadatahandler.dll") Region: id = 2258 start_va = 0xc388f50000 end_va = 0xc388f51fff entry_point = 0xc388f50000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 2259 start_va = 0xc388f60000 end_va = 0xc388f60fff entry_point = 0x0 region_type = private name = "private_0x000000c388f60000" filename = "" Region: id = 2260 start_va = 0xc388f70000 end_va = 0xc388f7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c388f70000" filename = "" Region: id = 2261 start_va = 0xc388f80000 end_va = 0xc388f8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c388f80000" filename = "" Region: id = 2262 start_va = 0xc388f90000 end_va = 0xc388f9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c388f90000" filename = "" Region: id = 2263 start_va = 0xc388fa0000 end_va = 0xc38919ffff entry_point = 0x0 region_type = private name = "private_0x000000c388fa0000" filename = "" Region: id = 2264 start_va = 0xc3891a0000 end_va = 0xc38929ffff entry_point = 0xc3891a0000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 2265 start_va = 0xc3892a0000 end_va = 0xc3892a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c3892a0000" filename = "" Region: id = 2266 start_va = 0xc3892b0000 end_va = 0xc3892b0fff entry_point = 0x0 region_type = private name = "private_0x000000c3892b0000" filename = "" Region: id = 2267 start_va = 0xc3892c0000 end_va = 0xc3892c0fff entry_point = 0x0 region_type = private name = "private_0x000000c3892c0000" filename = "" Region: id = 2268 start_va = 0xc3892d0000 end_va = 0xc38934ffff entry_point = 0x0 region_type = private name = "private_0x000000c3892d0000" filename = "" Region: id = 2269 start_va = 0x7ff7bcf32000 end_va = 0x7ff7bcf33fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf32000" filename = "" Region: id = 2270 start_va = 0x7ff8dd8f0000 end_va = 0x7ff8dd8fcfff entry_point = 0x7ff8dd8f0000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 2271 start_va = 0x7ff8eac70000 end_va = 0x7ff8ead07fff entry_point = 0x7ff8eac70000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 2272 start_va = 0x7ff8e3070000 end_va = 0x7ff8e30f8fff entry_point = 0x7ff8e3070000 region_type = mapped_file name = "directmanipulation.dll" filename = "\\Windows\\System32\\directmanipulation.dll" (normalized: "c:\\windows\\system32\\directmanipulation.dll") Thread: id = 20 os_tid = 0xfd8 Thread: id = 21 os_tid = 0xfd4 Thread: id = 22 os_tid = 0xfd0 Thread: id = 23 os_tid = 0xfc8 Thread: id = 24 os_tid = 0xfbc [0071.236] TranslateMessage (lpMsg=0xc38642f848) returned 0 [0071.236] DispatchMessageW (lpMsg=0xc38642f848) returned 0x1 [0071.241] GetMessageW (in: lpMsg=0xc38642f848, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc38642f848) returned 1 [0071.244] TranslateMessage (lpMsg=0xc38642f848) returned 0 [0071.244] DispatchMessageW (lpMsg=0xc38642f848) returned 0x1 [0071.330] IUnknown_Set (in: ppunk=0xc386aa5f60*=0x0, punk=0xc386662f68 | out: ppunk=0xc386aa5f60*=0xc386662f68) [0071.330] GetMessageW (in: lpMsg=0xc38642f848, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc38642f848) returned 1 [0071.395] TranslateMessage (lpMsg=0xc38642f848) returned 0 [0071.395] DispatchMessageW (lpMsg=0xc38642f848) returned 0x1 [0071.395] GetMessageW (in: lpMsg=0xc38642f848, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc38642f848) returned 1 [0071.421] TranslateMessage (lpMsg=0xc38642f848) returned 0 [0071.421] DispatchMessageW (lpMsg=0xc38642f848) returned 0x1 [0071.421] Str_SetPtrW (in: ppsz=0xc386aa5fa8*=0x0, psz="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: ppsz=0xc386aa5fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0071.421] GetMessageW (in: lpMsg=0xc38642f848, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc38642f848) returned 1 [0071.431] TranslateMessage (lpMsg=0xc38642f848) returned 0 [0071.431] DispatchMessageW (lpMsg=0xc38642f848) returned 0x1 [0071.431] GetMessageW (in: lpMsg=0xc38642f848, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc38642f848) returned 1 [0071.439] TranslateMessage (lpMsg=0xc38642f848) returned 0 [0071.439] DispatchMessageW (lpMsg=0xc38642f848) returned 0x1 [0071.440] GetMessageW (in: lpMsg=0xc38642f848, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc38642f848) returned 1 [0071.450] TranslateMessage (lpMsg=0xc38642f848) returned 0 [0071.450] DispatchMessageW (lpMsg=0xc38642f848) returned 0x1 [0071.459] IUnknown_Set (in: ppunk=0xc386aa5fc0*=0x0, punk=0xc386667f58 | out: ppunk=0xc386aa5fc0*=0xc386667f58) [0071.459] GetMessageW (in: lpMsg=0xc38642f848, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc38642f848) returned 1 [0071.468] TranslateMessage (lpMsg=0xc38642f848) returned 0 [0071.468] DispatchMessageW (lpMsg=0xc38642f848) returned 0x1 [0071.468] GetMessageW (in: lpMsg=0xc38642f848, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc38642f848) returned 1 [0071.475] TranslateMessage (lpMsg=0xc38642f848) returned 0 [0071.475] DispatchMessageW (lpMsg=0xc38642f848) returned 0x1 [0071.475] GetMessageW (in: lpMsg=0xc38642f848, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc38642f848) returned 1 [0071.509] TranslateMessage (lpMsg=0xc38642f848) returned 0 [0071.509] DispatchMessageW (lpMsg=0xc38642f848) returned 0x1 [0071.510] CoTaskMemAlloc (cb=0xa) returned 0xc38664da30 [0071.521] GetMessageW (in: lpMsg=0xc38642f848, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc38642f848) returned 1 [0071.529] TranslateMessage (lpMsg=0xc38642f848) returned 0 [0071.529] DispatchMessageW (lpMsg=0xc38642f848) returned 0x1 [0071.529] GetMessageW (in: lpMsg=0xc38642f848, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc38642f848) returned 1 [0071.553] TranslateMessage (lpMsg=0xc38642f848) returned 0 [0071.553] DispatchMessageW (lpMsg=0xc38642f848) returned 0x1 [0071.553] GetMessageW (in: lpMsg=0xc38642f848, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc38642f848) returned 1 [0071.598] TranslateMessage (lpMsg=0xc38642f848) returned 0 [0071.599] DispatchMessageW (lpMsg=0xc38642f848) returned 0x1 [0071.599] KillTimer (hWnd=0x0, uIDEvent=0x7f94) returned 1 [0071.599] CompareStringOrdinal (lpString1="InvokeDefaultVerbInOtherProcess", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 1 [0071.599] CoCreateInstance (in: rclsid=0x7ff7bd6575b0*(Data1=0x94b23d4d, Data2=0x1040, Data3=0x4c4b, Data4=([0]=0x90, [1]=0x81, [2]=0x85, [3]=0xd8, [4]=0xd6, [5]=0xfa, [6]=0x36, [7]=0xc4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7bd657a50*(Data1=0xce149b23, Data2=0x5941, Data3=0x4079, Data4=([0]=0x92, [1]=0x23, [2]=0x52, [3]=0xc0, [4]=0xa9, [5]=0x91, [6]=0xec, [7]=0x48)), ppv=0xc386aa5fe0 | out: ppv=0xc386aa5fe0*=0xc386aa9620) returned 0x0 [0073.235] IUnknown_SetSite (punk=0xc386aa9620, punkSite=0xc386aa5f40) returned 0x0 [0073.339] IUnknown:QueryInterface (This=0xc386aa5f40, riid=0x7ff8ee00d438*(Data1=0x114, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xc38642e190) [0073.339] IUnknown:QueryInterface (This=0xc386aa5f40, riid=0x7ff8ee00d468*(Data1=0x79eac9ed, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xc38642e180) [0073.339] IUnknown:QueryInterface (This=0xc386aa5f40, riid=0x7ff8ee00d458*(Data1=0x214e3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xc38642e188) [0073.339] IUnknown:QueryInterface (This=0xc386aa5f40, riid=0x7ff8ee00d448*(Data1=0x45d64a29, Data2=0xa63e, Data3=0x4cb6, Data4=([0]=0xb4, [1]=0x98, [2]=0x57, [3]=0x81, [4]=0xd2, [5]=0x98, [6]=0xcb, [7]=0x4f)), ppvObject=0xc38642e198) [0073.339] IUnknown:QueryInterface (This=0xc386aa5f40, riid=0x7ff8eb8347d8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0xc38642e1c0) [0073.339] IUnknown:QueryInterface (in: This=0xc386662f68, riid=0x7ff8de1e0bd8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xc38642e1f0 | out: ppvObject=0xc38642e1f0*=0xc386662f68) returned 0x0 [0073.819] IUnknown:QueryInterface (This=0xc386aa5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc38642e1f0) [0073.819] IUnknown:AddRef (This=0xc386aa5f40) returned 0xe [0073.819] IUnknown_QueryService (in: punk=0xc386662f68, guidService=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), riid=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), ppvOut=0xc386aa96e0 | out: ppvOut=0xc386aa96e0*=0x0) returned 0x80004001 [0073.855] IUnknown:Release (This=0xc386aa5f40) returned 0xd [0073.855] IUnknown:QueryInterface (This=0xc386aa5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc38642e1f0) [0073.856] IUnknown:AddRef (This=0xc386aa5f40) returned 0xe [0073.856] IUnknown_QueryService (in: punk=0xc386662f68, guidService=0x7ff8de1c0980*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), riid=0x7ff8de1c0a40*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), ppvOut=0xc386aa96e8 | out: ppvOut=0xc386aa96e8*=0x0) returned 0x80004001 [0073.856] IUnknown:Release (This=0xc386aa5f40) returned 0xd [0073.856] IUnknown:QueryInterface (This=0xc386aa5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc38642e1f0) [0073.856] IUnknown:AddRef (This=0xc386aa5f40) returned 0xe [0073.856] IUnknown_QueryService (in: punk=0xc386662f68, guidService=0x7ff8de1c0950*(Data1=0xcde725b0, Data2=0xccc9, Data3=0x4519, Data4=([0]=0x91, [1]=0x7e, [2]=0x32, [3]=0x5d, [4]=0x72, [5]=0xfa, [6]=0xb4, [7]=0xce)), riid=0x7ff8de1d2fb0*(Data1=0x1af3a467, Data2=0x214f, Data3=0x4298, Data4=([0]=0x90, [1]=0x8e, [2]=0x6, [3]=0xb0, [4]=0x3e, [5]=0xb, [6]=0x39, [7]=0xf9)), ppvOut=0xc386aa96f0 | out: ppvOut=0xc386aa96f0*=0x0) returned 0x80004001 [0073.857] IUnknown:Release (This=0xc386aa5f40) returned 0xd [0073.857] IUnknown:QueryInterface (This=0xc386aa5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc38642e1f0) [0073.857] IUnknown:AddRef (This=0xc386aa5f40) returned 0xe [0073.857] IUnknown_QueryService (in: punk=0xc386662f68, guidService=0x7ff8de1c0800*(Data1=0x80605492, Data2=0x67d9, Data3=0x414f, Data4=([0]=0xaf, [1]=0x89, [2]=0xa1, [3]=0xcd, [4]=0xf1, [5]=0x24, [6]=0x2b, [7]=0xc1)), riid=0x7ff8de1c0068*(Data1=0xe5aa01f7, Data2=0x1fb8, Data3=0x4830, Data4=([0]=0x87, [1]=0x20, [2]=0x4e, [3]=0x67, [4]=0x34, [5]=0xcb, [6]=0xd5, [7]=0xf3)), ppvOut=0xc386aa96f8 | out: ppvOut=0xc386aa96f8*=0x0) returned 0x80004001 [0073.858] IUnknown:Release (This=0xc386aa5f40) returned 0xd [0073.858] IUnknown:QueryInterface (This=0xc386aa5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc38642e1f0) [0073.858] IUnknown:AddRef (This=0xc386aa5f40) returned 0xe [0073.858] IUnknown_QueryService (in: punk=0xc386662f68, guidService=0x7ff8de1c0810*(Data1=0x2ce78010, Data2=0x74db, Data3=0x48bc, Data4=([0]=0x9c, [1]=0x6a, [2]=0x10, [3]=0xf3, [4]=0x72, [5]=0x49, [6]=0x57, [7]=0x23)), riid=0x7ff8de1bfb70*(Data1=0x989191ac, Data2=0x28ff, Data3=0x4cf0, Data4=([0]=0x95, [1]=0x84, [2]=0xe0, [3]=0xd0, [4]=0x78, [5]=0xbc, [6]=0x23, [7]=0x96)), ppvOut=0xc386aa9700 | out: ppvOut=0xc386aa9700*=0x0) returned 0x80004001 [0073.858] IUnknown:Release (This=0xc386aa5f40) returned 0xd [0073.858] IUnknown:QueryInterface (This=0xc386aa5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc38642e1f0) [0073.858] IUnknown:AddRef (This=0xc386aa5f40) returned 0xe [0073.858] IUnknown_QueryService (in: punk=0xc386662f68, guidService=0x7ff8de1c0078*(Data1=0x26db2472, Data2=0xb7b7, Data3=0x406b, Data4=([0]=0x97, [1]=0x2, [2]=0x73, [3]=0xa, [4]=0x4e, [5]=0x20, [6]=0xd3, [7]=0xbf)), riid=0x7ff8de1c0a10*(Data1=0x2f0666c6, Data2=0x12f7, Data3=0x4360, Data4=([0]=0xb5, [1]=0x11, [2]=0xa3, [3]=0x94, [4]=0xa0, [5]=0x55, [6]=0x37, [7]=0x25)), ppvOut=0xc386aa9708 | out: ppvOut=0xc386aa9708*=0x0) returned 0x80004001 [0073.859] IUnknown:Release (This=0xc386aa5f40) returned 0xd [0073.859] IUnknown:QueryInterface (This=0xc386aa5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc38642e1f0) [0073.859] IUnknown:AddRef (This=0xc386aa5f40) returned 0xe [0073.859] IUnknown_QueryService (in: punk=0xc386662f68, guidService=0x7ff8de1c0930*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), riid=0x7ff8de1c0a30*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), ppvOut=0xc386aa9bf0 | out: ppvOut=0xc386aa9bf0*=0x0) returned 0x80004001 [0073.859] IUnknown:Release (This=0xc386aa5f40) returned 0xd [0073.859] IUnknown:QueryInterface (This=0xc386aa5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc38642e1f0) [0073.859] IUnknown:AddRef (This=0xc386aa5f40) returned 0xe [0073.859] IUnknown_QueryService (in: punk=0xc386662f68, guidService=0x7ff8de27c2c0*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff8de27fc98*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xc38642e230 | out: ppvOut=0xc38642e230*=0x0) returned 0x80004001 [0073.860] IUnknown:Release (This=0xc386aa5f40) returned 0xd [0073.860] IUnknown:AddRef (This=0xc386aa5f40) returned 0xe [0073.860] GetCurrentThreadId () returned 0xfbc [0073.860] PostThreadMessageW (idThread=0xfbc, Msg=0x8001, wParam=0x0, lParam=0x0) returned 1 [0073.860] GetMessageW (in: lpMsg=0xc38642f848, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc38642f848) returned 1 [0073.860] CompareStringOrdinal (lpString1="openas", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0073.861] CompareStringOrdinal (lpString1="OpenWithSetDefaultOn", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0073.861] IUnknown_QueryService (in: punk=0xc386662f68, guidService=0x7ff7bd657da0*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), riid=0x7ff7bd657910*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), ppvOut=0xc38642f8d8 | out: ppvOut=0xc38642f8d8*=0xc38666c238) returned 0x0 [0073.912] IUnknown_Set (in: ppunk=0xc386aa5f60*=0xc386662f68, punk=0x0 | out: ppunk=0xc386aa5f60*=0x0) [0073.914] IUnknown_QueryService (in: punk=0x0, guidService=0x7ff7bd657d60*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff7bd657950*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xc38642f828 | out: ppvOut=0xc38642f828*=0x0) returned 0x80004001 [0073.914] QISearch (in: that=0xc386aa5f30, pqit=0x7ff7bd657970, riid=0x7ff7bd657ac0*(Data1=0x1c9cd5bb, Data2=0x98e9, Data3=0x4491, Data4=([0]=0xa6, [1]=0xf, [2]=0x31, [3]=0xaa, [4]=0xcc, [5]=0x72, [6]=0xb8, [7]=0x3c)), ppv=0xc38642f788 | out: that=0xc386aa5f30, ppv=0xc38642f788*=0xc386aa5f78) returned 0x0 [0073.914] IUnknown:QueryInterface (in: This=0xc386667f58, riid=0x7ff7bd657930*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xc38642f820 | out: ppvObject=0xc38642f820*=0xc386667f58) returned 0x0 [0073.914] IShellItemArray:GetItemAt (in: This=0xc386667f58, dwIndex=0x0, ppsi=0xc38642f810 | out: ppsi=0xc38642f810*=0xc386662e48) returned 0x0 [0073.914] IUnknown:QueryInterface (in: This=0xc386662e48, riid=0x7ff7bd657b10*(Data1=0x7e9fb0d3, Data2=0x919f, Data3=0x4307, Data4=([0]=0xab, [1]=0x2e, [2]=0x9b, [3]=0x18, [4]=0x60, [5]=0x31, [6]=0xc, [7]=0x93)), ppvObject=0xc38642f818 | out: ppvObject=0xc38642f818*=0xc386662e48) returned 0x0 [0073.915] IUnknown:Release (This=0xc386662e48) returned 0x1 [0073.915] IShellItem:BindToHandler (in: This=0xc386662e48, pbc=0x0, bhid=0x7ff7bd657db0, riid=0x7ff7bd657920, ppv=0xc38642f810 | out: ppv=0xc38642f810) returned 0x0 [0073.919] IUnknown:Release (This=0xc386662e48) returned 0x0 [0073.919] IUnknown:Release (This=0xc386667f58) returned 0x1 [0073.919] IUnknown:AddRef (This=0xc386aa5f78) returned 0xf [0073.919] IObjectWithSelection:GetSelection (in: This=0xc386aa5f78, riid=0x7ff8de1c76a8, ppv=0xc386aa9718 | out: ppv=0xc386aa9718) returned 0x0 [0073.919] IUnknown:QueryInterface (in: This=0xc386667f58, riid=0x7ff8de1c76a8*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xc386aa9718 | out: ppvObject=0xc386aa9718*=0xc386667f58) returned 0x0 [0073.919] IUnknown:Release (This=0xc386aa5f78) returned 0xe [0073.941] IUnknown:Release (This=0xc386aa5f78) returned 0x7 [0073.941] IUnknown:Release (This=0xc386aa5f78) returned 0x6 Thread: id = 25 os_tid = 0xfdc Thread: id = 90 os_tid = 0x300 Thread: id = 91 os_tid = 0x204 Thread: id = 92 os_tid = 0x6a8 Thread: id = 102 os_tid = 0xc70 Thread: id = 106 os_tid = 0xc04 Thread: id = 109 os_tid = 0xc20 Thread: id = 200 os_tid = 0xce8 Thread: id = 201 os_tid = 0x7a0 Thread: id = 308 os_tid = 0xe58 Thread: id = 309 os_tid = 0x3a8 Process: id = "4" image_name = "openwith.exe" filename = "c:\\windows\\system32\\openwith.exe" page_root = "0x2a081000" os_pid = "0xfe0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xdd4" cmd_line = "C:\\Windows\\system32\\OpenWith.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 556 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 557 start_va = 0xe437580000 end_va = 0xe43758ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e437580000" filename = "" Region: id = 558 start_va = 0xe437590000 end_va = 0xe437596fff entry_point = 0x0 region_type = private name = "private_0x000000e437590000" filename = "" Region: id = 559 start_va = 0xe4375a0000 end_va = 0xe4375b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e4375a0000" filename = "" Region: id = 560 start_va = 0xe4375c0000 end_va = 0xe43763ffff entry_point = 0x0 region_type = private name = "private_0x000000e4375c0000" filename = "" Region: id = 561 start_va = 0xe437640000 end_va = 0xe437643fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e437640000" filename = "" Region: id = 562 start_va = 0xe437650000 end_va = 0xe437652fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e437650000" filename = "" Region: id = 563 start_va = 0xe437660000 end_va = 0xe437661fff entry_point = 0x0 region_type = private name = "private_0x000000e437660000" filename = "" Region: id = 564 start_va = 0xe437670000 end_va = 0xe43772dfff entry_point = 0xe437670000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 565 start_va = 0xe437730000 end_va = 0xe437736fff entry_point = 0x0 region_type = private name = "private_0x000000e437730000" filename = "" Region: id = 566 start_va = 0xe437740000 end_va = 0xe437740fff entry_point = 0xe437740000 region_type = mapped_file name = "openwith.exe.mui" filename = "\\Windows\\System32\\en-US\\OpenWith.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\openwith.exe.mui") Region: id = 567 start_va = 0xe437750000 end_va = 0xe437750fff entry_point = 0x0 region_type = private name = "private_0x000000e437750000" filename = "" Region: id = 568 start_va = 0xe437760000 end_va = 0xe437760fff entry_point = 0x0 region_type = private name = "private_0x000000e437760000" filename = "" Region: id = 569 start_va = 0xe437770000 end_va = 0xe437770fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e437770000" filename = "" Region: id = 570 start_va = 0xe437780000 end_va = 0xe43787ffff entry_point = 0x0 region_type = private name = "private_0x000000e437780000" filename = "" Region: id = 571 start_va = 0xe437880000 end_va = 0xe4378fffff entry_point = 0x0 region_type = private name = "private_0x000000e437880000" filename = "" Region: id = 572 start_va = 0xe437900000 end_va = 0xe437a87fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e437900000" filename = "" Region: id = 573 start_va = 0xe437a90000 end_va = 0xe437a91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e437a90000" filename = "" Region: id = 574 start_va = 0xe437ac0000 end_va = 0xe437acffff entry_point = 0x0 region_type = private name = "private_0x000000e437ac0000" filename = "" Region: id = 575 start_va = 0xe437ad0000 end_va = 0xe437b4ffff entry_point = 0x0 region_type = private name = "private_0x000000e437ad0000" filename = "" Region: id = 576 start_va = 0xe437b80000 end_va = 0xe437b8ffff entry_point = 0x0 region_type = private name = "private_0x000000e437b80000" filename = "" Region: id = 577 start_va = 0xe437b90000 end_va = 0xe437d10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e437b90000" filename = "" Region: id = 578 start_va = 0xe437d20000 end_va = 0xe43911ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e437d20000" filename = "" Region: id = 579 start_va = 0xe439120000 end_va = 0xe439456fff entry_point = 0xe439120000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 580 start_va = 0xe439460000 end_va = 0xe4394dffff entry_point = 0x0 region_type = private name = "private_0x000000e439460000" filename = "" Region: id = 581 start_va = 0xe4394e0000 end_va = 0xe43955ffff entry_point = 0x0 region_type = private name = "private_0x000000e4394e0000" filename = "" Region: id = 582 start_va = 0xe439560000 end_va = 0xe4395dffff entry_point = 0x0 region_type = private name = "private_0x000000e439560000" filename = "" Region: id = 583 start_va = 0x7df5ff440000 end_va = 0x7ff5ff43ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff440000" filename = "" Region: id = 584 start_va = 0x7ff7bc6fe000 end_va = 0x7ff7bc6fffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6fe000" filename = "" Region: id = 585 start_va = 0x7ff7bc700000 end_va = 0x7ff7bc7fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bc700000" filename = "" Region: id = 586 start_va = 0x7ff7bc800000 end_va = 0x7ff7bc822fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bc800000" filename = "" Region: id = 587 start_va = 0x7ff7bc824000 end_va = 0x7ff7bc825fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc824000" filename = "" Region: id = 588 start_va = 0x7ff7bc826000 end_va = 0x7ff7bc827fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc826000" filename = "" Region: id = 589 start_va = 0x7ff7bc828000 end_va = 0x7ff7bc828fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc828000" filename = "" Region: id = 590 start_va = 0x7ff7bc82a000 end_va = 0x7ff7bc82bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc82a000" filename = "" Region: id = 591 start_va = 0x7ff7bc82c000 end_va = 0x7ff7bc82dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc82c000" filename = "" Region: id = 592 start_va = 0x7ff7bc82e000 end_va = 0x7ff7bc82ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc82e000" filename = "" Region: id = 593 start_va = 0x7ff7bd650000 end_va = 0x7ff7bd669fff entry_point = 0x7ff7bd650000 region_type = mapped_file name = "openwith.exe" filename = "\\Windows\\System32\\OpenWith.exe" (normalized: "c:\\windows\\system32\\openwith.exe") Region: id = 594 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 595 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 596 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 597 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 598 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 599 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 600 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 601 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 602 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 603 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 604 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 605 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 606 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 607 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 608 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 609 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 610 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 611 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 612 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 613 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 614 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 615 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 616 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 617 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 618 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 619 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 620 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 621 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 622 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 623 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 631 start_va = 0xe437aa0000 end_va = 0xe437aa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e437aa0000" filename = "" Region: id = 632 start_va = 0xe437ab0000 end_va = 0xe437ab0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e437ab0000" filename = "" Region: id = 638 start_va = 0x7ff8ddbd0000 end_va = 0x7ff8de6dcfff entry_point = 0x7ff8ddbd0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 639 start_va = 0x7ff8e9860000 end_va = 0x7ff8e994dfff entry_point = 0x7ff8e9860000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 640 start_va = 0x7ff8e3a70000 end_va = 0x7ff8e3c26fff entry_point = 0x7ff8e3a70000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 641 start_va = 0xe437b50000 end_va = 0xe437b52fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e437b50000" filename = "" Region: id = 642 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 643 start_va = 0x7ff8e7430000 end_va = 0x7ff8e7560fff entry_point = 0x7ff8e7430000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 644 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1783 start_va = 0xe437b60000 end_va = 0xe437b60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e437b60000" filename = "" Region: id = 1784 start_va = 0xe437b70000 end_va = 0xe437b71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e437b70000" filename = "" Region: id = 1785 start_va = 0xe4395e0000 end_va = 0xe439609fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e4395e0000" filename = "" Region: id = 1786 start_va = 0xe439610000 end_va = 0xe43968ffff entry_point = 0x0 region_type = private name = "private_0x000000e439610000" filename = "" Region: id = 1787 start_va = 0xe439690000 end_va = 0xe43970ffff entry_point = 0x0 region_type = private name = "private_0x000000e439690000" filename = "" Region: id = 1788 start_va = 0xe439710000 end_va = 0xe439711fff entry_point = 0xe439710000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 1789 start_va = 0xe439720000 end_va = 0xe439723fff entry_point = 0xe439720000 region_type = mapped_file name = "windows.ui.immersive.dll.mui" filename = "\\Windows\\System32\\en-US\\Windows.UI.Immersive.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.ui.immersive.dll.mui") Region: id = 1790 start_va = 0xe439730000 end_va = 0xe4397affff entry_point = 0x0 region_type = private name = "private_0x000000e439730000" filename = "" Region: id = 1791 start_va = 0xe4397b0000 end_va = 0xe4398affff entry_point = 0x0 region_type = private name = "private_0x000000e4397b0000" filename = "" Region: id = 1792 start_va = 0xe4398b0000 end_va = 0xe4398b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e4398b0000" filename = "" Region: id = 1793 start_va = 0xe4398c0000 end_va = 0xe4398c0fff entry_point = 0x0 region_type = private name = "private_0x000000e4398c0000" filename = "" Region: id = 1794 start_va = 0xe4398d0000 end_va = 0xe4398d0fff entry_point = 0x0 region_type = private name = "private_0x000000e4398d0000" filename = "" Region: id = 1795 start_va = 0xe4398e0000 end_va = 0xe43995ffff entry_point = 0x0 region_type = private name = "private_0x000000e4398e0000" filename = "" Region: id = 1796 start_va = 0xe439960000 end_va = 0xe439960fff entry_point = 0x0 region_type = private name = "private_0x000000e439960000" filename = "" Region: id = 1797 start_va = 0xe439970000 end_va = 0xe439970fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e439970000" filename = "" Region: id = 1798 start_va = 0xe439980000 end_va = 0xe439993fff entry_point = 0xe439980000 region_type = mapped_file name = "twinui.dll.mui" filename = "\\Windows\\System32\\en-US\\twinui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\twinui.dll.mui") Region: id = 1799 start_va = 0xe4399a0000 end_va = 0xe4399a1fff entry_point = 0xe4399a0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 1800 start_va = 0xe4399b0000 end_va = 0xe4399b4fff entry_point = 0xe4399b0000 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 1801 start_va = 0xe4399c0000 end_va = 0xe439abffff entry_point = 0x0 region_type = private name = "private_0x000000e4399c0000" filename = "" Region: id = 1802 start_va = 0xe439ac0000 end_va = 0xe439ac3fff entry_point = 0xe439ac0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 1803 start_va = 0xe439ad0000 end_va = 0xe439ae2fff entry_point = 0xe439ad0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 1804 start_va = 0xe439af0000 end_va = 0xe439af0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e439af0000" filename = "" Region: id = 1805 start_va = 0xe439b00000 end_va = 0xe439b1bfff entry_point = 0xe439b00000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db") Region: id = 1806 start_va = 0xe439b20000 end_va = 0xe439b9ffff entry_point = 0x0 region_type = private name = "private_0x000000e439b20000" filename = "" Region: id = 1807 start_va = 0xe439ba0000 end_va = 0xe439c1ffff entry_point = 0x0 region_type = private name = "private_0x000000e439ba0000" filename = "" Region: id = 1808 start_va = 0x7ff7bc6f2000 end_va = 0x7ff7bc6f3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6f2000" filename = "" Region: id = 1809 start_va = 0x7ff7bc6f4000 end_va = 0x7ff7bc6f5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6f4000" filename = "" Region: id = 1810 start_va = 0x7ff7bc6f6000 end_va = 0x7ff7bc6f7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6f6000" filename = "" Region: id = 1811 start_va = 0x7ff7bc6f8000 end_va = 0x7ff7bc6f9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6f8000" filename = "" Region: id = 1812 start_va = 0x7ff7bc6fa000 end_va = 0x7ff7bc6fbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6fa000" filename = "" Region: id = 1813 start_va = 0x7ff7bc6fc000 end_va = 0x7ff7bc6fdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6fc000" filename = "" Region: id = 1814 start_va = 0x7ff8d1180000 end_va = 0x7ff8d132ffff entry_point = 0x7ff8d1180000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 1815 start_va = 0x7ff8d1330000 end_va = 0x7ff8d147bfff entry_point = 0x7ff8d1330000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 1816 start_va = 0x7ff8d76a0000 end_va = 0x7ff8d7738fff entry_point = 0x7ff8d76a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 1817 start_va = 0x7ff8dc6e0000 end_va = 0x7ff8dc778fff entry_point = 0x7ff8dc6e0000 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 1818 start_va = 0x7ff8dc780000 end_va = 0x7ff8dca11fff entry_point = 0x7ff8dc780000 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 1819 start_va = 0x7ff8dcfd0000 end_va = 0x7ff8dd018fff entry_point = 0x7ff8dcfd0000 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 1820 start_va = 0x7ff8debc0000 end_va = 0x7ff8dec28fff entry_point = 0x7ff8debc0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 1821 start_va = 0x7ff8e37f0000 end_va = 0x7ff8e3a48fff entry_point = 0x7ff8e37f0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 1822 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1823 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 1824 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 1825 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1826 start_va = 0x7ff8e8650000 end_va = 0x7ff8e869afff entry_point = 0x7ff8e8650000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 1827 start_va = 0x7ff8e8860000 end_va = 0x7ff8e8acdfff entry_point = 0x7ff8e8860000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 1828 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 1829 start_va = 0x7ff8e8c60000 end_va = 0x7ff8e8cfbfff entry_point = 0x7ff8e8c60000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 1830 start_va = 0x7ff8e8d00000 end_va = 0x7ff8e8fa2fff entry_point = 0x7ff8e8d00000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 1831 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 1832 start_va = 0x7ff8e9130000 end_va = 0x7ff8e9200fff entry_point = 0x7ff8e9130000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 1833 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1834 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1836 start_va = 0xe439c20000 end_va = 0xe439c23fff entry_point = 0xe439c20000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1837 start_va = 0xe439c30000 end_va = 0xe439c72fff entry_point = 0xe439c30000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db") Region: id = 1838 start_va = 0xe439c80000 end_va = 0xe439c83fff entry_point = 0xe439c80000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1839 start_va = 0xe439c90000 end_va = 0xe439d1afff entry_point = 0xe439c90000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 1840 start_va = 0xe439d20000 end_va = 0xe439e1ffff entry_point = 0x0 region_type = private name = "private_0x000000e439d20000" filename = "" Region: id = 1841 start_va = 0x7ff8dd900000 end_va = 0x7ff8dd94afff entry_point = 0x7ff8dd900000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 2188 start_va = 0xe439e20000 end_va = 0xe439e22fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e439e20000" filename = "" Region: id = 2189 start_va = 0xe439e30000 end_va = 0xe439e31fff entry_point = 0xe439e30000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 2190 start_va = 0xe439e40000 end_va = 0xe439f3ffff entry_point = 0xe439e40000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 2191 start_va = 0xe439f40000 end_va = 0xe439f42fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e439f40000" filename = "" Region: id = 2192 start_va = 0xe439f50000 end_va = 0xe439f50fff entry_point = 0x0 region_type = private name = "private_0x000000e439f50000" filename = "" Region: id = 2193 start_va = 0xe439f60000 end_va = 0xe439f63fff entry_point = 0xe439f60000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 2194 start_va = 0xe439f70000 end_va = 0xe439f73fff entry_point = 0xe439f70000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2195 start_va = 0xe439f80000 end_va = 0xe439f88fff entry_point = 0x0 region_type = private name = "private_0x000000e439f80000" filename = "" Region: id = 2196 start_va = 0xe439f90000 end_va = 0xe439f90fff entry_point = 0x0 region_type = private name = "private_0x000000e439f90000" filename = "" Region: id = 2197 start_va = 0xe439fa0000 end_va = 0xe439fc3fff entry_point = 0x0 region_type = private name = "private_0x000000e439fa0000" filename = "" Region: id = 2198 start_va = 0xe439fd0000 end_va = 0xe439fd8fff entry_point = 0x0 region_type = private name = "private_0x000000e439fd0000" filename = "" Region: id = 2199 start_va = 0xe439fe0000 end_va = 0xe43a0dffff entry_point = 0x0 region_type = private name = "private_0x000000e439fe0000" filename = "" Region: id = 2200 start_va = 0xe43a0e0000 end_va = 0xe43a0e0fff entry_point = 0xe43a0e0000 region_type = mapped_file name = "internet explorer.lnk" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk") Region: id = 2201 start_va = 0xe43a0f0000 end_va = 0xe43a0f1fff entry_point = 0xe43a0f0000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 2202 start_va = 0xe43a100000 end_va = 0xe43a1fffff entry_point = 0xe43a100000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 2203 start_va = 0xe43a200000 end_va = 0xe43a247fff entry_point = 0x0 region_type = private name = "private_0x000000e43a200000" filename = "" Region: id = 2204 start_va = 0xe43a250000 end_va = 0xe43a260fff entry_point = 0xe43a250000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 2205 start_va = 0xe43a270000 end_va = 0xe43a270fff entry_point = 0x0 region_type = private name = "private_0x000000e43a270000" filename = "" Region: id = 2206 start_va = 0xe43a280000 end_va = 0xe43a28ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e43a280000" filename = "" Region: id = 2207 start_va = 0xe43a290000 end_va = 0xe43a29ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e43a290000" filename = "" Region: id = 2208 start_va = 0xe43a2a0000 end_va = 0xe43a2affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e43a2a0000" filename = "" Region: id = 2209 start_va = 0x7ff8dd8f0000 end_va = 0x7ff8dd8fcfff entry_point = 0x7ff8dd8f0000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 2210 start_va = 0x7ff8e0a60000 end_va = 0x7ff8e0bf6fff entry_point = 0x7ff8e0a60000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 2211 start_va = 0x7ff8e2f70000 end_va = 0x7ff8e2fdafff entry_point = 0x7ff8e2f70000 region_type = mapped_file name = "photometadatahandler.dll" filename = "\\Windows\\System32\\PhotoMetadataHandler.dll" (normalized: "c:\\windows\\system32\\photometadatahandler.dll") Region: id = 2212 start_va = 0x7ff8e86a0000 end_va = 0x7ff8e8851fff entry_point = 0x7ff8e86a0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Thread: id = 27 os_tid = 0xff4 Thread: id = 28 os_tid = 0xff0 Thread: id = 29 os_tid = 0xfec Thread: id = 30 os_tid = 0xfe8 Thread: id = 31 os_tid = 0xfe4 [0073.754] TranslateMessage (lpMsg=0xe43763f9e8) returned 0 [0073.754] DispatchMessageW (lpMsg=0xe43763f9e8) returned 0x1 [0073.758] GetMessageW (in: lpMsg=0xe43763f9e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe43763f9e8) returned 1 [0073.758] TranslateMessage (lpMsg=0xe43763f9e8) returned 0 [0073.758] DispatchMessageW (lpMsg=0xe43763f9e8) returned 0x1 [0073.911] IUnknown_Set (in: ppunk=0xe437b85f60*=0x0, punk=0xe4377b29a8 | out: ppunk=0xe437b85f60*=0xe4377b29a8) [0073.911] GetMessageW (in: lpMsg=0xe43763f9e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe43763f9e8) returned 1 [0074.049] TranslateMessage (lpMsg=0xe43763f9e8) returned 0 [0074.049] DispatchMessageW (lpMsg=0xe43763f9e8) returned 0x1 [0074.049] GetMessageW (in: lpMsg=0xe43763f9e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe43763f9e8) returned 1 [0074.056] TranslateMessage (lpMsg=0xe43763f9e8) returned 0 [0074.056] DispatchMessageW (lpMsg=0xe43763f9e8) returned 0x1 [0074.056] Str_SetPtrW (in: ppsz=0xe437b85fa8*=0x0, psz="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: ppsz=0xe437b85fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0074.058] GetMessageW (in: lpMsg=0xe43763f9e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe43763f9e8) returned 1 [0074.080] TranslateMessage (lpMsg=0xe43763f9e8) returned 0 [0074.080] DispatchMessageW (lpMsg=0xe43763f9e8) returned 0x1 [0074.080] GetMessageW (in: lpMsg=0xe43763f9e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe43763f9e8) returned 1 [0074.094] TranslateMessage (lpMsg=0xe43763f9e8) returned 0 [0074.094] DispatchMessageW (lpMsg=0xe43763f9e8) returned 0x1 [0074.095] GetMessageW (in: lpMsg=0xe43763f9e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe43763f9e8) returned 1 [0074.105] TranslateMessage (lpMsg=0xe43763f9e8) returned 0 [0074.105] DispatchMessageW (lpMsg=0xe43763f9e8) returned 0x1 [0074.116] IUnknown_Set (in: ppunk=0xe437b85fc0*=0x0, punk=0xe4377b7e58 | out: ppunk=0xe437b85fc0*=0xe4377b7e58) [0074.116] GetMessageW (in: lpMsg=0xe43763f9e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe43763f9e8) returned 1 [0074.147] TranslateMessage (lpMsg=0xe43763f9e8) returned 0 [0074.147] DispatchMessageW (lpMsg=0xe43763f9e8) returned 0x1 [0074.147] GetMessageW (in: lpMsg=0xe43763f9e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe43763f9e8) returned 1 [0074.192] TranslateMessage (lpMsg=0xe43763f9e8) returned 0 [0074.192] DispatchMessageW (lpMsg=0xe43763f9e8) returned 0x1 [0074.193] GetMessageW (in: lpMsg=0xe43763f9e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe43763f9e8) returned 1 [0074.286] TranslateMessage (lpMsg=0xe43763f9e8) returned 0 [0074.286] DispatchMessageW (lpMsg=0xe43763f9e8) returned 0x1 [0074.286] CoTaskMemAlloc (cb=0xa) returned 0xe43779d6a0 [0074.377] GetMessageW (in: lpMsg=0xe43763f9e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe43763f9e8) returned 1 [0074.425] TranslateMessage (lpMsg=0xe43763f9e8) returned 0 [0074.425] DispatchMessageW (lpMsg=0xe43763f9e8) returned 0x1 [0074.426] GetMessageW (in: lpMsg=0xe43763f9e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe43763f9e8) returned 1 [0074.564] TranslateMessage (lpMsg=0xe43763f9e8) returned 0 [0074.564] DispatchMessageW (lpMsg=0xe43763f9e8) returned 0x1 [0074.564] GetMessageW (in: lpMsg=0xe43763f9e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe43763f9e8) returned 1 [0074.578] TranslateMessage (lpMsg=0xe43763f9e8) returned 0 [0074.578] DispatchMessageW (lpMsg=0xe43763f9e8) returned 0x1 [0074.578] KillTimer (hWnd=0x0, uIDEvent=0x7f92) returned 1 [0074.578] CompareStringOrdinal (lpString1="InvokeDefaultVerbInOtherProcess", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 1 [0074.578] CoCreateInstance (in: rclsid=0x7ff7bd6575b0*(Data1=0x94b23d4d, Data2=0x1040, Data3=0x4c4b, Data4=([0]=0x90, [1]=0x81, [2]=0x85, [3]=0xd8, [4]=0xd6, [5]=0xfa, [6]=0x36, [7]=0xc4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7bd657a50*(Data1=0xce149b23, Data2=0x5941, Data3=0x4079, Data4=([0]=0x92, [1]=0x23, [2]=0x52, [3]=0xc0, [4]=0xa9, [5]=0x91, [6]=0xec, [7]=0x48)), ppv=0xe437b85fe0 | out: ppv=0xe437b85fe0*=0xe437b89620) returned 0x0 [0074.598] IUnknown_SetSite (punk=0xe437b89620, punkSite=0xe437b85f40) returned 0x0 [0074.598] IUnknown:QueryInterface (This=0xe437b85f40, riid=0x7ff8ee00d438*(Data1=0x114, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xe43763e330) [0074.598] IUnknown:QueryInterface (This=0xe437b85f40, riid=0x7ff8ee00d468*(Data1=0x79eac9ed, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xe43763e320) [0074.598] IUnknown:QueryInterface (This=0xe437b85f40, riid=0x7ff8ee00d458*(Data1=0x214e3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xe43763e328) [0074.598] IUnknown:QueryInterface (This=0xe437b85f40, riid=0x7ff8ee00d448*(Data1=0x45d64a29, Data2=0xa63e, Data3=0x4cb6, Data4=([0]=0xb4, [1]=0x98, [2]=0x57, [3]=0x81, [4]=0xd2, [5]=0x98, [6]=0xcb, [7]=0x4f)), ppvObject=0xe43763e338) [0074.598] IUnknown:QueryInterface (This=0xe437b85f40, riid=0x7ff8eb8347d8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0xe43763e360) [0074.598] IUnknown:QueryInterface (in: This=0xe4377b29a8, riid=0x7ff8de1e0bd8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xe43763e390 | out: ppvObject=0xe43763e390*=0xe4377b29a8) returned 0x0 [0074.641] IUnknown:QueryInterface (This=0xe437b85f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe43763e390) [0074.641] IUnknown:AddRef (This=0xe437b85f40) returned 0xe [0074.641] IUnknown_QueryService (in: punk=0xe4377b29a8, guidService=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), riid=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), ppvOut=0xe437b896e0 | out: ppvOut=0xe437b896e0*=0x0) returned 0x80004001 [0075.563] IUnknown:Release (This=0xe437b85f40) returned 0xd [0075.563] IUnknown:QueryInterface (This=0xe437b85f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe43763e390) [0075.563] IUnknown:AddRef (This=0xe437b85f40) returned 0xe [0075.563] IUnknown_QueryService (in: punk=0xe4377b29a8, guidService=0x7ff8de1c0980*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), riid=0x7ff8de1c0a40*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), ppvOut=0xe437b896e8 | out: ppvOut=0xe437b896e8*=0x0) returned 0x80004001 [0075.564] IUnknown:Release (This=0xe437b85f40) returned 0xd [0075.564] IUnknown:QueryInterface (This=0xe437b85f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe43763e390) [0075.564] IUnknown:AddRef (This=0xe437b85f40) returned 0xe [0075.564] IUnknown_QueryService (in: punk=0xe4377b29a8, guidService=0x7ff8de1c0950*(Data1=0xcde725b0, Data2=0xccc9, Data3=0x4519, Data4=([0]=0x91, [1]=0x7e, [2]=0x32, [3]=0x5d, [4]=0x72, [5]=0xfa, [6]=0xb4, [7]=0xce)), riid=0x7ff8de1d2fb0*(Data1=0x1af3a467, Data2=0x214f, Data3=0x4298, Data4=([0]=0x90, [1]=0x8e, [2]=0x6, [3]=0xb0, [4]=0x3e, [5]=0xb, [6]=0x39, [7]=0xf9)), ppvOut=0xe437b896f0 | out: ppvOut=0xe437b896f0*=0x0) returned 0x80004001 [0075.565] IUnknown:Release (This=0xe437b85f40) returned 0xd [0075.565] IUnknown:QueryInterface (This=0xe437b85f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe43763e390) [0075.565] IUnknown:AddRef (This=0xe437b85f40) returned 0xe [0075.565] IUnknown_QueryService (in: punk=0xe4377b29a8, guidService=0x7ff8de1c0800*(Data1=0x80605492, Data2=0x67d9, Data3=0x414f, Data4=([0]=0xaf, [1]=0x89, [2]=0xa1, [3]=0xcd, [4]=0xf1, [5]=0x24, [6]=0x2b, [7]=0xc1)), riid=0x7ff8de1c0068*(Data1=0xe5aa01f7, Data2=0x1fb8, Data3=0x4830, Data4=([0]=0x87, [1]=0x20, [2]=0x4e, [3]=0x67, [4]=0x34, [5]=0xcb, [6]=0xd5, [7]=0xf3)), ppvOut=0xe437b896f8 | out: ppvOut=0xe437b896f8*=0x0) returned 0x80004001 [0075.566] IUnknown:Release (This=0xe437b85f40) returned 0xd [0075.566] IUnknown:QueryInterface (This=0xe437b85f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe43763e390) [0075.566] IUnknown:AddRef (This=0xe437b85f40) returned 0xe [0075.566] IUnknown_QueryService (in: punk=0xe4377b29a8, guidService=0x7ff8de1c0810*(Data1=0x2ce78010, Data2=0x74db, Data3=0x48bc, Data4=([0]=0x9c, [1]=0x6a, [2]=0x10, [3]=0xf3, [4]=0x72, [5]=0x49, [6]=0x57, [7]=0x23)), riid=0x7ff8de1bfb70*(Data1=0x989191ac, Data2=0x28ff, Data3=0x4cf0, Data4=([0]=0x95, [1]=0x84, [2]=0xe0, [3]=0xd0, [4]=0x78, [5]=0xbc, [6]=0x23, [7]=0x96)), ppvOut=0xe437b89700 | out: ppvOut=0xe437b89700*=0x0) returned 0x80004001 [0075.566] IUnknown:Release (This=0xe437b85f40) returned 0xd [0075.566] IUnknown:QueryInterface (This=0xe437b85f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe43763e390) [0075.566] IUnknown:AddRef (This=0xe437b85f40) returned 0xe [0075.566] IUnknown_QueryService (in: punk=0xe4377b29a8, guidService=0x7ff8de1c0078*(Data1=0x26db2472, Data2=0xb7b7, Data3=0x406b, Data4=([0]=0x97, [1]=0x2, [2]=0x73, [3]=0xa, [4]=0x4e, [5]=0x20, [6]=0xd3, [7]=0xbf)), riid=0x7ff8de1c0a10*(Data1=0x2f0666c6, Data2=0x12f7, Data3=0x4360, Data4=([0]=0xb5, [1]=0x11, [2]=0xa3, [3]=0x94, [4]=0xa0, [5]=0x55, [6]=0x37, [7]=0x25)), ppvOut=0xe437b89708 | out: ppvOut=0xe437b89708*=0x0) returned 0x80004001 [0075.567] IUnknown:Release (This=0xe437b85f40) returned 0xd [0075.567] IUnknown:QueryInterface (This=0xe437b85f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe43763e390) [0075.567] IUnknown:AddRef (This=0xe437b85f40) returned 0xe [0075.567] IUnknown_QueryService (in: punk=0xe4377b29a8, guidService=0x7ff8de1c0930*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), riid=0x7ff8de1c0a30*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), ppvOut=0xe437b89bf0 | out: ppvOut=0xe437b89bf0*=0x0) returned 0x80004001 [0075.568] IUnknown:Release (This=0xe437b85f40) returned 0xd [0075.568] IUnknown:QueryInterface (This=0xe437b85f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe43763e390) [0075.568] IUnknown:AddRef (This=0xe437b85f40) returned 0xe [0075.568] IUnknown_QueryService (in: punk=0xe4377b29a8, guidService=0x7ff8de27c2c0*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff8de27fc98*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xe43763e3d0 | out: ppvOut=0xe43763e3d0*=0x0) returned 0x80004001 [0075.568] IUnknown:Release (This=0xe437b85f40) returned 0xd [0075.568] IUnknown:AddRef (This=0xe437b85f40) returned 0xe [0075.568] GetCurrentThreadId () returned 0xfe4 [0075.568] PostThreadMessageW (idThread=0xfe4, Msg=0x8001, wParam=0x0, lParam=0x0) returned 1 [0075.569] GetMessageW (in: lpMsg=0xe43763f9e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe43763f9e8) returned 1 [0075.569] CompareStringOrdinal (lpString1="openas", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0075.569] CompareStringOrdinal (lpString1="OpenWithSetDefaultOn", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0075.569] IUnknown_QueryService (in: punk=0xe4377b29a8, guidService=0x7ff7bd657da0*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), riid=0x7ff7bd657910*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), ppvOut=0xe43763fa78 | out: ppvOut=0xe43763fa78*=0xe4377bc368) returned 0x0 [0075.610] IUnknown_Set (in: ppunk=0xe437b85f60*=0xe4377b29a8, punk=0x0 | out: ppunk=0xe437b85f60*=0x0) [0075.613] IUnknown_QueryService (in: punk=0x0, guidService=0x7ff7bd657d60*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff7bd657950*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xe43763f9c8 | out: ppvOut=0xe43763f9c8*=0x0) returned 0x80004001 [0075.613] QISearch (in: that=0xe437b85f30, pqit=0x7ff7bd657970, riid=0x7ff7bd657ac0*(Data1=0x1c9cd5bb, Data2=0x98e9, Data3=0x4491, Data4=([0]=0xa6, [1]=0xf, [2]=0x31, [3]=0xaa, [4]=0xcc, [5]=0x72, [6]=0xb8, [7]=0x3c)), ppv=0xe43763f928 | out: that=0xe437b85f30, ppv=0xe43763f928*=0xe437b85f78) returned 0x0 [0075.613] IUnknown:QueryInterface (in: This=0xe4377b7e58, riid=0x7ff7bd657930*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xe43763f9c0 | out: ppvObject=0xe43763f9c0*=0xe4377b7e58) returned 0x0 [0075.613] IShellItemArray:GetItemAt (in: This=0xe4377b7e58, dwIndex=0x0, ppsi=0xe43763f9b0 | out: ppsi=0xe43763f9b0*=0xe4377bcac8) returned 0x0 [0075.613] IUnknown:QueryInterface (in: This=0xe4377bcac8, riid=0x7ff7bd657b10*(Data1=0x7e9fb0d3, Data2=0x919f, Data3=0x4307, Data4=([0]=0xab, [1]=0x2e, [2]=0x9b, [3]=0x18, [4]=0x60, [5]=0x31, [6]=0xc, [7]=0x93)), ppvObject=0xe43763f9b8 | out: ppvObject=0xe43763f9b8*=0xe4377bcac8) returned 0x0 [0075.614] IUnknown:Release (This=0xe4377bcac8) returned 0x1 [0075.614] IShellItem:BindToHandler (in: This=0xe4377bcac8, pbc=0x0, bhid=0x7ff7bd657db0, riid=0x7ff7bd657920, ppv=0xe43763f9b0 | out: ppv=0xe43763f9b0) returned 0x0 [0075.617] IUnknown:Release (This=0xe4377bcac8) returned 0x0 [0075.617] IUnknown:Release (This=0xe4377b7e58) returned 0x1 [0075.618] IUnknown:AddRef (This=0xe437b85f78) returned 0xf [0075.618] IObjectWithSelection:GetSelection (in: This=0xe437b85f78, riid=0x7ff8de1c76a8, ppv=0xe437b89718 | out: ppv=0xe437b89718) returned 0x0 [0075.618] IUnknown:QueryInterface (in: This=0xe4377b7e58, riid=0x7ff8de1c76a8*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xe437b89718 | out: ppvObject=0xe437b89718*=0xe4377b7e58) returned 0x0 [0075.618] IUnknown:Release (This=0xe437b85f78) returned 0xe [0075.798] IUnknown:Release (This=0xe437b85f78) returned 0x7 [0075.798] IUnknown:Release (This=0xe437b85f78) returned 0x6 Thread: id = 32 os_tid = 0xffc Thread: id = 101 os_tid = 0xc5c Thread: id = 103 os_tid = 0xb0 Thread: id = 104 os_tid = 0xc18 Thread: id = 110 os_tid = 0xc08 Thread: id = 112 os_tid = 0xc40 Thread: id = 113 os_tid = 0xc3c Thread: id = 202 os_tid = 0xe54 Thread: id = 203 os_tid = 0xe4c Thread: id = 310 os_tid = 0x854 Thread: id = 311 os_tid = 0xe68 Process: id = "5" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0xb6a9000" os_pid = "0x508" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0xfb8" cmd_line = "C:\\Windows\\Explorer.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 645 start_va = 0xdc0000 end_va = 0xdcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000dc0000" filename = "" Region: id = 646 start_va = 0xdd0000 end_va = 0xdd6fff entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 647 start_va = 0xde0000 end_va = 0xdf3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000de0000" filename = "" Region: id = 648 start_va = 0xe00000 end_va = 0xe7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 649 start_va = 0xe80000 end_va = 0xe83fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e80000" filename = "" Region: id = 650 start_va = 0xe90000 end_va = 0xe92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e90000" filename = "" Region: id = 651 start_va = 0xea0000 end_va = 0xea1fff entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 652 start_va = 0xeb0000 end_va = 0xf6dfff entry_point = 0xeb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 653 start_va = 0xf70000 end_va = 0xfeffff entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 654 start_va = 0xff0000 end_va = 0xff6fff entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 655 start_va = 0x1000000 end_va = 0x1007fff entry_point = 0x1000000 region_type = mapped_file name = "explorer.exe.mui" filename = "\\Windows\\en-US\\explorer.exe.mui" (normalized: "c:\\windows\\en-us\\explorer.exe.mui") Region: id = 656 start_va = 0x1010000 end_va = 0x1010fff entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 657 start_va = 0x1020000 end_va = 0x1020fff entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 658 start_va = 0x1030000 end_va = 0x1030fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001030000" filename = "" Region: id = 659 start_va = 0x1040000 end_va = 0x1040fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001040000" filename = "" Region: id = 660 start_va = 0x1050000 end_va = 0x1050fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001050000" filename = "" Region: id = 661 start_va = 0x1060000 end_va = 0x1060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001060000" filename = "" Region: id = 662 start_va = 0x1070000 end_va = 0x1073fff entry_point = 0x1070000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 663 start_va = 0x1080000 end_va = 0x1092fff entry_point = 0x1080000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 664 start_va = 0x10a0000 end_va = 0x119ffff entry_point = 0x0 region_type = private name = "private_0x00000000010a0000" filename = "" Region: id = 665 start_va = 0x11a0000 end_va = 0x11a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011a0000" filename = "" Region: id = 666 start_va = 0x11b0000 end_va = 0x122ffff entry_point = 0x0 region_type = private name = "private_0x00000000011b0000" filename = "" Region: id = 667 start_va = 0x1230000 end_va = 0x124dfff entry_point = 0x1230000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000034.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000034.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000034.db") Region: id = 668 start_va = 0x1250000 end_va = 0x1252fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001250000" filename = "" Region: id = 669 start_va = 0x1260000 end_va = 0x126ffff entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 670 start_va = 0x1270000 end_va = 0x1272fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001270000" filename = "" Region: id = 671 start_va = 0x1280000 end_va = 0x12a9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001280000" filename = "" Region: id = 672 start_va = 0x12b0000 end_va = 0x12b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000012b0000" filename = "" Region: id = 673 start_va = 0x12c0000 end_va = 0x12cffff entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 674 start_va = 0x12d0000 end_va = 0x1457fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000012d0000" filename = "" Region: id = 675 start_va = 0x1460000 end_va = 0x15e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001460000" filename = "" Region: id = 676 start_va = 0x15f0000 end_va = 0x29effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015f0000" filename = "" Region: id = 677 start_va = 0x29f0000 end_va = 0x2d26fff entry_point = 0x29f0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 678 start_va = 0x2d30000 end_va = 0x2daffff entry_point = 0x0 region_type = private name = "private_0x0000000002d30000" filename = "" Region: id = 679 start_va = 0x2db0000 end_va = 0x2e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002db0000" filename = "" Region: id = 680 start_va = 0x2e30000 end_va = 0x2eaffff entry_point = 0x0 region_type = private name = "private_0x0000000002e30000" filename = "" Region: id = 681 start_va = 0x2eb0000 end_va = 0x2f10fff entry_point = 0x2eb0000 region_type = mapped_file name = "shell32.dll.mui" filename = "\\Windows\\System32\\en-US\\shell32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\shell32.dll.mui") Region: id = 682 start_va = 0x2f20000 end_va = 0x2ffefff entry_point = 0x2f20000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 683 start_va = 0x3000000 end_va = 0x307ffff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 684 start_va = 0x3080000 end_va = 0x30fffff entry_point = 0x0 region_type = private name = "private_0x0000000003080000" filename = "" Region: id = 685 start_va = 0x3100000 end_va = 0x317ffff entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 686 start_va = 0x3180000 end_va = 0x3181fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003180000" filename = "" Region: id = 687 start_va = 0x3190000 end_va = 0x3191fff entry_point = 0x3190000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 688 start_va = 0x31a0000 end_va = 0x31a4fff entry_point = 0x31a0000 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 689 start_va = 0x31b0000 end_va = 0x3267fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000031b0000" filename = "" Region: id = 690 start_va = 0x3270000 end_va = 0x3273fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003270000" filename = "" Region: id = 691 start_va = 0x3280000 end_va = 0x337ffff entry_point = 0x0 region_type = private name = "private_0x0000000003280000" filename = "" Region: id = 692 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 693 start_va = 0x3480000 end_va = 0x3480fff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 694 start_va = 0x3490000 end_va = 0x44cffff entry_point = 0x3490000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 695 start_va = 0x44d0000 end_va = 0x44d6fff entry_point = 0x0 region_type = private name = "private_0x00000000044d0000" filename = "" Region: id = 696 start_va = 0x44e0000 end_va = 0x44e0fff entry_point = 0x0 region_type = private name = "private_0x00000000044e0000" filename = "" Region: id = 697 start_va = 0x44f0000 end_va = 0x44f0fff entry_point = 0x0 region_type = private name = "private_0x00000000044f0000" filename = "" Region: id = 698 start_va = 0x4500000 end_va = 0x4500fff entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 699 start_va = 0x4510000 end_va = 0x458ffff entry_point = 0x0 region_type = private name = "private_0x0000000004510000" filename = "" Region: id = 700 start_va = 0x4590000 end_va = 0x4591fff entry_point = 0x0 region_type = private name = "private_0x0000000004590000" filename = "" Region: id = 701 start_va = 0x45a0000 end_va = 0x45a0fff entry_point = 0x0 region_type = private name = "private_0x00000000045a0000" filename = "" Region: id = 702 start_va = 0x45b0000 end_va = 0x45b0fff entry_point = 0x0 region_type = private name = "private_0x00000000045b0000" filename = "" Region: id = 703 start_va = 0x45c0000 end_va = 0x45c0fff entry_point = 0x0 region_type = private name = "private_0x00000000045c0000" filename = "" Region: id = 704 start_va = 0x45d0000 end_va = 0x45d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000045d0000" filename = "" Region: id = 705 start_va = 0x45e0000 end_va = 0x45e3fff entry_point = 0x45e0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 706 start_va = 0x45f0000 end_va = 0x45f0fff entry_point = 0x0 region_type = private name = "private_0x00000000045f0000" filename = "" Region: id = 707 start_va = 0x4600000 end_va = 0x4600fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004600000" filename = "" Region: id = 708 start_va = 0x4610000 end_va = 0x4610fff entry_point = 0x0 region_type = private name = "private_0x0000000004610000" filename = "" Region: id = 709 start_va = 0x4620000 end_va = 0x4622fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004620000" filename = "" Region: id = 710 start_va = 0x4630000 end_va = 0x4668fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004630000" filename = "" Region: id = 711 start_va = 0x4670000 end_va = 0x4672fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004670000" filename = "" Region: id = 712 start_va = 0x4680000 end_va = 0x4680fff entry_point = 0x0 region_type = private name = "private_0x0000000004680000" filename = "" Region: id = 713 start_va = 0x4690000 end_va = 0x4690fff entry_point = 0x0 region_type = private name = "private_0x0000000004690000" filename = "" Region: id = 714 start_va = 0x46a0000 end_va = 0x471ffff entry_point = 0x0 region_type = private name = "private_0x00000000046a0000" filename = "" Region: id = 715 start_va = 0x4720000 end_va = 0x479ffff entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 716 start_va = 0x47a0000 end_va = 0x47a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000047a0000" filename = "" Region: id = 717 start_va = 0x47b0000 end_va = 0x47b3fff entry_point = 0x47b0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 718 start_va = 0x47c0000 end_va = 0x4802fff entry_point = 0x47c0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db") Region: id = 719 start_va = 0x4810000 end_va = 0x4813fff entry_point = 0x4810000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 720 start_va = 0x4820000 end_va = 0x48aafff entry_point = 0x4820000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 721 start_va = 0x48b0000 end_va = 0x48c0fff entry_point = 0x48b0000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 722 start_va = 0x48d0000 end_va = 0x494ffff entry_point = 0x0 region_type = private name = "private_0x00000000048d0000" filename = "" Region: id = 723 start_va = 0x4950000 end_va = 0x49cffff entry_point = 0x0 region_type = private name = "private_0x0000000004950000" filename = "" Region: id = 724 start_va = 0x49d0000 end_va = 0x4a4ffff entry_point = 0x0 region_type = private name = "private_0x00000000049d0000" filename = "" Region: id = 725 start_va = 0x4a50000 end_va = 0x4a50fff entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 726 start_va = 0x4a60000 end_va = 0x4adffff entry_point = 0x0 region_type = private name = "private_0x0000000004a60000" filename = "" Region: id = 727 start_va = 0x4ae0000 end_va = 0x4b5ffff entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 728 start_va = 0x4b60000 end_va = 0x4bdffff entry_point = 0x0 region_type = private name = "private_0x0000000004b60000" filename = "" Region: id = 729 start_va = 0x4be0000 end_va = 0x50d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004be0000" filename = "" Region: id = 730 start_va = 0x50e0000 end_va = 0x50e0fff entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 731 start_va = 0x50f0000 end_va = 0x516ffff entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 732 start_va = 0x5170000 end_va = 0x5170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005170000" filename = "" Region: id = 733 start_va = 0x5180000 end_va = 0x5181fff entry_point = 0x5180000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 734 start_va = 0x5190000 end_va = 0x5191fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005190000" filename = "" Region: id = 735 start_va = 0x51a0000 end_va = 0x51a1fff entry_point = 0x51a0000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 736 start_va = 0x51b0000 end_va = 0x51b1fff entry_point = 0x51b0000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 737 start_va = 0x51c0000 end_va = 0x51c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000051c0000" filename = "" Region: id = 738 start_va = 0x51d0000 end_va = 0x51d1fff entry_point = 0x51d0000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 739 start_va = 0x51e0000 end_va = 0x51fbfff entry_point = 0x51e0000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db") Region: id = 740 start_va = 0x5200000 end_va = 0x5201fff entry_point = 0x5200000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 741 start_va = 0x5210000 end_va = 0x5211fff entry_point = 0x5210000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 742 start_va = 0x5220000 end_va = 0x5221fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005220000" filename = "" Region: id = 743 start_va = 0x5230000 end_va = 0x5231fff entry_point = 0x5230000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 744 start_va = 0x5240000 end_va = 0x5240fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005240000" filename = "" Region: id = 745 start_va = 0x5250000 end_va = 0x5251fff entry_point = 0x5250000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 746 start_va = 0x5260000 end_va = 0x5260fff entry_point = 0x5260000 region_type = mapped_file name = "iconcache_256.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db") Region: id = 747 start_va = 0x5270000 end_va = 0x52effff entry_point = 0x0 region_type = private name = "private_0x0000000005270000" filename = "" Region: id = 748 start_va = 0x52f0000 end_va = 0x536ffff entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 749 start_va = 0x5370000 end_va = 0x53effff entry_point = 0x0 region_type = private name = "private_0x0000000005370000" filename = "" Region: id = 750 start_va = 0x53f0000 end_va = 0x546ffff entry_point = 0x0 region_type = private name = "private_0x00000000053f0000" filename = "" Region: id = 751 start_va = 0x5470000 end_va = 0x5474fff entry_point = 0x5470000 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 752 start_va = 0x5480000 end_va = 0x548ffff entry_point = 0x5480000 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 753 start_va = 0x5490000 end_va = 0x5493fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 754 start_va = 0x5510000 end_va = 0x5510fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005510000" filename = "" Region: id = 755 start_va = 0x5520000 end_va = 0x5520fff entry_point = 0x0 region_type = private name = "private_0x0000000005520000" filename = "" Region: id = 756 start_va = 0x5530000 end_va = 0x5530fff entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 757 start_va = 0x5540000 end_va = 0x55bffff entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 758 start_va = 0x55c0000 end_va = 0x55c2fff entry_point = 0x55c0000 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 759 start_va = 0x55d0000 end_va = 0x55d7fff entry_point = 0x55d0000 region_type = mapped_file name = "windows.storage.dll.mui" filename = "\\Windows\\System32\\en-US\\windows.storage.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.storage.dll.mui") Region: id = 760 start_va = 0x55e0000 end_va = 0x55e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000055e0000" filename = "" Region: id = 761 start_va = 0x55f0000 end_va = 0x5deffff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 762 start_va = 0x5df0000 end_va = 0x5df2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005df0000" filename = "" Region: id = 763 start_va = 0x5e00000 end_va = 0x5e00fff entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 764 start_va = 0x5e10000 end_va = 0x5e12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005e10000" filename = "" Region: id = 765 start_va = 0x5e20000 end_va = 0x5e20fff entry_point = 0x0 region_type = private name = "private_0x0000000005e20000" filename = "" Region: id = 766 start_va = 0x5e30000 end_va = 0x5e38fff entry_point = 0x0 region_type = private name = "private_0x0000000005e30000" filename = "" Region: id = 767 start_va = 0x5e40000 end_va = 0x5e43fff entry_point = 0x0 region_type = private name = "private_0x0000000005e40000" filename = "" Region: id = 768 start_va = 0x5e50000 end_va = 0x5e50fff entry_point = 0x5e50000 region_type = mapped_file name = "counters.dat" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 769 start_va = 0x5e60000 end_va = 0x5e6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005e60000" filename = "" Region: id = 770 start_va = 0x5e70000 end_va = 0x5e78fff entry_point = 0x0 region_type = private name = "private_0x0000000005e70000" filename = "" Region: id = 771 start_va = 0x5e80000 end_va = 0x5e80fff entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 772 start_va = 0x5e90000 end_va = 0x5e91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005e90000" filename = "" Region: id = 773 start_va = 0x5ea0000 end_va = 0x5ea2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005ea0000" filename = "" Region: id = 774 start_va = 0x5eb0000 end_va = 0x5ec1fff entry_point = 0x5eb0000 region_type = mapped_file name = "wscui.cpl.mui" filename = "\\Windows\\System32\\en-US\\wscui.cpl.mui" (normalized: "c:\\windows\\system32\\en-us\\wscui.cpl.mui") Region: id = 775 start_va = 0x5ed0000 end_va = 0x5ed1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005ed0000" filename = "" Region: id = 776 start_va = 0x5ee0000 end_va = 0x5ee1fff entry_point = 0x5ee0000 region_type = mapped_file name = "hcproviders.dll.mui" filename = "\\Windows\\System32\\en-US\\hcproviders.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hcproviders.dll.mui") Region: id = 777 start_va = 0x5ef0000 end_va = 0x5efafff entry_point = 0x5ef0000 region_type = mapped_file name = "actioncenter.dll.mui" filename = "\\Windows\\System32\\en-US\\ActionCenter.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\actioncenter.dll.mui") Region: id = 778 start_va = 0x5f30000 end_va = 0x5f3ffff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 779 start_va = 0x5f60000 end_va = 0x5f60fff entry_point = 0x5f60000 region_type = mapped_file name = "imageres.dll.mui" filename = "\\Windows\\System32\\en-US\\imageres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\imageres.dll.mui") Region: id = 780 start_va = 0x5f90000 end_va = 0x608ffff entry_point = 0x0 region_type = private name = "private_0x0000000005f90000" filename = "" Region: id = 781 start_va = 0x6090000 end_va = 0x6092fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006090000" filename = "" Region: id = 782 start_va = 0x60a0000 end_va = 0x60e7fff entry_point = 0x0 region_type = private name = "private_0x00000000060a0000" filename = "" Region: id = 783 start_va = 0x60f0000 end_va = 0x6137fff entry_point = 0x0 region_type = private name = "private_0x00000000060f0000" filename = "" Region: id = 784 start_va = 0x6140000 end_va = 0x614ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006140000" filename = "" Region: id = 785 start_va = 0x6150000 end_va = 0x615ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006150000" filename = "" Region: id = 786 start_va = 0x6160000 end_va = 0x616ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006160000" filename = "" Region: id = 787 start_va = 0x6170000 end_va = 0x6171fff entry_point = 0x6170000 region_type = mapped_file name = "stobject.dll.mui" filename = "\\Windows\\System32\\en-US\\stobject.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\stobject.dll.mui") Region: id = 788 start_va = 0x6180000 end_va = 0x61fffff entry_point = 0x0 region_type = private name = "private_0x0000000006180000" filename = "" Region: id = 789 start_va = 0x6210000 end_va = 0x6210fff entry_point = 0x6210000 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\System32\\netmsg.dll" (normalized: "c:\\windows\\system32\\netmsg.dll") Region: id = 790 start_va = 0x6220000 end_va = 0x6251fff entry_point = 0x6220000 region_type = mapped_file name = "netmsg.dll.mui" filename = "\\Windows\\System32\\en-US\\netmsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netmsg.dll.mui") Region: id = 791 start_va = 0x6260000 end_va = 0x62dffff entry_point = 0x0 region_type = private name = "private_0x0000000006260000" filename = "" Region: id = 792 start_va = 0x62e0000 end_va = 0x63dffff entry_point = 0x62e0000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 793 start_va = 0x6400000 end_va = 0x6447fff entry_point = 0x0 region_type = private name = "private_0x0000000006400000" filename = "" Region: id = 794 start_va = 0x6450000 end_va = 0x64cffff entry_point = 0x0 region_type = private name = "private_0x0000000006450000" filename = "" Region: id = 795 start_va = 0x64e0000 end_va = 0x655ffff entry_point = 0x0 region_type = private name = "private_0x00000000064e0000" filename = "" Region: id = 796 start_va = 0x6560000 end_va = 0x6561fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006560000" filename = "" Region: id = 797 start_va = 0x6570000 end_va = 0x6df2fff entry_point = 0x6570000 region_type = mapped_file name = "grooveintlresource.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grooveintlresource.dll") Region: id = 798 start_va = 0x6e00000 end_va = 0x6efffff entry_point = 0x6e00000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 799 start_va = 0x6f10000 end_va = 0x6f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000006f10000" filename = "" Region: id = 800 start_va = 0x6f90000 end_va = 0x6fd8fff entry_point = 0x0 region_type = private name = "private_0x0000000006f90000" filename = "" Region: id = 801 start_va = 0x6fe0000 end_va = 0x9361fff entry_point = 0x6fe0000 region_type = mapped_file name = "appdb.dat" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\appdb.dat") Region: id = 802 start_va = 0x9370000 end_va = 0x93effff entry_point = 0x0 region_type = private name = "private_0x0000000009370000" filename = "" Region: id = 803 start_va = 0x93f0000 end_va = 0x94effff entry_point = 0x93f0000 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 804 start_va = 0x94f0000 end_va = 0x95effff entry_point = 0x94f0000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 805 start_va = 0x95f0000 end_va = 0x97effff entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 806 start_va = 0x97f0000 end_va = 0x986ffff entry_point = 0x0 region_type = private name = "private_0x00000000097f0000" filename = "" Region: id = 807 start_va = 0x9870000 end_va = 0x98effff entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 808 start_va = 0x98f0000 end_va = 0x99effff entry_point = 0x98f0000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 809 start_va = 0x99f0000 end_va = 0x9a6ffff entry_point = 0x0 region_type = private name = "private_0x00000000099f0000" filename = "" Region: id = 810 start_va = 0x9a70000 end_va = 0x9a72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009a70000" filename = "" Region: id = 811 start_va = 0x9a80000 end_va = 0x9b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000009a80000" filename = "" Region: id = 812 start_va = 0x9b80000 end_va = 0x9b81fff entry_point = 0x9b80000 region_type = mapped_file name = "pnidui.dll.mui" filename = "\\Windows\\System32\\en-US\\pnidui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnidui.dll.mui") Region: id = 813 start_va = 0x9b90000 end_va = 0x9b92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009b90000" filename = "" Region: id = 814 start_va = 0x9ba0000 end_va = 0x9ba3fff entry_point = 0x9ba0000 region_type = mapped_file name = "bthprops.cpl.mui" filename = "\\Windows\\System32\\en-US\\bthprops.cpl.mui" (normalized: "c:\\windows\\system32\\en-us\\bthprops.cpl.mui") Region: id = 815 start_va = 0x9bb0000 end_va = 0x9bb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009bb0000" filename = "" Region: id = 816 start_va = 0x9be0000 end_va = 0x9be0fff entry_point = 0x0 region_type = private name = "private_0x0000000009be0000" filename = "" Region: id = 817 start_va = 0x9c00000 end_va = 0x9c02fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009c00000" filename = "" Region: id = 818 start_va = 0x9c30000 end_va = 0x9c44fff entry_point = 0x0 region_type = private name = "private_0x0000000009c30000" filename = "" Region: id = 819 start_va = 0x9d10000 end_va = 0x9d8ffff entry_point = 0x0 region_type = private name = "private_0x0000000009d10000" filename = "" Region: id = 820 start_va = 0x9d90000 end_va = 0x9d92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009d90000" filename = "" Region: id = 821 start_va = 0x9da0000 end_va = 0x9da1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009da0000" filename = "" Region: id = 822 start_va = 0x9db0000 end_va = 0x9db2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009db0000" filename = "" Region: id = 823 start_va = 0x9dc0000 end_va = 0x9dc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009dc0000" filename = "" Region: id = 824 start_va = 0x9dd0000 end_va = 0x9dd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009dd0000" filename = "" Region: id = 825 start_va = 0x9de0000 end_va = 0x9de2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009de0000" filename = "" Region: id = 826 start_va = 0x9df0000 end_va = 0x9eeffff entry_point = 0x9df0000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 827 start_va = 0x9f70000 end_va = 0x9feffff entry_point = 0x0 region_type = private name = "private_0x0000000009f70000" filename = "" Region: id = 828 start_va = 0x9ff0000 end_va = 0xa06ffff entry_point = 0x0 region_type = private name = "private_0x0000000009ff0000" filename = "" Region: id = 829 start_va = 0xa070000 end_va = 0xa0effff entry_point = 0x0 region_type = private name = "private_0x000000000a070000" filename = "" Region: id = 830 start_va = 0xa0f0000 end_va = 0xa16ffff entry_point = 0x0 region_type = private name = "private_0x000000000a0f0000" filename = "" Region: id = 831 start_va = 0xa170000 end_va = 0xa1effff entry_point = 0x0 region_type = private name = "private_0x000000000a170000" filename = "" Region: id = 832 start_va = 0xa2f0000 end_va = 0xa36ffff entry_point = 0x0 region_type = private name = "private_0x000000000a2f0000" filename = "" Region: id = 833 start_va = 0xa470000 end_va = 0xa4effff entry_point = 0x0 region_type = private name = "private_0x000000000a470000" filename = "" Region: id = 834 start_va = 0xa670000 end_va = 0xa6effff entry_point = 0x0 region_type = private name = "private_0x000000000a670000" filename = "" Region: id = 835 start_va = 0xaa70000 end_va = 0xaaeffff entry_point = 0x0 region_type = private name = "private_0x000000000aa70000" filename = "" Region: id = 836 start_va = 0xabf0000 end_va = 0xafeffff entry_point = 0x0 region_type = private name = "private_0x000000000abf0000" filename = "" Region: id = 837 start_va = 0xaff0000 end_va = 0xaff2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000aff0000" filename = "" Region: id = 838 start_va = 0xb000000 end_va = 0xb001fff entry_point = 0xb000000 region_type = mapped_file name = "inputswitch.dll.mui" filename = "\\Windows\\System32\\en-US\\InputSwitch.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\inputswitch.dll.mui") Region: id = 839 start_va = 0xb010000 end_va = 0xb010fff entry_point = 0x0 region_type = private name = "private_0x000000000b010000" filename = "" Region: id = 840 start_va = 0xb020000 end_va = 0xb022fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000b020000" filename = "" Region: id = 841 start_va = 0xb0b0000 end_va = 0xb0b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000b0b0000" filename = "" Region: id = 842 start_va = 0xb0c0000 end_va = 0xb0c3fff entry_point = 0xb0c0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 843 start_va = 0xb0d0000 end_va = 0xb0d1fff entry_point = 0xb0d0000 region_type = mapped_file name = "sndvolsso.dll.mui" filename = "\\Windows\\System32\\en-US\\sndvolsso.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sndvolsso.dll.mui") Region: id = 844 start_va = 0xb0e0000 end_va = 0xb215fff entry_point = 0xb0e0000 region_type = mapped_file name = "ieframe.dll.mui" filename = "\\Windows\\System32\\en-US\\ieframe.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\ieframe.dll.mui") Region: id = 845 start_va = 0xb2a0000 end_va = 0xb31ffff entry_point = 0x0 region_type = private name = "private_0x000000000b2a0000" filename = "" Region: id = 846 start_va = 0xb320000 end_va = 0xb39ffff entry_point = 0x0 region_type = private name = "private_0x000000000b320000" filename = "" Region: id = 847 start_va = 0xb3a0000 end_va = 0xb41ffff entry_point = 0x0 region_type = private name = "private_0x000000000b3a0000" filename = "" Region: id = 848 start_va = 0xb420000 end_va = 0xb49ffff entry_point = 0x0 region_type = private name = "private_0x000000000b420000" filename = "" Region: id = 849 start_va = 0xb520000 end_va = 0xb59ffff entry_point = 0x0 region_type = private name = "private_0x000000000b520000" filename = "" Region: id = 850 start_va = 0xb5a0000 end_va = 0xba91fff entry_point = 0x0 region_type = private name = "private_0x000000000b5a0000" filename = "" Region: id = 851 start_va = 0xbaa0000 end_va = 0xbc9ffff entry_point = 0x0 region_type = private name = "private_0x000000000baa0000" filename = "" Region: id = 852 start_va = 0xbca0000 end_va = 0xe8b2fff entry_point = 0xbca0000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 853 start_va = 0xe8c0000 end_va = 0xe9bffff entry_point = 0xe8c0000 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 854 start_va = 0xe9c0000 end_va = 0xeabffff entry_point = 0xe9c0000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 855 start_va = 0xeac0000 end_va = 0xebbffff entry_point = 0xeac0000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 856 start_va = 0xebc0000 end_va = 0xecbffff entry_point = 0xebc0000 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 857 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 858 start_va = 0x7df600000000 end_va = 0x7ff5ffffffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df600000000" filename = "" Region: id = 859 start_va = 0x7ff70c8b0000 end_va = 0x7ff70d101fff entry_point = 0x7ff70c8b0000 region_type = mapped_file name = "ntoskrnl.exe" filename = "\\Windows\\System32\\ntoskrnl.exe" (normalized: "c:\\windows\\system32\\ntoskrnl.exe") Region: id = 860 start_va = 0x7ff79edea000 end_va = 0x7ff79edebfff entry_point = 0x0 region_type = private name = "private_0x00007ff79edea000" filename = "" Region: id = 861 start_va = 0x7ff79edf0000 end_va = 0x7ff79edf1fff entry_point = 0x0 region_type = private name = "private_0x00007ff79edf0000" filename = "" Region: id = 862 start_va = 0x7ff79edf2000 end_va = 0x7ff79edf3fff entry_point = 0x0 region_type = private name = "private_0x00007ff79edf2000" filename = "" Region: id = 863 start_va = 0x7ff79edf4000 end_va = 0x7ff79edf5fff entry_point = 0x0 region_type = private name = "private_0x00007ff79edf4000" filename = "" Region: id = 864 start_va = 0x7ff79edf6000 end_va = 0x7ff79edf7fff entry_point = 0x0 region_type = private name = "private_0x00007ff79edf6000" filename = "" Region: id = 865 start_va = 0x7ff79edf8000 end_va = 0x7ff79edf9fff entry_point = 0x0 region_type = private name = "private_0x00007ff79edf8000" filename = "" Region: id = 866 start_va = 0x7ff79edfe000 end_va = 0x7ff79edfffff entry_point = 0x0 region_type = private name = "private_0x00007ff79edfe000" filename = "" Region: id = 867 start_va = 0x7ff79ee04000 end_va = 0x7ff79ee05fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee04000" filename = "" Region: id = 868 start_va = 0x7ff79ee14000 end_va = 0x7ff79ee15fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee14000" filename = "" Region: id = 869 start_va = 0x7ff79ee1c000 end_va = 0x7ff79ee1dfff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee1c000" filename = "" Region: id = 870 start_va = 0x7ff79ee22000 end_va = 0x7ff79ee23fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee22000" filename = "" Region: id = 871 start_va = 0x7ff79ee28000 end_va = 0x7ff79ee29fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee28000" filename = "" Region: id = 872 start_va = 0x7ff79ee2a000 end_va = 0x7ff79ee2bfff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee2a000" filename = "" Region: id = 873 start_va = 0x7ff79ee2c000 end_va = 0x7ff79ee2dfff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee2c000" filename = "" Region: id = 874 start_va = 0x7ff79ee2e000 end_va = 0x7ff79ee2ffff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee2e000" filename = "" Region: id = 875 start_va = 0x7ff79ee30000 end_va = 0x7ff79ee31fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee30000" filename = "" Region: id = 876 start_va = 0x7ff79ee32000 end_va = 0x7ff79ee33fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee32000" filename = "" Region: id = 877 start_va = 0x7ff79ee36000 end_va = 0x7ff79ee37fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee36000" filename = "" Region: id = 878 start_va = 0x7ff79ee38000 end_va = 0x7ff79ee39fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee38000" filename = "" Region: id = 879 start_va = 0x7ff79ee3a000 end_va = 0x7ff79ee3bfff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee3a000" filename = "" Region: id = 880 start_va = 0x7ff79ee3c000 end_va = 0x7ff79ee3dfff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee3c000" filename = "" Region: id = 881 start_va = 0x7ff79ee44000 end_va = 0x7ff79ee45fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee44000" filename = "" Region: id = 882 start_va = 0x7ff79ee46000 end_va = 0x7ff79ee47fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee46000" filename = "" Region: id = 883 start_va = 0x7ff79ee48000 end_va = 0x7ff79ee49fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee48000" filename = "" Region: id = 884 start_va = 0x7ff79ee4a000 end_va = 0x7ff79ee4bfff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee4a000" filename = "" Region: id = 885 start_va = 0x7ff79ee4c000 end_va = 0x7ff79ee4dfff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee4c000" filename = "" Region: id = 886 start_va = 0x7ff79ee4e000 end_va = 0x7ff79ee4ffff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee4e000" filename = "" Region: id = 887 start_va = 0x7ff79ee50000 end_va = 0x7ff79ee51fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee50000" filename = "" Region: id = 888 start_va = 0x7ff79ee52000 end_va = 0x7ff79ee53fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee52000" filename = "" Region: id = 889 start_va = 0x7ff79ee54000 end_va = 0x7ff79ee55fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee54000" filename = "" Region: id = 890 start_va = 0x7ff79ee56000 end_va = 0x7ff79ee57fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee56000" filename = "" Region: id = 891 start_va = 0x7ff79ee58000 end_va = 0x7ff79ee59fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee58000" filename = "" Region: id = 892 start_va = 0x7ff79ee5a000 end_va = 0x7ff79ee5bfff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee5a000" filename = "" Region: id = 893 start_va = 0x7ff79ee5c000 end_va = 0x7ff79ee5dfff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee5c000" filename = "" Region: id = 894 start_va = 0x7ff79ee5e000 end_va = 0x7ff79ee5ffff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee5e000" filename = "" Region: id = 895 start_va = 0x7ff79ee60000 end_va = 0x7ff79ee61fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee60000" filename = "" Region: id = 896 start_va = 0x7ff79ee62000 end_va = 0x7ff79ee63fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee62000" filename = "" Region: id = 897 start_va = 0x7ff79ee64000 end_va = 0x7ff79ee65fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee64000" filename = "" Region: id = 898 start_va = 0x7ff79ee66000 end_va = 0x7ff79ee67fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee66000" filename = "" Region: id = 899 start_va = 0x7ff79ee68000 end_va = 0x7ff79ee69fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee68000" filename = "" Region: id = 900 start_va = 0x7ff79ee6a000 end_va = 0x7ff79ee6bfff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee6a000" filename = "" Region: id = 901 start_va = 0x7ff79ee6c000 end_va = 0x7ff79ee6dfff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee6c000" filename = "" Region: id = 902 start_va = 0x7ff79ee6e000 end_va = 0x7ff79ee6ffff entry_point = 0x0 region_type = private name = "private_0x00007ff79ee6e000" filename = "" Region: id = 903 start_va = 0x7ff79ee70000 end_va = 0x7ff79ef6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff79ee70000" filename = "" Region: id = 904 start_va = 0x7ff79ef70000 end_va = 0x7ff79ef92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff79ef70000" filename = "" Region: id = 905 start_va = 0x7ff79ef94000 end_va = 0x7ff79ef95fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ef94000" filename = "" Region: id = 906 start_va = 0x7ff79ef96000 end_va = 0x7ff79ef96fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ef96000" filename = "" Region: id = 907 start_va = 0x7ff79ef98000 end_va = 0x7ff79ef99fff entry_point = 0x0 region_type = private name = "private_0x00007ff79ef98000" filename = "" Region: id = 908 start_va = 0x7ff79ef9a000 end_va = 0x7ff79ef9bfff entry_point = 0x0 region_type = private name = "private_0x00007ff79ef9a000" filename = "" Region: id = 909 start_va = 0x7ff79ef9c000 end_va = 0x7ff79ef9dfff entry_point = 0x0 region_type = private name = "private_0x00007ff79ef9c000" filename = "" Region: id = 910 start_va = 0x7ff79ef9e000 end_va = 0x7ff79ef9ffff entry_point = 0x0 region_type = private name = "private_0x00007ff79ef9e000" filename = "" Region: id = 911 start_va = 0x7ff79fdc0000 end_va = 0x7ff7a020dfff entry_point = 0x7ff79fdc0000 region_type = mapped_file name = "explorer.exe" filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe") Region: id = 912 start_va = 0x7ff8d1970000 end_va = 0x7ff8d1983fff entry_point = 0x7ff8d1970000 region_type = mapped_file name = "hcproviders.dll" filename = "\\Windows\\System32\\hcproviders.dll" (normalized: "c:\\windows\\system32\\hcproviders.dll") Region: id = 913 start_va = 0x7ff8d1990000 end_va = 0x7ff8d19ddfff entry_point = 0x7ff8d1990000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 914 start_va = 0x7ff8d19e0000 end_va = 0x7ff8d1b1ffff entry_point = 0x7ff8d19e0000 region_type = mapped_file name = "werconcpl.dll" filename = "\\Windows\\System32\\werconcpl.dll" (normalized: "c:\\windows\\system32\\werconcpl.dll") Region: id = 915 start_va = 0x7ff8d1b20000 end_va = 0x7ff8d1c40fff entry_point = 0x7ff8d1b20000 region_type = mapped_file name = "wscui.cpl" filename = "\\Windows\\System32\\wscui.cpl" (normalized: "c:\\windows\\system32\\wscui.cpl") Region: id = 916 start_va = 0x7ff8d2040000 end_va = 0x7ff8d20ddfff entry_point = 0x7ff8d2040000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 917 start_va = 0x7ff8d2140000 end_va = 0x7ff8d2222fff entry_point = 0x7ff8d2140000 region_type = mapped_file name = "dismapi.dll" filename = "\\Windows\\System32\\DismApi.dll" (normalized: "c:\\windows\\system32\\dismapi.dll") Region: id = 918 start_va = 0x7ff8d2230000 end_va = 0x7ff8d2324fff entry_point = 0x7ff8d2230000 region_type = mapped_file name = "reagent.dll" filename = "\\Windows\\System32\\ReAgent.dll" (normalized: "c:\\windows\\system32\\reagent.dll") Region: id = 919 start_va = 0x7ff8d2470000 end_va = 0x7ff8d24a4fff entry_point = 0x7ff8d2470000 region_type = mapped_file name = "wscapi.dll" filename = "\\Windows\\System32\\wscapi.dll" (normalized: "c:\\windows\\system32\\wscapi.dll") Region: id = 920 start_va = 0x7ff8d24b0000 end_va = 0x7ff8d24ddfff entry_point = 0x7ff8d24b0000 region_type = mapped_file name = "wscinterop.dll" filename = "\\Windows\\System32\\wscinterop.dll" (normalized: "c:\\windows\\system32\\wscinterop.dll") Region: id = 921 start_va = 0x7ff8d5f40000 end_va = 0x7ff8d5f5afff entry_point = 0x7ff8d5f40000 region_type = mapped_file name = "wercplsupport.dll" filename = "\\Windows\\System32\\wercplsupport.dll" (normalized: "c:\\windows\\system32\\wercplsupport.dll") Region: id = 922 start_va = 0x7ff8d64b0000 end_va = 0x7ff8d6665fff entry_point = 0x7ff8d64b0000 region_type = mapped_file name = "msoshext.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\msoshext.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msoshext.dll") Region: id = 923 start_va = 0x7ff8d6770000 end_va = 0x7ff8d7368fff entry_point = 0x7ff8d6770000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 924 start_va = 0x7ff8d76a0000 end_va = 0x7ff8d7738fff entry_point = 0x7ff8d76a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 925 start_va = 0x7ff8d7740000 end_va = 0x7ff8d77dffff entry_point = 0x7ff8d7740000 region_type = mapped_file name = "hgcpl.dll" filename = "\\Windows\\System32\\hgcpl.dll" (normalized: "c:\\windows\\system32\\hgcpl.dll") Region: id = 926 start_va = 0x7ff8d77e0000 end_va = 0x7ff8d781bfff entry_point = 0x7ff8d77e0000 region_type = mapped_file name = "bthprops.cpl" filename = "\\Windows\\System32\\bthprops.cpl" (normalized: "c:\\windows\\system32\\bthprops.cpl") Region: id = 927 start_va = 0x7ff8d7820000 end_va = 0x7ff8d7840fff entry_point = 0x7ff8d7820000 region_type = mapped_file name = "networkstatus.dll" filename = "\\Windows\\System32\\NetworkStatus.dll" (normalized: "c:\\windows\\system32\\networkstatus.dll") Region: id = 928 start_va = 0x7ff8d7850000 end_va = 0x7ff8d7a0efff entry_point = 0x7ff8d7850000 region_type = mapped_file name = "pnidui.dll" filename = "\\Windows\\System32\\pnidui.dll" (normalized: "c:\\windows\\system32\\pnidui.dll") Region: id = 929 start_va = 0x7ff8d7a10000 end_va = 0x7ff8d7c51fff entry_point = 0x7ff8d7a10000 region_type = mapped_file name = "authui.dll" filename = "\\Windows\\System32\\authui.dll" (normalized: "c:\\windows\\system32\\authui.dll") Region: id = 930 start_va = 0x7ff8d7c60000 end_va = 0x7ff8d7c9cfff entry_point = 0x7ff8d7c60000 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll") Region: id = 931 start_va = 0x7ff8d98e0000 end_va = 0x7ff8d9964fff entry_point = 0x7ff8d98e0000 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 932 start_va = 0x7ff8d9970000 end_va = 0x7ff8d99bffff entry_point = 0x7ff8d9970000 region_type = mapped_file name = "actioncenter.dll" filename = "\\Windows\\System32\\ActionCenter.dll" (normalized: "c:\\windows\\system32\\actioncenter.dll") Region: id = 933 start_va = 0x7ff8d99c0000 end_va = 0x7ff8d99cffff entry_point = 0x7ff8d99c0000 region_type = mapped_file name = "atlthunk.dll" filename = "\\Windows\\System32\\atlthunk.dll" (normalized: "c:\\windows\\system32\\atlthunk.dll") Region: id = 934 start_va = 0x7ff8d99d0000 end_va = 0x7ff8d99e6fff entry_point = 0x7ff8d99d0000 region_type = mapped_file name = "syncreg.dll" filename = "\\Windows\\System32\\Syncreg.dll" (normalized: "c:\\windows\\system32\\syncreg.dll") Region: id = 935 start_va = 0x7ff8d99f0000 end_va = 0x7ff8d9a30fff entry_point = 0x7ff8d99f0000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 936 start_va = 0x7ff8d9a40000 end_va = 0x7ff8d9be8fff entry_point = 0x7ff8d9a40000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_89a94c179af51f83\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_89a94c179af51f83\\gdiplus.dll") Region: id = 937 start_va = 0x7ff8d9bf0000 end_va = 0x7ff8d9c68fff entry_point = 0x7ff8d9bf0000 region_type = mapped_file name = "dxp.dll" filename = "\\Windows\\System32\\DXP.dll" (normalized: "c:\\windows\\system32\\dxp.dll") Region: id = 938 start_va = 0x7ff8d9eb0000 end_va = 0x7ff8d9feafff entry_point = 0x7ff8d9eb0000 region_type = mapped_file name = "windows.ui.shell.dll" filename = "\\Windows\\System32\\Windows.UI.Shell.dll" (normalized: "c:\\windows\\system32\\windows.ui.shell.dll") Region: id = 939 start_va = 0x7ff8d9ff0000 end_va = 0x7ff8da1edfff entry_point = 0x7ff8d9ff0000 region_type = mapped_file name = "batmeter.dll" filename = "\\Windows\\System32\\batmeter.dll" (normalized: "c:\\windows\\system32\\batmeter.dll") Region: id = 940 start_va = 0x7ff8da840000 end_va = 0x7ff8da8c3fff entry_point = 0x7ff8da840000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 941 start_va = 0x7ff8da8d0000 end_va = 0x7ff8da94bfff entry_point = 0x7ff8da8d0000 region_type = mapped_file name = "prnfldr.dll" filename = "\\Windows\\System32\\prnfldr.dll" (normalized: "c:\\windows\\system32\\prnfldr.dll") Region: id = 942 start_va = 0x7ff8da950000 end_va = 0x7ff8da99efff entry_point = 0x7ff8da950000 region_type = mapped_file name = "inputswitch.dll" filename = "\\Windows\\System32\\InputSwitch.dll" (normalized: "c:\\windows\\system32\\inputswitch.dll") Region: id = 943 start_va = 0x7ff8da9a0000 end_va = 0x7ff8da9fbfff entry_point = 0x7ff8da9a0000 region_type = mapped_file name = "stobject.dll" filename = "\\Windows\\System32\\stobject.dll" (normalized: "c:\\windows\\system32\\stobject.dll") Region: id = 944 start_va = 0x7ff8db480000 end_va = 0x7ff8db4c6fff entry_point = 0x7ff8db480000 region_type = mapped_file name = "windows.system.launcher.dll" filename = "\\Windows\\System32\\Windows.System.Launcher.dll" (normalized: "c:\\windows\\system32\\windows.system.launcher.dll") Region: id = 945 start_va = 0x7ff8db610000 end_va = 0x7ff8db8affff entry_point = 0x7ff8db610000 region_type = mapped_file name = "gameux.dll" filename = "\\Windows\\System32\\gameux.dll" (normalized: "c:\\windows\\system32\\gameux.dll") Region: id = 946 start_va = 0x7ff8db910000 end_va = 0x7ff8db93bfff entry_point = 0x7ff8db910000 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 947 start_va = 0x7ff8db940000 end_va = 0x7ff8db962fff entry_point = 0x7ff8db940000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 948 start_va = 0x7ff8db9f0000 end_va = 0x7ff8dba81fff entry_point = 0x7ff8db9f0000 region_type = mapped_file name = "windows.internal.shell.broker.dll" filename = "\\Windows\\System32\\Windows.Internal.Shell.Broker.dll" (normalized: "c:\\windows\\system32\\windows.internal.shell.broker.dll") Region: id = 949 start_va = 0x7ff8dbc00000 end_va = 0x7ff8dbc4dfff entry_point = 0x7ff8dbc00000 region_type = mapped_file name = "notificationobjfactory.dll" filename = "\\Windows\\System32\\NotificationObjFactory.dll" (normalized: "c:\\windows\\system32\\notificationobjfactory.dll") Region: id = 950 start_va = 0x7ff8dc6e0000 end_va = 0x7ff8dc778fff entry_point = 0x7ff8dc6e0000 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 951 start_va = 0x7ff8dc780000 end_va = 0x7ff8dca11fff entry_point = 0x7ff8dc780000 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 952 start_va = 0x7ff8dca20000 end_va = 0x7ff8dca79fff entry_point = 0x7ff8dca20000 region_type = mapped_file name = "dsreg.dll" filename = "\\Windows\\System32\\dsreg.dll" (normalized: "c:\\windows\\system32\\dsreg.dll") Region: id = 953 start_va = 0x7ff8dca80000 end_va = 0x7ff8dca91fff entry_point = 0x7ff8dca80000 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 954 start_va = 0x7ff8dcb00000 end_va = 0x7ff8dcb98fff entry_point = 0x7ff8dcb00000 region_type = mapped_file name = "wlidprov.dll" filename = "\\Windows\\System32\\wlidprov.dll" (normalized: "c:\\windows\\system32\\wlidprov.dll") Region: id = 955 start_va = 0x7ff8dcba0000 end_va = 0x7ff8dcbcafff entry_point = 0x7ff8dcba0000 region_type = mapped_file name = "abovelockapphost.dll" filename = "\\Windows\\System32\\AboveLockAppHost.dll" (normalized: "c:\\windows\\system32\\abovelockapphost.dll") Region: id = 956 start_va = 0x7ff8dcbd0000 end_va = 0x7ff8dcc4ffff entry_point = 0x7ff8dcbd0000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 957 start_va = 0x7ff8dcc50000 end_va = 0x7ff8dcc6ffff entry_point = 0x7ff8dcc50000 region_type = mapped_file name = "wcmapi.dll" filename = "\\Windows\\System32\\wcmapi.dll" (normalized: "c:\\windows\\system32\\wcmapi.dll") Region: id = 958 start_va = 0x7ff8dcc70000 end_va = 0x7ff8dcc85fff entry_point = 0x7ff8dcc70000 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 959 start_va = 0x7ff8dcc90000 end_va = 0x7ff8dcd3bfff entry_point = 0x7ff8dcc90000 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 960 start_va = 0x7ff8dcd40000 end_va = 0x7ff8dcd54fff entry_point = 0x7ff8dcd40000 region_type = mapped_file name = "profext.dll" filename = "\\Windows\\System32\\profext.dll" (normalized: "c:\\windows\\system32\\profext.dll") Region: id = 961 start_va = 0x7ff8dcd60000 end_va = 0x7ff8dcda7fff entry_point = 0x7ff8dcd60000 region_type = mapped_file name = "vaultcli.dll" filename = "\\Windows\\System32\\vaultcli.dll" (normalized: "c:\\windows\\system32\\vaultcli.dll") Region: id = 962 start_va = 0x7ff8dcfd0000 end_va = 0x7ff8dd018fff entry_point = 0x7ff8dcfd0000 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 963 start_va = 0x7ff8dd020000 end_va = 0x7ff8dd0a2fff entry_point = 0x7ff8dd020000 region_type = mapped_file name = "notificationcontroller.dll" filename = "\\Windows\\System32\\NotificationController.dll" (normalized: "c:\\windows\\system32\\notificationcontroller.dll") Region: id = 964 start_va = 0x7ff8dd0b0000 end_va = 0x7ff8dd183fff entry_point = 0x7ff8dd0b0000 region_type = mapped_file name = "wpncore.dll" filename = "\\Windows\\System32\\wpncore.dll" (normalized: "c:\\windows\\system32\\wpncore.dll") Region: id = 965 start_va = 0x7ff8dd190000 end_va = 0x7ff8dd205fff entry_point = 0x7ff8dd190000 region_type = mapped_file name = "provsvc.dll" filename = "\\Windows\\System32\\provsvc.dll" (normalized: "c:\\windows\\system32\\provsvc.dll") Region: id = 966 start_va = 0x7ff8dd210000 end_va = 0x7ff8dd246fff entry_point = 0x7ff8dd210000 region_type = mapped_file name = "ehstorshell.dll" filename = "\\Windows\\System32\\EhStorShell.dll" (normalized: "c:\\windows\\system32\\ehstorshell.dll") Region: id = 967 start_va = 0x7ff8dd250000 end_va = 0x7ff8dd2eefff entry_point = 0x7ff8dd250000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msvcp140.dll") Region: id = 968 start_va = 0x7ff8dd2f0000 end_va = 0x7ff8dd305fff entry_point = 0x7ff8dd2f0000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\vcruntime140.dll") Region: id = 969 start_va = 0x7ff8dd310000 end_va = 0x7ff8dd622fff entry_point = 0x7ff8dd310000 region_type = mapped_file name = "grooveex.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\grooveex.dll") Region: id = 970 start_va = 0x7ff8dd630000 end_va = 0x7ff8dd8edfff entry_point = 0x7ff8dd630000 region_type = mapped_file name = "filesyncshell64.dll" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncshell64.dll") Region: id = 971 start_va = 0x7ff8dd8f0000 end_va = 0x7ff8dd8fcfff entry_point = 0x7ff8dd8f0000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 972 start_va = 0x7ff8dd900000 end_va = 0x7ff8dd94afff entry_point = 0x7ff8dd900000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 973 start_va = 0x7ff8dd950000 end_va = 0x7ff8dd967fff entry_point = 0x7ff8dd950000 region_type = mapped_file name = "elscore.dll" filename = "\\Windows\\System32\\ELSCore.dll" (normalized: "c:\\windows\\system32\\elscore.dll") Region: id = 974 start_va = 0x7ff8dd970000 end_va = 0x7ff8dda8afff entry_point = 0x7ff8dd970000 region_type = mapped_file name = "applicationframe.dll" filename = "\\Windows\\System32\\ApplicationFrame.dll" (normalized: "c:\\windows\\system32\\applicationframe.dll") Region: id = 975 start_va = 0x7ff8dda90000 end_va = 0x7ff8ddb69fff entry_point = 0x7ff8dda90000 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 976 start_va = 0x7ff8ddb70000 end_va = 0x7ff8ddb7ffff entry_point = 0x7ff8ddb70000 region_type = mapped_file name = "wldp.dll" filename = "\\Windows\\System32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll") Region: id = 977 start_va = 0x7ff8ddb80000 end_va = 0x7ff8ddbccfff entry_point = 0x7ff8ddb80000 region_type = mapped_file name = "windows.immersiveshell.serviceprovider.dll" filename = "\\Windows\\System32\\windows.immersiveshell.serviceprovider.dll" (normalized: "c:\\windows\\system32\\windows.immersiveshell.serviceprovider.dll") Region: id = 978 start_va = 0x7ff8ddbd0000 end_va = 0x7ff8de6dcfff entry_point = 0x7ff8ddbd0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 979 start_va = 0x7ff8de6e0000 end_va = 0x7ff8deb6ffff entry_point = 0x7ff8de6e0000 region_type = mapped_file name = "explorerframe.dll" filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll") Region: id = 980 start_va = 0x7ff8deb70000 end_va = 0x7ff8debb5fff entry_point = 0x7ff8deb70000 region_type = mapped_file name = "dataexchange.dll" filename = "\\Windows\\System32\\DataExchange.dll" (normalized: "c:\\windows\\system32\\dataexchange.dll") Region: id = 981 start_va = 0x7ff8debc0000 end_va = 0x7ff8dec28fff entry_point = 0x7ff8debc0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 982 start_va = 0x7ff8dec30000 end_va = 0x7ff8dec94fff entry_point = 0x7ff8dec30000 region_type = mapped_file name = "sndvolsso.dll" filename = "\\Windows\\System32\\SndVolSSO.dll" (normalized: "c:\\windows\\system32\\sndvolsso.dll") Region: id = 983 start_va = 0x7ff8deca0000 end_va = 0x7ff8ded65fff entry_point = 0x7ff8deca0000 region_type = mapped_file name = "tokenbroker.dll" filename = "\\Windows\\System32\\TokenBroker.dll" (normalized: "c:\\windows\\system32\\tokenbroker.dll") Region: id = 984 start_va = 0x7ff8ded70000 end_va = 0x7ff8dee50fff entry_point = 0x7ff8ded70000 region_type = mapped_file name = "settingsynccore.dll" filename = "\\Windows\\System32\\SettingSyncCore.dll" (normalized: "c:\\windows\\system32\\settingsynccore.dll") Region: id = 985 start_va = 0x7ff8dee60000 end_va = 0x7ff8dee70fff entry_point = 0x7ff8dee60000 region_type = mapped_file name = "settingsyncpolicy.dll" filename = "\\Windows\\System32\\SettingSyncPolicy.dll" (normalized: "c:\\windows\\system32\\settingsyncpolicy.dll") Region: id = 986 start_va = 0x7ff8dee80000 end_va = 0x7ff8dee95fff entry_point = 0x7ff8dee80000 region_type = mapped_file name = "capauthz.dll" filename = "\\Windows\\System32\\capauthz.dll" (normalized: "c:\\windows\\system32\\capauthz.dll") Region: id = 987 start_va = 0x7ff8deeb0000 end_va = 0x7ff8df0bcfff entry_point = 0x7ff8deeb0000 region_type = mapped_file name = "twinui.appcore.dll" filename = "\\Windows\\System32\\twinui.appcore.dll" (normalized: "c:\\windows\\system32\\twinui.appcore.dll") Region: id = 988 start_va = 0x7ff8df0c0000 end_va = 0x7ff8df179fff entry_point = 0x7ff8df0c0000 region_type = mapped_file name = "twinapi.dll" filename = "\\Windows\\System32\\twinapi.dll" (normalized: "c:\\windows\\system32\\twinapi.dll") Region: id = 989 start_va = 0x7ff8df190000 end_va = 0x7ff8df1a4fff entry_point = 0x7ff8df190000 region_type = mapped_file name = "execmodelproxy.dll" filename = "\\Windows\\System32\\execmodelproxy.dll" (normalized: "c:\\windows\\system32\\execmodelproxy.dll") Region: id = 990 start_va = 0x7ff8df400000 end_va = 0x7ff8df40bfff entry_point = 0x7ff8df400000 region_type = mapped_file name = "notificationcontrollerps.dll" filename = "\\Windows\\System32\\NotificationControllerPS.dll" (normalized: "c:\\windows\\system32\\notificationcontrollerps.dll") Region: id = 991 start_va = 0x7ff8df410000 end_va = 0x7ff8df418fff entry_point = 0x7ff8df410000 region_type = mapped_file name = "wpportinglibrary.dll" filename = "\\Windows\\System32\\WpPortingLibrary.dll" (normalized: "c:\\windows\\system32\\wpportinglibrary.dll") Region: id = 992 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 993 start_va = 0x7ff8dfab0000 end_va = 0x7ff8dfd10fff entry_point = 0x7ff8dfab0000 region_type = mapped_file name = "coreuicomponents.dll" filename = "\\Windows\\System32\\CoreUIComponents.dll" (normalized: "c:\\windows\\system32\\coreuicomponents.dll") Region: id = 994 start_va = 0x7ff8dff00000 end_va = 0x7ff8e01a6fff entry_point = 0x7ff8dff00000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 995 start_va = 0x7ff8e05b0000 end_va = 0x7ff8e05c1fff entry_point = 0x7ff8e05b0000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 996 start_va = 0x7ff8e09f0000 end_va = 0x7ff8e0a0dfff entry_point = 0x7ff8e09f0000 region_type = mapped_file name = "bluetoothapis.dll" filename = "\\Windows\\System32\\BluetoothApis.dll" (normalized: "c:\\windows\\system32\\bluetoothapis.dll") Region: id = 997 start_va = 0x7ff8e0a60000 end_va = 0x7ff8e0bf6fff entry_point = 0x7ff8e0a60000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 998 start_va = 0x7ff8e0f70000 end_va = 0x7ff8e0f7dfff entry_point = 0x7ff8e0f70000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 999 start_va = 0x7ff8e0f80000 end_va = 0x7ff8e0f94fff entry_point = 0x7ff8e0f80000 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 1000 start_va = 0x7ff8e15f0000 end_va = 0x7ff8e164efff entry_point = 0x7ff8e15f0000 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1001 start_va = 0x7ff8e1650000 end_va = 0x7ff8e165bfff entry_point = 0x7ff8e1650000 region_type = mapped_file name = "dsclient.dll" filename = "\\Windows\\System32\\dsclient.dll" (normalized: "c:\\windows\\system32\\dsclient.dll") Region: id = 1002 start_va = 0x7ff8e1780000 end_va = 0x7ff8e17c0fff entry_point = 0x7ff8e1780000 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1003 start_va = 0x7ff8e2760000 end_va = 0x7ff8e279efff entry_point = 0x7ff8e2760000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1004 start_va = 0x7ff8e2ea0000 end_va = 0x7ff8e2ea9fff entry_point = 0x7ff8e2ea0000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1005 start_va = 0x7ff8e2f70000 end_va = 0x7ff8e2fdafff entry_point = 0x7ff8e2f70000 region_type = mapped_file name = "photometadatahandler.dll" filename = "\\Windows\\System32\\PhotoMetadataHandler.dll" (normalized: "c:\\windows\\system32\\photometadatahandler.dll") Region: id = 1006 start_va = 0x7ff8e3040000 end_va = 0x7ff8e3066fff entry_point = 0x7ff8e3040000 region_type = mapped_file name = "idstore.dll" filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll") Region: id = 1007 start_va = 0x7ff8e3190000 end_va = 0x7ff8e3212fff entry_point = 0x7ff8e3190000 region_type = mapped_file name = "imapi2.dll" filename = "\\Windows\\System32\\imapi2.dll" (normalized: "c:\\windows\\system32\\imapi2.dll") Region: id = 1008 start_va = 0x7ff8e3220000 end_va = 0x7ff8e3565fff entry_point = 0x7ff8e3220000 region_type = mapped_file name = "synccenter.dll" filename = "\\Windows\\System32\\SyncCenter.dll" (normalized: "c:\\windows\\system32\\synccenter.dll") Region: id = 1009 start_va = 0x7ff8e3570000 end_va = 0x7ff8e35affff entry_point = 0x7ff8e3570000 region_type = mapped_file name = "windows.gaming.input.dll" filename = "\\Windows\\System32\\Windows.Gaming.Input.dll" (normalized: "c:\\windows\\system32\\windows.gaming.input.dll") Region: id = 1010 start_va = 0x7ff8e35b0000 end_va = 0x7ff8e360cfff entry_point = 0x7ff8e35b0000 region_type = mapped_file name = "srchadmin.dll" filename = "\\Windows\\System32\\srchadmin.dll" (normalized: "c:\\windows\\system32\\srchadmin.dll") Region: id = 1011 start_va = 0x7ff8e3610000 end_va = 0x7ff8e365ffff entry_point = 0x7ff8e3610000 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 1012 start_va = 0x7ff8e3a50000 end_va = 0x7ff8e3a59fff entry_point = 0x7ff8e3a50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1013 start_va = 0x7ff8e3a70000 end_va = 0x7ff8e3c26fff entry_point = 0x7ff8e3a70000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 1014 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1015 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 1016 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 1017 start_va = 0x7ff8e5160000 end_va = 0x7ff8e51c9fff entry_point = 0x7ff8e5160000 region_type = mapped_file name = "wincorlib.dll" filename = "\\Windows\\System32\\wincorlib.dll" (normalized: "c:\\windows\\system32\\wincorlib.dll") Region: id = 1018 start_va = 0x7ff8e51d0000 end_va = 0x7ff8e51d8fff entry_point = 0x7ff8e51d0000 region_type = mapped_file name = "iconcodecservice.dll" filename = "\\Windows\\System32\\IconCodecService.dll" (normalized: "c:\\windows\\system32\\iconcodecservice.dll") Region: id = 1019 start_va = 0x7ff8e51e0000 end_va = 0x7ff8e51ecfff entry_point = 0x7ff8e51e0000 region_type = mapped_file name = "cscdll.dll" filename = "\\Windows\\System32\\cscdll.dll" (normalized: "c:\\windows\\system32\\cscdll.dll") Region: id = 1020 start_va = 0x7ff8e51f0000 end_va = 0x7ff8e52b3fff entry_point = 0x7ff8e51f0000 region_type = mapped_file name = "cscui.dll" filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll") Region: id = 1021 start_va = 0x7ff8e5310000 end_va = 0x7ff8e531efff entry_point = 0x7ff8e5310000 region_type = mapped_file name = "pcacli.dll" filename = "\\Windows\\System32\\pcacli.dll" (normalized: "c:\\windows\\system32\\pcacli.dll") Region: id = 1022 start_va = 0x7ff8e53b0000 end_va = 0x7ff8e53b9fff entry_point = 0x7ff8e53b0000 region_type = mapped_file name = "msiltcfg.dll" filename = "\\Windows\\System32\\msiltcfg.dll" (normalized: "c:\\windows\\system32\\msiltcfg.dll") Region: id = 1023 start_va = 0x7ff8e5480000 end_va = 0x7ff8e548bfff entry_point = 0x7ff8e5480000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1024 start_va = 0x7ff8e54e0000 end_va = 0x7ff8e5511fff entry_point = 0x7ff8e54e0000 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 1025 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 1026 start_va = 0x7ff8e5a30000 end_va = 0x7ff8e5d6cfff entry_point = 0x7ff8e5a30000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 1027 start_va = 0x7ff8e5dd0000 end_va = 0x7ff8e5ea5fff entry_point = 0x7ff8e5dd0000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1028 start_va = 0x7ff8e60a0000 end_va = 0x7ff8e6131fff entry_point = 0x7ff8e60a0000 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 1029 start_va = 0x7ff8e6140000 end_va = 0x7ff8e6178fff entry_point = 0x7ff8e6140000 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 1030 start_va = 0x7ff8e6330000 end_va = 0x7ff8e6365fff entry_point = 0x7ff8e6330000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1031 start_va = 0x7ff8e6440000 end_va = 0x7ff8e646ffff entry_point = 0x7ff8e6440000 region_type = mapped_file name = "rtworkq.dll" filename = "\\Windows\\System32\\RTWorkQ.dll" (normalized: "c:\\windows\\system32\\rtworkq.dll") Region: id = 1032 start_va = 0x7ff8e6470000 end_va = 0x7ff8e657bfff entry_point = 0x7ff8e6470000 region_type = mapped_file name = "mfplat.dll" filename = "\\Windows\\System32\\mfplat.dll" (normalized: "c:\\windows\\system32\\mfplat.dll") Region: id = 1033 start_va = 0x7ff8e6640000 end_va = 0x7ff8e6b84fff entry_point = 0x7ff8e6640000 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 1034 start_va = 0x7ff8e6c30000 end_va = 0x7ff8e6d21fff entry_point = 0x7ff8e6c30000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1035 start_va = 0x7ff8e7160000 end_va = 0x7ff8e71c7fff entry_point = 0x7ff8e7160000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1036 start_va = 0x7ff8e7280000 end_va = 0x7ff8e7299fff entry_point = 0x7ff8e7280000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1037 start_va = 0x7ff8e72a0000 end_va = 0x7ff8e72b5fff entry_point = 0x7ff8e72a0000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1038 start_va = 0x7ff8e7400000 end_va = 0x7ff8e741bfff entry_point = 0x7ff8e7400000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1039 start_va = 0x7ff8e7430000 end_va = 0x7ff8e7560fff entry_point = 0x7ff8e7430000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1040 start_va = 0x7ff8e75b0000 end_va = 0x7ff8e75bafff entry_point = 0x7ff8e75b0000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 1041 start_va = 0x7ff8e76f0000 end_va = 0x7ff8e7707fff entry_point = 0x7ff8e76f0000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1042 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1043 start_va = 0x7ff8e7b40000 end_va = 0x7ff8e7bb1fff entry_point = 0x7ff8e7b40000 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 1044 start_va = 0x7ff8e7cd0000 end_va = 0x7ff8e7ce5fff entry_point = 0x7ff8e7cd0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1045 start_va = 0x7ff8e7d90000 end_va = 0x7ff8e7da0fff entry_point = 0x7ff8e7d90000 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1046 start_va = 0x7ff8e7f00000 end_va = 0x7ff8e7f79fff entry_point = 0x7ff8e7f00000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1047 start_va = 0x7ff8e8140000 end_va = 0x7ff8e81e0fff entry_point = 0x7ff8e8140000 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 1048 start_va = 0x7ff8e81f0000 end_va = 0x7ff8e8254fff entry_point = 0x7ff8e81f0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1049 start_va = 0x7ff8e8460000 end_va = 0x7ff8e846afff entry_point = 0x7ff8e8460000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1050 start_va = 0x7ff8e8480000 end_va = 0x7ff8e84b7fff entry_point = 0x7ff8e8480000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1051 start_va = 0x7ff8e8650000 end_va = 0x7ff8e869afff entry_point = 0x7ff8e8650000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 1052 start_va = 0x7ff8e86a0000 end_va = 0x7ff8e8851fff entry_point = 0x7ff8e86a0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 1053 start_va = 0x7ff8e8860000 end_va = 0x7ff8e8acdfff entry_point = 0x7ff8e8860000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 1054 start_va = 0x7ff8e8ad0000 end_va = 0x7ff8e8ae2fff entry_point = 0x7ff8e8ad0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1055 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 1056 start_va = 0x7ff8e8b60000 end_va = 0x7ff8e8b84fff entry_point = 0x7ff8e8b60000 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 1057 start_va = 0x7ff8e8b90000 end_va = 0x7ff8e8bb5fff entry_point = 0x7ff8e8b90000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1058 start_va = 0x7ff8e8bc0000 end_va = 0x7ff8e8bfefff entry_point = 0x7ff8e8bc0000 region_type = mapped_file name = "settingmonitor.dll" filename = "\\Windows\\System32\\SettingMonitor.dll" (normalized: "c:\\windows\\system32\\settingmonitor.dll") Region: id = 1059 start_va = 0x7ff8e8c00000 end_va = 0x7ff8e8c31fff entry_point = 0x7ff8e8c00000 region_type = mapped_file name = "portabledevicetypes.dll" filename = "\\Windows\\System32\\PortableDeviceTypes.dll" (normalized: "c:\\windows\\system32\\portabledevicetypes.dll") Region: id = 1060 start_va = 0x7ff8e8c40000 end_va = 0x7ff8e8c54fff entry_point = 0x7ff8e8c40000 region_type = mapped_file name = "wpdshserviceobj.dll" filename = "\\Windows\\System32\\WPDShServiceObj.dll" (normalized: "c:\\windows\\system32\\wpdshserviceobj.dll") Region: id = 1061 start_va = 0x7ff8e8c60000 end_va = 0x7ff8e8cfbfff entry_point = 0x7ff8e8c60000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 1062 start_va = 0x7ff8e8d00000 end_va = 0x7ff8e8fa2fff entry_point = 0x7ff8e8d00000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 1063 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1064 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 1065 start_va = 0x7ff8e9060000 end_va = 0x7ff8e9127fff entry_point = 0x7ff8e9060000 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll") Region: id = 1066 start_va = 0x7ff8e9130000 end_va = 0x7ff8e9200fff entry_point = 0x7ff8e9130000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 1067 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1068 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1069 start_va = 0x7ff8e9720000 end_va = 0x7ff8e9746fff entry_point = 0x7ff8e9720000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1070 start_va = 0x7ff8e9860000 end_va = 0x7ff8e994dfff entry_point = 0x7ff8e9860000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1071 start_va = 0x7ff8e99e0000 end_va = 0x7ff8e9a07fff entry_point = 0x7ff8e99e0000 region_type = mapped_file name = "rmclient.dll" filename = "\\Windows\\System32\\rmclient.dll" (normalized: "c:\\windows\\system32\\rmclient.dll") Region: id = 1072 start_va = 0x7ff8e9e00000 end_va = 0x7ff8e9e0bfff entry_point = 0x7ff8e9e00000 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 1073 start_va = 0x7ff8e9fe0000 end_va = 0x7ff8e9ffbfff entry_point = 0x7ff8e9fe0000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 1074 start_va = 0x7ff8ea000000 end_va = 0x7ff8ea00bfff entry_point = 0x7ff8ea000000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1075 start_va = 0x7ff8ea010000 end_va = 0x7ff8ea035fff entry_point = 0x7ff8ea010000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1076 start_va = 0x7ff8ea0f0000 end_va = 0x7ff8ea121fff entry_point = 0x7ff8ea0f0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1077 start_va = 0x7ff8ea1d0000 end_va = 0x7ff8ea1d9fff entry_point = 0x7ff8ea1d0000 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 1078 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1079 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1080 start_va = 0x7ff8ea3c0000 end_va = 0x7ff8ea467fff entry_point = 0x7ff8ea3c0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1081 start_va = 0x7ff8ea5c0000 end_va = 0x7ff8ea61cfff entry_point = 0x7ff8ea5c0000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1082 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1083 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1084 start_va = 0x7ff8ea820000 end_va = 0x7ff8ea877fff entry_point = 0x7ff8ea820000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1085 start_va = 0x7ff8ea880000 end_va = 0x7ff8ea8b5fff entry_point = 0x7ff8ea880000 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 1086 start_va = 0x7ff8ea8c0000 end_va = 0x7ff8ea8e5fff entry_point = 0x7ff8ea8c0000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 1087 start_va = 0x7ff8ea9d0000 end_va = 0x7ff8ea9fbfff entry_point = 0x7ff8ea9d0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1088 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1089 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1090 start_va = 0x7ff8eac70000 end_va = 0x7ff8ead07fff entry_point = 0x7ff8eac70000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1091 start_va = 0x7ff8eadb0000 end_va = 0x7ff8eadc0fff entry_point = 0x7ff8eadb0000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1092 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1093 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1094 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1095 start_va = 0x7ff8eae50000 end_va = 0x7ff8eaea3fff entry_point = 0x7ff8eae50000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1096 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1097 start_va = 0x7ff8eafb0000 end_va = 0x7ff8eb170fff entry_point = 0x7ff8eafb0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1098 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1099 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1100 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1101 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1102 start_va = 0x7ff8ebbf0000 end_va = 0x7ff8ebdb4fff entry_point = 0x7ff8ebbf0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1103 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1104 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1105 start_va = 0x7ff8ec220000 end_va = 0x7ff8ec23bfff entry_point = 0x7ff8ec220000 region_type = mapped_file name = "imagehlp.dll" filename = "\\Windows\\System32\\imagehlp.dll" (normalized: "c:\\windows\\system32\\imagehlp.dll") Region: id = 1106 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1107 start_va = 0x7ff8ec2a0000 end_va = 0x7ff8ec2fafff entry_point = 0x7ff8ec2a0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1108 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1109 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1110 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1111 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1112 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1113 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1114 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1115 start_va = 0x7ff8ee040000 end_va = 0x7ff8ee0a8fff entry_point = 0x7ff8ee040000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1116 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1117 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1118 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1119 start_va = 0x7ff8ee250000 end_va = 0x7ff8ee257fff entry_point = 0x7ff8ee250000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1120 start_va = 0x7ff8ee260000 end_va = 0x7ff8ee2cefff entry_point = 0x7ff8ee260000 region_type = mapped_file name = "coml2.dll" filename = "\\Windows\\System32\\coml2.dll" (normalized: "c:\\windows\\system32\\coml2.dll") Region: id = 1121 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1122 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2112 start_va = 0x54a0000 end_va = 0x550bfff entry_point = 0x0 region_type = private name = "private_0x00000000054a0000" filename = "" Region: id = 2113 start_va = 0x60a0000 end_va = 0x60d3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000060a0000" filename = "" Region: id = 2114 start_va = 0x7ff8db5c0000 end_va = 0x7ff8db609fff entry_point = 0x7ff8db5c0000 region_type = mapped_file name = "windowscodecsext.dll" filename = "\\Windows\\System32\\WindowsCodecsExt.dll" (normalized: "c:\\windows\\system32\\windowscodecsext.dll") Region: id = 2115 start_va = 0x7ff8d0ea0000 end_va = 0x7ff8d0f30fff entry_point = 0x7ff8d0ea0000 region_type = mapped_file name = "mscms.dll" filename = "\\Windows\\System32\\mscms.dll" (normalized: "c:\\windows\\system32\\mscms.dll") Region: id = 2187 start_va = 0x7ff8d0df0000 end_va = 0x7ff8d0e96fff entry_point = 0x7ff8d0df0000 region_type = mapped_file name = "ieproxy.dll" filename = "\\Windows\\System32\\ieproxy.dll" (normalized: "c:\\windows\\system32\\ieproxy.dll") Thread: id = 33 os_tid = 0xf84 Thread: id = 34 os_tid = 0xf7c Thread: id = 35 os_tid = 0xc6c Thread: id = 36 os_tid = 0x908 Thread: id = 37 os_tid = 0x90c Thread: id = 38 os_tid = 0x960 Thread: id = 39 os_tid = 0x7c8 Thread: id = 40 os_tid = 0x7e8 Thread: id = 41 os_tid = 0x95c Thread: id = 42 os_tid = 0x974 Thread: id = 43 os_tid = 0x46c Thread: id = 44 os_tid = 0xbe0 Thread: id = 45 os_tid = 0xbdc Thread: id = 46 os_tid = 0xa98 Thread: id = 47 os_tid = 0xa94 Thread: id = 48 os_tid = 0xa18 Thread: id = 49 os_tid = 0x970 Thread: id = 50 os_tid = 0x964 Thread: id = 51 os_tid = 0x94c Thread: id = 52 os_tid = 0x948 Thread: id = 53 os_tid = 0x940 Thread: id = 54 os_tid = 0x938 Thread: id = 55 os_tid = 0x930 Thread: id = 56 os_tid = 0x92c Thread: id = 57 os_tid = 0x8fc Thread: id = 58 os_tid = 0x8f8 Thread: id = 59 os_tid = 0x8f4 Thread: id = 60 os_tid = 0x8f0 Thread: id = 61 os_tid = 0x8c0 Thread: id = 62 os_tid = 0x8a4 Thread: id = 63 os_tid = 0x878 Thread: id = 64 os_tid = 0x86c Thread: id = 65 os_tid = 0x84c Thread: id = 66 os_tid = 0x848 Thread: id = 67 os_tid = 0x844 Thread: id = 68 os_tid = 0x840 Thread: id = 69 os_tid = 0x830 Thread: id = 70 os_tid = 0x82c Thread: id = 71 os_tid = 0x810 Thread: id = 72 os_tid = 0x80c Thread: id = 73 os_tid = 0x808 Thread: id = 74 os_tid = 0x804 Thread: id = 75 os_tid = 0x5bc Thread: id = 76 os_tid = 0x478 Thread: id = 77 os_tid = 0x5b4 Thread: id = 78 os_tid = 0x65c Thread: id = 79 os_tid = 0x5e8 Thread: id = 80 os_tid = 0x5ec Thread: id = 81 os_tid = 0x55c Thread: id = 107 os_tid = 0xc0c Thread: id = 288 os_tid = 0xdf0 Thread: id = 316 os_tid = 0x76c Process: id = "6" image_name = "openwith.exe" filename = "c:\\windows\\system32\\openwith.exe" page_root = "0x2917e000" os_pid = "0xc1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xdd4" cmd_line = "C:\\Windows\\system32\\OpenWith.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1124 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1125 start_va = 0xa30b7e0000 end_va = 0xa30b7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30b7e0000" filename = "" Region: id = 1126 start_va = 0xa30b7f0000 end_va = 0xa30b7f6fff entry_point = 0x0 region_type = private name = "private_0x000000a30b7f0000" filename = "" Region: id = 1127 start_va = 0xa30b800000 end_va = 0xa30b813fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30b800000" filename = "" Region: id = 1128 start_va = 0xa30b820000 end_va = 0xa30b89ffff entry_point = 0x0 region_type = private name = "private_0x000000a30b820000" filename = "" Region: id = 1129 start_va = 0xa30b8a0000 end_va = 0xa30b8a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30b8a0000" filename = "" Region: id = 1130 start_va = 0xa30b8b0000 end_va = 0xa30b8b2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30b8b0000" filename = "" Region: id = 1131 start_va = 0xa30b8c0000 end_va = 0xa30b8c1fff entry_point = 0x0 region_type = private name = "private_0x000000a30b8c0000" filename = "" Region: id = 1132 start_va = 0xa30b8d0000 end_va = 0xa30b98dfff entry_point = 0xa30b8d0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1133 start_va = 0xa30b990000 end_va = 0xa30b99ffff entry_point = 0x0 region_type = private name = "private_0x000000a30b990000" filename = "" Region: id = 1134 start_va = 0xa30b9a0000 end_va = 0xa30b9a6fff entry_point = 0x0 region_type = private name = "private_0x000000a30b9a0000" filename = "" Region: id = 1135 start_va = 0xa30b9b0000 end_va = 0xa30b9b0fff entry_point = 0xa30b9b0000 region_type = mapped_file name = "openwith.exe.mui" filename = "\\Windows\\System32\\en-US\\OpenWith.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\openwith.exe.mui") Region: id = 1136 start_va = 0xa30b9c0000 end_va = 0xa30b9c0fff entry_point = 0x0 region_type = private name = "private_0x000000a30b9c0000" filename = "" Region: id = 1137 start_va = 0xa30b9d0000 end_va = 0xa30b9d0fff entry_point = 0x0 region_type = private name = "private_0x000000a30b9d0000" filename = "" Region: id = 1138 start_va = 0xa30b9e0000 end_va = 0xa30badffff entry_point = 0x0 region_type = private name = "private_0x000000a30b9e0000" filename = "" Region: id = 1139 start_va = 0xa30bae0000 end_va = 0xa30bb5ffff entry_point = 0x0 region_type = private name = "private_0x000000a30bae0000" filename = "" Region: id = 1140 start_va = 0xa30bb60000 end_va = 0xa30bce7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30bb60000" filename = "" Region: id = 1141 start_va = 0xa30bcf0000 end_va = 0xa30be70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30bcf0000" filename = "" Region: id = 1142 start_va = 0xa30be80000 end_va = 0xa30d27ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30be80000" filename = "" Region: id = 1143 start_va = 0xa30d280000 end_va = 0xa30d280fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30d280000" filename = "" Region: id = 1144 start_va = 0xa30d290000 end_va = 0xa30d291fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30d290000" filename = "" Region: id = 1145 start_va = 0xa30d2a0000 end_va = 0xa30d31ffff entry_point = 0x0 region_type = private name = "private_0x000000a30d2a0000" filename = "" Region: id = 1146 start_va = 0xa30d320000 end_va = 0xa30d39ffff entry_point = 0x0 region_type = private name = "private_0x000000a30d320000" filename = "" Region: id = 1147 start_va = 0xa30d3a0000 end_va = 0xa30d41ffff entry_point = 0x0 region_type = private name = "private_0x000000a30d3a0000" filename = "" Region: id = 1148 start_va = 0xa30d450000 end_va = 0xa30d45ffff entry_point = 0x0 region_type = private name = "private_0x000000a30d450000" filename = "" Region: id = 1149 start_va = 0xa30d460000 end_va = 0xa30d796fff entry_point = 0xa30d460000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1150 start_va = 0xa30d7a0000 end_va = 0xa30d81ffff entry_point = 0x0 region_type = private name = "private_0x000000a30d7a0000" filename = "" Region: id = 1151 start_va = 0x7df5ff6b0000 end_va = 0x7ff5ff6affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff6b0000" filename = "" Region: id = 1152 start_va = 0x7ff7bcbc0000 end_va = 0x7ff7bccbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bcbc0000" filename = "" Region: id = 1153 start_va = 0x7ff7bccc0000 end_va = 0x7ff7bcce2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bccc0000" filename = "" Region: id = 1154 start_va = 0x7ff7bcce3000 end_va = 0x7ff7bcce3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcce3000" filename = "" Region: id = 1155 start_va = 0x7ff7bcce4000 end_va = 0x7ff7bcce5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcce4000" filename = "" Region: id = 1156 start_va = 0x7ff7bcce6000 end_va = 0x7ff7bcce7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcce6000" filename = "" Region: id = 1157 start_va = 0x7ff7bcce8000 end_va = 0x7ff7bcce9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcce8000" filename = "" Region: id = 1158 start_va = 0x7ff7bccea000 end_va = 0x7ff7bccebfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bccea000" filename = "" Region: id = 1159 start_va = 0x7ff7bccec000 end_va = 0x7ff7bccedfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bccec000" filename = "" Region: id = 1160 start_va = 0x7ff7bccee000 end_va = 0x7ff7bcceffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bccee000" filename = "" Region: id = 1161 start_va = 0x7ff7bd650000 end_va = 0x7ff7bd669fff entry_point = 0x7ff7bd650000 region_type = mapped_file name = "openwith.exe" filename = "\\Windows\\System32\\OpenWith.exe" (normalized: "c:\\windows\\system32\\openwith.exe") Region: id = 1162 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1163 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 1164 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1165 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1166 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1167 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1168 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1169 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1170 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1171 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1172 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1173 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1174 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1175 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1176 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1177 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1178 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1179 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1180 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1181 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1182 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1183 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1184 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1185 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1186 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1187 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1188 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1189 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1190 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1191 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1214 start_va = 0xa30d420000 end_va = 0xa30d420fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30d420000" filename = "" Region: id = 1215 start_va = 0xa30d430000 end_va = 0xa30d430fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30d430000" filename = "" Region: id = 1216 start_va = 0x7ff8ddbd0000 end_va = 0x7ff8de6dcfff entry_point = 0x7ff8ddbd0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 1217 start_va = 0x7ff8e9860000 end_va = 0x7ff8e994dfff entry_point = 0x7ff8e9860000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1218 start_va = 0x7ff8e3a70000 end_va = 0x7ff8e3c26fff entry_point = 0x7ff8e3a70000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 1219 start_va = 0xa30d440000 end_va = 0xa30d442fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30d440000" filename = "" Region: id = 1220 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1221 start_va = 0x7ff8e7430000 end_va = 0x7ff8e7560fff entry_point = 0x7ff8e7430000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1222 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2466 start_va = 0xa30d820000 end_va = 0xa30d849fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30d820000" filename = "" Region: id = 2467 start_va = 0xa30d850000 end_va = 0xa30d850fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30d850000" filename = "" Region: id = 2468 start_va = 0xa30d860000 end_va = 0xa30d861fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30d860000" filename = "" Region: id = 2469 start_va = 0xa30d870000 end_va = 0xa30d8effff entry_point = 0x0 region_type = private name = "private_0x000000a30d870000" filename = "" Region: id = 2470 start_va = 0xa30d8f0000 end_va = 0xa30d96ffff entry_point = 0x0 region_type = private name = "private_0x000000a30d8f0000" filename = "" Region: id = 2471 start_va = 0xa30d970000 end_va = 0xa30d971fff entry_point = 0xa30d970000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 2472 start_va = 0xa30d980000 end_va = 0xa30d983fff entry_point = 0xa30d980000 region_type = mapped_file name = "windows.ui.immersive.dll.mui" filename = "\\Windows\\System32\\en-US\\Windows.UI.Immersive.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.ui.immersive.dll.mui") Region: id = 2473 start_va = 0xa30d990000 end_va = 0xa30da0ffff entry_point = 0x0 region_type = private name = "private_0x000000a30d990000" filename = "" Region: id = 2474 start_va = 0xa30da10000 end_va = 0xa30da13fff entry_point = 0xa30da10000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2475 start_va = 0xa30da20000 end_va = 0xa30da62fff entry_point = 0xa30da20000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db") Region: id = 2476 start_va = 0xa30da70000 end_va = 0xa30da73fff entry_point = 0xa30da70000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2477 start_va = 0xa30da80000 end_va = 0xa30db0afff entry_point = 0xa30da80000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 2478 start_va = 0xa30db10000 end_va = 0xa30db12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30db10000" filename = "" Region: id = 2479 start_va = 0xa30db20000 end_va = 0xa30db28fff entry_point = 0x0 region_type = private name = "private_0x000000a30db20000" filename = "" Region: id = 2480 start_va = 0xa30db30000 end_va = 0xa30db30fff entry_point = 0x0 region_type = private name = "private_0x000000a30db30000" filename = "" Region: id = 2481 start_va = 0xa30db40000 end_va = 0xa30dc3ffff entry_point = 0x0 region_type = private name = "private_0x000000a30db40000" filename = "" Region: id = 2482 start_va = 0xa30dc40000 end_va = 0xa30dc40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30dc40000" filename = "" Region: id = 2483 start_va = 0xa30dc50000 end_va = 0xa30dc50fff entry_point = 0x0 region_type = private name = "private_0x000000a30dc50000" filename = "" Region: id = 2484 start_va = 0xa30dc60000 end_va = 0xa30dc60fff entry_point = 0x0 region_type = private name = "private_0x000000a30dc60000" filename = "" Region: id = 2485 start_va = 0xa30dc70000 end_va = 0xa30dceffff entry_point = 0x0 region_type = private name = "private_0x000000a30dc70000" filename = "" Region: id = 2486 start_va = 0xa30dcf0000 end_va = 0xa30dcf0fff entry_point = 0x0 region_type = private name = "private_0x000000a30dcf0000" filename = "" Region: id = 2487 start_va = 0xa30dd00000 end_va = 0xa30dd00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30dd00000" filename = "" Region: id = 2488 start_va = 0xa30dd10000 end_va = 0xa30dd23fff entry_point = 0xa30dd10000 region_type = mapped_file name = "twinui.dll.mui" filename = "\\Windows\\System32\\en-US\\twinui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\twinui.dll.mui") Region: id = 2489 start_va = 0xa30dd30000 end_va = 0xa30dd31fff entry_point = 0xa30dd30000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 2490 start_va = 0xa30dd40000 end_va = 0xa30dd44fff entry_point = 0xa30dd40000 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 2491 start_va = 0xa30dd50000 end_va = 0xa30de4ffff entry_point = 0x0 region_type = private name = "private_0x000000a30dd50000" filename = "" Region: id = 2492 start_va = 0xa30de50000 end_va = 0xa30de53fff entry_point = 0xa30de50000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 2493 start_va = 0xa30de60000 end_va = 0xa30de72fff entry_point = 0xa30de60000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 2494 start_va = 0xa30de80000 end_va = 0xa30de80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30de80000" filename = "" Region: id = 2495 start_va = 0xa30de90000 end_va = 0xa30df0ffff entry_point = 0x0 region_type = private name = "private_0x000000a30de90000" filename = "" Region: id = 2496 start_va = 0xa30df10000 end_va = 0xa30df2bfff entry_point = 0xa30df10000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db") Region: id = 2497 start_va = 0xa30df30000 end_va = 0xa30dfaffff entry_point = 0x0 region_type = private name = "private_0x000000a30df30000" filename = "" Region: id = 2498 start_va = 0xa30dfb0000 end_va = 0xa30e0affff entry_point = 0x0 region_type = private name = "private_0x000000a30dfb0000" filename = "" Region: id = 2499 start_va = 0xa30e0b0000 end_va = 0xa30e0b0fff entry_point = 0x0 region_type = private name = "private_0x000000a30e0b0000" filename = "" Region: id = 2500 start_va = 0xa30e0c0000 end_va = 0xa30e0c3fff entry_point = 0xa30e0c0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 2501 start_va = 0xa30e0d0000 end_va = 0xa30e0d1fff entry_point = 0xa30e0d0000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 2502 start_va = 0xa30e0e0000 end_va = 0xa30e103fff entry_point = 0x0 region_type = private name = "private_0x000000a30e0e0000" filename = "" Region: id = 2503 start_va = 0xa30e110000 end_va = 0xa30e118fff entry_point = 0x0 region_type = private name = "private_0x000000a30e110000" filename = "" Region: id = 2504 start_va = 0xa30e120000 end_va = 0xa30e21ffff entry_point = 0x0 region_type = private name = "private_0x000000a30e120000" filename = "" Region: id = 2505 start_va = 0xa30e220000 end_va = 0xa30e221fff entry_point = 0xa30e220000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 2506 start_va = 0xa30e230000 end_va = 0xa30e232fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30e230000" filename = "" Region: id = 2507 start_va = 0xa30e240000 end_va = 0xa30e241fff entry_point = 0xa30e240000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 2508 start_va = 0xa30e250000 end_va = 0xa30e34ffff entry_point = 0xa30e250000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 2509 start_va = 0xa30e350000 end_va = 0xa30e397fff entry_point = 0x0 region_type = private name = "private_0x000000a30e350000" filename = "" Region: id = 2510 start_va = 0xa30e3a0000 end_va = 0xa30e3b0fff entry_point = 0xa30e3a0000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 2511 start_va = 0xa30e3c0000 end_va = 0xa30e4bffff entry_point = 0xa30e3c0000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 2512 start_va = 0xa30e4c0000 end_va = 0xa30e4c0fff entry_point = 0x0 region_type = private name = "private_0x000000a30e4c0000" filename = "" Region: id = 2513 start_va = 0xa30e4d0000 end_va = 0xa30e4dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30e4d0000" filename = "" Region: id = 2514 start_va = 0xa30e4e0000 end_va = 0xa30e4effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30e4e0000" filename = "" Region: id = 2515 start_va = 0xa30e4f0000 end_va = 0xa30e4fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30e4f0000" filename = "" Region: id = 2516 start_va = 0xa30e500000 end_va = 0xa30e5fffff entry_point = 0xa30e500000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 2517 start_va = 0xa30e600000 end_va = 0xa30e602fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a30e600000" filename = "" Region: id = 2518 start_va = 0xa30e610000 end_va = 0xa30e610fff entry_point = 0x0 region_type = private name = "private_0x000000a30e610000" filename = "" Region: id = 2519 start_va = 0xa30e620000 end_va = 0xa30e620fff entry_point = 0x0 region_type = private name = "private_0x000000a30e620000" filename = "" Region: id = 2520 start_va = 0xa30e630000 end_va = 0xa30e633fff entry_point = 0xa30e630000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2521 start_va = 0xa30e650000 end_va = 0xa30e650fff entry_point = 0x0 region_type = private name = "private_0x000000a30e650000" filename = "" Region: id = 2522 start_va = 0xa30e660000 end_va = 0xa30e6dffff entry_point = 0x0 region_type = private name = "private_0x000000a30e660000" filename = "" Region: id = 2523 start_va = 0x7ff7bcbb2000 end_va = 0x7ff7bcbb3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcbb2000" filename = "" Region: id = 2524 start_va = 0x7ff7bcbb4000 end_va = 0x7ff7bcbb5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcbb4000" filename = "" Region: id = 2525 start_va = 0x7ff7bcbb6000 end_va = 0x7ff7bcbb7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcbb6000" filename = "" Region: id = 2526 start_va = 0x7ff7bcbb8000 end_va = 0x7ff7bcbb9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcbb8000" filename = "" Region: id = 2527 start_va = 0x7ff7bcbba000 end_va = 0x7ff7bcbbbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcbba000" filename = "" Region: id = 2528 start_va = 0x7ff7bcbbc000 end_va = 0x7ff7bcbbdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcbbc000" filename = "" Region: id = 2529 start_va = 0x7ff7bcbbe000 end_va = 0x7ff7bcbbffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcbbe000" filename = "" Region: id = 2530 start_va = 0x7ff8d1180000 end_va = 0x7ff8d132ffff entry_point = 0x7ff8d1180000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 2531 start_va = 0x7ff8d1330000 end_va = 0x7ff8d147bfff entry_point = 0x7ff8d1330000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 2532 start_va = 0x7ff8d76a0000 end_va = 0x7ff8d7738fff entry_point = 0x7ff8d76a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 2533 start_va = 0x7ff8dc6e0000 end_va = 0x7ff8dc778fff entry_point = 0x7ff8dc6e0000 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 2534 start_va = 0x7ff8dc780000 end_va = 0x7ff8dca11fff entry_point = 0x7ff8dc780000 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 2535 start_va = 0x7ff8dcfd0000 end_va = 0x7ff8dd018fff entry_point = 0x7ff8dcfd0000 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 2536 start_va = 0x7ff8dd8f0000 end_va = 0x7ff8dd8fcfff entry_point = 0x7ff8dd8f0000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 2537 start_va = 0x7ff8dd900000 end_va = 0x7ff8dd94afff entry_point = 0x7ff8dd900000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 2538 start_va = 0x7ff8debc0000 end_va = 0x7ff8dec28fff entry_point = 0x7ff8debc0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 2539 start_va = 0x7ff8e0a60000 end_va = 0x7ff8e0bf6fff entry_point = 0x7ff8e0a60000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 2540 start_va = 0x7ff8e2f70000 end_va = 0x7ff8e2fdafff entry_point = 0x7ff8e2f70000 region_type = mapped_file name = "photometadatahandler.dll" filename = "\\Windows\\System32\\PhotoMetadataHandler.dll" (normalized: "c:\\windows\\system32\\photometadatahandler.dll") Region: id = 2541 start_va = 0x7ff8e37f0000 end_va = 0x7ff8e3a48fff entry_point = 0x7ff8e37f0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 2542 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2543 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 2544 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 2545 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2546 start_va = 0x7ff8e8650000 end_va = 0x7ff8e869afff entry_point = 0x7ff8e8650000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 2547 start_va = 0x7ff8e86a0000 end_va = 0x7ff8e8851fff entry_point = 0x7ff8e86a0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 2548 start_va = 0x7ff8e8860000 end_va = 0x7ff8e8acdfff entry_point = 0x7ff8e8860000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 2549 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 2550 start_va = 0x7ff8e8c60000 end_va = 0x7ff8e8cfbfff entry_point = 0x7ff8e8c60000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2551 start_va = 0x7ff8e8d00000 end_va = 0x7ff8e8fa2fff entry_point = 0x7ff8e8d00000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 2552 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 2553 start_va = 0x7ff8e9130000 end_va = 0x7ff8e9200fff entry_point = 0x7ff8e9130000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 2554 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 2555 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Thread: id = 84 os_tid = 0x1b8 Thread: id = 85 os_tid = 0xa3c Thread: id = 86 os_tid = 0xa5c Thread: id = 87 os_tid = 0x4d4 Thread: id = 88 os_tid = 0xa14 [0077.429] GetMessageW (in: lpMsg=0xa30b89f868, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa30b89f868) returned 1 [0077.429] TranslateMessage (lpMsg=0xa30b89f868) returned 0 [0077.429] DispatchMessageW (lpMsg=0xa30b89f868) returned 0x1 [0077.434] GetMessageW (in: lpMsg=0xa30b89f868, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa30b89f868) returned 1 [0077.541] TranslateMessage (lpMsg=0xa30b89f868) returned 0 [0077.541] DispatchMessageW (lpMsg=0xa30b89f868) returned 0x1 [0077.989] IUnknown_Set (in: ppunk=0xa30b995f60*=0x0, punk=0xa30ba0ae28 | out: ppunk=0xa30b995f60*=0xa30ba0ae28) [0077.989] GetMessageW (in: lpMsg=0xa30b89f868, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa30b89f868) returned 1 [0078.175] TranslateMessage (lpMsg=0xa30b89f868) returned 0 [0078.175] DispatchMessageW (lpMsg=0xa30b89f868) returned 0x1 [0078.175] GetMessageW (in: lpMsg=0xa30b89f868, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa30b89f868) returned 1 [0078.230] TranslateMessage (lpMsg=0xa30b89f868) returned 0 [0078.230] DispatchMessageW (lpMsg=0xa30b89f868) returned 0x1 [0078.231] Str_SetPtrW (in: ppsz=0xa30b995fa8*=0x0, psz="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: ppsz=0xa30b995fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0078.231] GetMessageW (in: lpMsg=0xa30b89f868, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa30b89f868) returned 1 [0078.301] TranslateMessage (lpMsg=0xa30b89f868) returned 0 [0078.301] DispatchMessageW (lpMsg=0xa30b89f868) returned 0x1 [0078.301] GetMessageW (in: lpMsg=0xa30b89f868, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa30b89f868) returned 1 [0078.317] TranslateMessage (lpMsg=0xa30b89f868) returned 0 [0078.317] DispatchMessageW (lpMsg=0xa30b89f868) returned 0x1 [0078.319] GetMessageW (in: lpMsg=0xa30b89f868, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa30b89f868) returned 1 [0078.409] TranslateMessage (lpMsg=0xa30b89f868) returned 0 [0078.409] DispatchMessageW (lpMsg=0xa30b89f868) returned 0x1 [0078.416] IUnknown_Set (in: ppunk=0xa30b995fc0*=0x0, punk=0xa30ba18078 | out: ppunk=0xa30b995fc0*=0xa30ba18078) [0078.416] GetMessageW (in: lpMsg=0xa30b89f868, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa30b89f868) returned 1 [0078.427] TranslateMessage (lpMsg=0xa30b89f868) returned 0 [0078.427] DispatchMessageW (lpMsg=0xa30b89f868) returned 0x1 [0078.428] GetMessageW (in: lpMsg=0xa30b89f868, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa30b89f868) returned 1 [0078.470] TranslateMessage (lpMsg=0xa30b89f868) returned 0 [0078.470] DispatchMessageW (lpMsg=0xa30b89f868) returned 0x1 [0078.471] GetMessageW (in: lpMsg=0xa30b89f868, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa30b89f868) returned 1 [0078.506] TranslateMessage (lpMsg=0xa30b89f868) returned 0 [0078.506] DispatchMessageW (lpMsg=0xa30b89f868) returned 0x1 [0078.506] CoTaskMemAlloc (cb=0xa) returned 0xa30b9fd9f0 [0078.517] GetMessageW (in: lpMsg=0xa30b89f868, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa30b89f868) returned 1 [0078.518] TranslateMessage (lpMsg=0xa30b89f868) returned 0 [0078.518] DispatchMessageW (lpMsg=0xa30b89f868) returned 0x1 [0078.519] GetMessageW (in: lpMsg=0xa30b89f868, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa30b89f868) returned 1 [0078.519] TranslateMessage (lpMsg=0xa30b89f868) returned 0 [0078.519] DispatchMessageW (lpMsg=0xa30b89f868) returned 0x1 [0078.519] GetMessageW (in: lpMsg=0xa30b89f868, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa30b89f868) returned 1 [0078.520] TranslateMessage (lpMsg=0xa30b89f868) returned 0 [0078.520] DispatchMessageW (lpMsg=0xa30b89f868) returned 0x1 [0078.520] KillTimer (hWnd=0x0, uIDEvent=0x7f8d) returned 1 [0078.520] CompareStringOrdinal (lpString1="InvokeDefaultVerbInOtherProcess", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 1 [0078.520] CoCreateInstance (in: rclsid=0x7ff7bd6575b0*(Data1=0x94b23d4d, Data2=0x1040, Data3=0x4c4b, Data4=([0]=0x90, [1]=0x81, [2]=0x85, [3]=0xd8, [4]=0xd6, [5]=0xfa, [6]=0x36, [7]=0xc4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7bd657a50*(Data1=0xce149b23, Data2=0x5941, Data3=0x4079, Data4=([0]=0x92, [1]=0x23, [2]=0x52, [3]=0xc0, [4]=0xa9, [5]=0x91, [6]=0xec, [7]=0x48)), ppv=0xa30b995fe0 | out: ppv=0xa30b995fe0*=0xa30b999620) returned 0x0 [0078.549] IUnknown_SetSite (punk=0xa30b999620, punkSite=0xa30b995f40) returned 0x0 [0078.550] IUnknown:QueryInterface (This=0xa30b995f40, riid=0x7ff8ee00d438*(Data1=0x114, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xa30b89e1b0) [0078.550] IUnknown:QueryInterface (This=0xa30b995f40, riid=0x7ff8ee00d468*(Data1=0x79eac9ed, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xa30b89e1a0) [0078.550] IUnknown:QueryInterface (This=0xa30b995f40, riid=0x7ff8ee00d458*(Data1=0x214e3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xa30b89e1a8) [0078.550] IUnknown:QueryInterface (This=0xa30b995f40, riid=0x7ff8ee00d448*(Data1=0x45d64a29, Data2=0xa63e, Data3=0x4cb6, Data4=([0]=0xb4, [1]=0x98, [2]=0x57, [3]=0x81, [4]=0xd2, [5]=0x98, [6]=0xcb, [7]=0x4f)), ppvObject=0xa30b89e1b8) [0078.550] IUnknown:QueryInterface (This=0xa30b995f40, riid=0x7ff8eb8347d8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0xa30b89e1e0) [0078.550] IUnknown:QueryInterface (in: This=0xa30ba0ae28, riid=0x7ff8de1e0bd8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xa30b89e210 | out: ppvObject=0xa30b89e210*=0xa30ba0ae28) returned 0x0 [0079.103] IUnknown:QueryInterface (This=0xa30b995f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xa30b89e210) [0079.103] IUnknown:AddRef (This=0xa30b995f40) returned 0xe [0079.103] IUnknown_QueryService (in: punk=0xa30ba0ae28, guidService=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), riid=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), ppvOut=0xa30b9996e0 | out: ppvOut=0xa30b9996e0*=0x0) returned 0x80004001 [0079.222] IUnknown:Release (This=0xa30b995f40) returned 0xd [0079.222] IUnknown:QueryInterface (This=0xa30b995f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xa30b89e210) [0079.222] IUnknown:AddRef (This=0xa30b995f40) returned 0xe [0079.222] IUnknown_QueryService (in: punk=0xa30ba0ae28, guidService=0x7ff8de1c0980*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), riid=0x7ff8de1c0a40*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), ppvOut=0xa30b9996e8 | out: ppvOut=0xa30b9996e8*=0x0) returned 0x80004001 [0079.223] IUnknown:Release (This=0xa30b995f40) returned 0xd [0079.223] IUnknown:QueryInterface (This=0xa30b995f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xa30b89e210) [0079.223] IUnknown:AddRef (This=0xa30b995f40) returned 0xe [0079.223] IUnknown_QueryService (in: punk=0xa30ba0ae28, guidService=0x7ff8de1c0950*(Data1=0xcde725b0, Data2=0xccc9, Data3=0x4519, Data4=([0]=0x91, [1]=0x7e, [2]=0x32, [3]=0x5d, [4]=0x72, [5]=0xfa, [6]=0xb4, [7]=0xce)), riid=0x7ff8de1d2fb0*(Data1=0x1af3a467, Data2=0x214f, Data3=0x4298, Data4=([0]=0x90, [1]=0x8e, [2]=0x6, [3]=0xb0, [4]=0x3e, [5]=0xb, [6]=0x39, [7]=0xf9)), ppvOut=0xa30b9996f0 | out: ppvOut=0xa30b9996f0*=0x0) returned 0x80004001 [0079.224] IUnknown:Release (This=0xa30b995f40) returned 0xd [0079.224] IUnknown:QueryInterface (This=0xa30b995f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xa30b89e210) [0079.224] IUnknown:AddRef (This=0xa30b995f40) returned 0xe [0079.224] IUnknown_QueryService (in: punk=0xa30ba0ae28, guidService=0x7ff8de1c0800*(Data1=0x80605492, Data2=0x67d9, Data3=0x414f, Data4=([0]=0xaf, [1]=0x89, [2]=0xa1, [3]=0xcd, [4]=0xf1, [5]=0x24, [6]=0x2b, [7]=0xc1)), riid=0x7ff8de1c0068*(Data1=0xe5aa01f7, Data2=0x1fb8, Data3=0x4830, Data4=([0]=0x87, [1]=0x20, [2]=0x4e, [3]=0x67, [4]=0x34, [5]=0xcb, [6]=0xd5, [7]=0xf3)), ppvOut=0xa30b9996f8 | out: ppvOut=0xa30b9996f8*=0x0) returned 0x80004001 [0079.225] IUnknown:Release (This=0xa30b995f40) returned 0xd [0079.225] IUnknown:QueryInterface (This=0xa30b995f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xa30b89e210) [0079.225] IUnknown:AddRef (This=0xa30b995f40) returned 0xe [0079.225] IUnknown_QueryService (in: punk=0xa30ba0ae28, guidService=0x7ff8de1c0810*(Data1=0x2ce78010, Data2=0x74db, Data3=0x48bc, Data4=([0]=0x9c, [1]=0x6a, [2]=0x10, [3]=0xf3, [4]=0x72, [5]=0x49, [6]=0x57, [7]=0x23)), riid=0x7ff8de1bfb70*(Data1=0x989191ac, Data2=0x28ff, Data3=0x4cf0, Data4=([0]=0x95, [1]=0x84, [2]=0xe0, [3]=0xd0, [4]=0x78, [5]=0xbc, [6]=0x23, [7]=0x96)), ppvOut=0xa30b999700 | out: ppvOut=0xa30b999700*=0x0) returned 0x80004001 [0079.226] IUnknown:Release (This=0xa30b995f40) returned 0xd [0079.226] IUnknown:QueryInterface (This=0xa30b995f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xa30b89e210) [0079.226] IUnknown:AddRef (This=0xa30b995f40) returned 0xe [0079.226] IUnknown_QueryService (in: punk=0xa30ba0ae28, guidService=0x7ff8de1c0078*(Data1=0x26db2472, Data2=0xb7b7, Data3=0x406b, Data4=([0]=0x97, [1]=0x2, [2]=0x73, [3]=0xa, [4]=0x4e, [5]=0x20, [6]=0xd3, [7]=0xbf)), riid=0x7ff8de1c0a10*(Data1=0x2f0666c6, Data2=0x12f7, Data3=0x4360, Data4=([0]=0xb5, [1]=0x11, [2]=0xa3, [3]=0x94, [4]=0xa0, [5]=0x55, [6]=0x37, [7]=0x25)), ppvOut=0xa30b999708 | out: ppvOut=0xa30b999708*=0x0) returned 0x80004001 [0079.227] IUnknown:Release (This=0xa30b995f40) returned 0xd [0079.227] IUnknown:QueryInterface (This=0xa30b995f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xa30b89e210) [0079.227] IUnknown:AddRef (This=0xa30b995f40) returned 0xe [0079.227] IUnknown_QueryService (in: punk=0xa30ba0ae28, guidService=0x7ff8de1c0930*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), riid=0x7ff8de1c0a30*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), ppvOut=0xa30b999bf0 | out: ppvOut=0xa30b999bf0*=0x0) returned 0x80004001 [0079.227] IUnknown:Release (This=0xa30b995f40) returned 0xd [0079.227] IUnknown:QueryInterface (This=0xa30b995f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xa30b89e210) [0079.228] IUnknown:AddRef (This=0xa30b995f40) returned 0xe [0079.228] IUnknown_QueryService (in: punk=0xa30ba0ae28, guidService=0x7ff8de27c2c0*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff8de27fc98*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xa30b89e250 | out: ppvOut=0xa30b89e250*=0x0) returned 0x80004001 [0079.228] IUnknown:Release (This=0xa30b995f40) returned 0xd [0079.228] IUnknown:AddRef (This=0xa30b995f40) returned 0xe [0079.228] GetCurrentThreadId () returned 0xa14 [0079.228] PostThreadMessageW (idThread=0xa14, Msg=0x8001, wParam=0x0, lParam=0x0) returned 1 [0079.229] GetMessageW (in: lpMsg=0xa30b89f868, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa30b89f868) returned 1 [0079.229] CompareStringOrdinal (lpString1="openas", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0079.229] CompareStringOrdinal (lpString1="OpenWithSetDefaultOn", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0079.229] IUnknown_QueryService (in: punk=0xa30ba0ae28, guidService=0x7ff7bd657da0*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), riid=0x7ff7bd657910*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), ppvOut=0xa30b89f8f8 | out: ppvOut=0xa30b89f8f8*=0xa30ba1bd38) returned 0x0 [0079.358] IUnknown_Set (in: ppunk=0xa30b995f60*=0xa30ba0ae28, punk=0x0 | out: ppunk=0xa30b995f60*=0x0) [0079.361] IUnknown_QueryService (in: punk=0x0, guidService=0x7ff7bd657d60*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff7bd657950*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xa30b89f848 | out: ppvOut=0xa30b89f848*=0x0) returned 0x80004001 [0079.361] QISearch (in: that=0xa30b995f30, pqit=0x7ff7bd657970, riid=0x7ff7bd657ac0*(Data1=0x1c9cd5bb, Data2=0x98e9, Data3=0x4491, Data4=([0]=0xa6, [1]=0xf, [2]=0x31, [3]=0xaa, [4]=0xcc, [5]=0x72, [6]=0xb8, [7]=0x3c)), ppv=0xa30b89f7a8 | out: that=0xa30b995f30, ppv=0xa30b89f7a8*=0xa30b995f78) returned 0x0 [0079.362] IUnknown:QueryInterface (in: This=0xa30ba18078, riid=0x7ff7bd657930*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xa30b89f840 | out: ppvObject=0xa30b89f840*=0xa30ba18078) returned 0x0 [0079.362] IShellItemArray:GetItemAt (in: This=0xa30ba18078, dwIndex=0x0, ppsi=0xa30b89f830 | out: ppsi=0xa30b89f830*=0xa30ba1cb28) returned 0x0 [0079.362] IUnknown:QueryInterface (in: This=0xa30ba1cb28, riid=0x7ff7bd657b10*(Data1=0x7e9fb0d3, Data2=0x919f, Data3=0x4307, Data4=([0]=0xab, [1]=0x2e, [2]=0x9b, [3]=0x18, [4]=0x60, [5]=0x31, [6]=0xc, [7]=0x93)), ppvObject=0xa30b89f838 | out: ppvObject=0xa30b89f838*=0xa30ba1cb28) returned 0x0 [0079.362] IUnknown:Release (This=0xa30ba1cb28) returned 0x1 [0079.362] IShellItem:BindToHandler (in: This=0xa30ba1cb28, pbc=0x0, bhid=0x7ff7bd657db0, riid=0x7ff7bd657920, ppv=0xa30b89f830 | out: ppv=0xa30b89f830) returned 0x0 [0079.368] IUnknown:Release (This=0xa30ba1cb28) returned 0x0 [0079.368] IUnknown:Release (This=0xa30ba18078) returned 0x1 [0079.368] IUnknown:AddRef (This=0xa30b995f78) returned 0xf [0079.368] IObjectWithSelection:GetSelection (in: This=0xa30b995f78, riid=0x7ff8de1c76a8, ppv=0xa30b999718 | out: ppv=0xa30b999718) returned 0x0 [0079.368] IUnknown:QueryInterface (in: This=0xa30ba18078, riid=0x7ff8de1c76a8*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xa30b999718 | out: ppvObject=0xa30b999718*=0xa30ba18078) returned 0x0 [0079.368] IUnknown:Release (This=0xa30b995f78) returned 0xe [0079.431] IUnknown:Release (This=0xa30b995f78) returned 0x7 [0079.431] IUnknown:Release (This=0xa30b995f78) returned 0x6 Thread: id = 89 os_tid = 0x708 Thread: id = 130 os_tid = 0xbe8 Thread: id = 131 os_tid = 0xf0 Thread: id = 132 os_tid = 0x340 Thread: id = 133 os_tid = 0x408 Thread: id = 134 os_tid = 0x718 Thread: id = 135 os_tid = 0xbf4 Thread: id = 222 os_tid = 0x3c8 Thread: id = 223 os_tid = 0xed0 Thread: id = 305 os_tid = 0x7a8 Thread: id = 312 os_tid = 0x7c0 Process: id = "7" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x29083000" os_pid = "0x8ec" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x508" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1230 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1231 start_va = 0x8877420000 end_va = 0x887742ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008877420000" filename = "" Region: id = 1232 start_va = 0x8877430000 end_va = 0x8877436fff entry_point = 0x0 region_type = private name = "private_0x0000008877430000" filename = "" Region: id = 1233 start_va = 0x8877440000 end_va = 0x8877453fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008877440000" filename = "" Region: id = 1234 start_va = 0x8877460000 end_va = 0x887755ffff entry_point = 0x0 region_type = private name = "private_0x0000008877460000" filename = "" Region: id = 1235 start_va = 0x8877560000 end_va = 0x8877563fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008877560000" filename = "" Region: id = 1236 start_va = 0x8877570000 end_va = 0x8877571fff entry_point = 0x0 region_type = private name = "private_0x0000008877570000" filename = "" Region: id = 1237 start_va = 0x8877580000 end_va = 0x8877580fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008877580000" filename = "" Region: id = 1238 start_va = 0x8877590000 end_va = 0x8877596fff entry_point = 0x0 region_type = private name = "private_0x0000008877590000" filename = "" Region: id = 1239 start_va = 0x88775a0000 end_va = 0x88775a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000088775a0000" filename = "" Region: id = 1240 start_va = 0x88775b0000 end_va = 0x88775b0fff entry_point = 0x0 region_type = private name = "private_0x00000088775b0000" filename = "" Region: id = 1241 start_va = 0x88775c0000 end_va = 0x88775c0fff entry_point = 0x0 region_type = private name = "private_0x00000088775c0000" filename = "" Region: id = 1242 start_va = 0x88775d0000 end_va = 0x88775d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000088775d0000" filename = "" Region: id = 1243 start_va = 0x88775f0000 end_va = 0x88775f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000088775f0000" filename = "" Region: id = 1244 start_va = 0x8877620000 end_va = 0x887771ffff entry_point = 0x0 region_type = private name = "private_0x0000008877620000" filename = "" Region: id = 1245 start_va = 0x8877720000 end_va = 0x88777ddfff entry_point = 0x8877720000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1246 start_va = 0x88777e0000 end_va = 0x88778dffff entry_point = 0x0 region_type = private name = "private_0x00000088777e0000" filename = "" Region: id = 1247 start_va = 0x88778e0000 end_va = 0x88779dffff entry_point = 0x0 region_type = private name = "private_0x00000088778e0000" filename = "" Region: id = 1248 start_va = 0x8877a10000 end_va = 0x8877a1ffff entry_point = 0x0 region_type = private name = "private_0x0000008877a10000" filename = "" Region: id = 1249 start_va = 0x8877a20000 end_va = 0x8877d56fff entry_point = 0x8877a20000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1250 start_va = 0x8877d60000 end_va = 0x8877e5ffff entry_point = 0x0 region_type = private name = "private_0x0000008877d60000" filename = "" Region: id = 1251 start_va = 0x8877e60000 end_va = 0x8877f5ffff entry_point = 0x0 region_type = private name = "private_0x0000008877e60000" filename = "" Region: id = 1252 start_va = 0x8877f60000 end_va = 0x887805ffff entry_point = 0x0 region_type = private name = "private_0x0000008877f60000" filename = "" Region: id = 1253 start_va = 0x8878060000 end_va = 0x88781e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008878060000" filename = "" Region: id = 1254 start_va = 0x88781f0000 end_va = 0x8878370fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000088781f0000" filename = "" Region: id = 1255 start_va = 0x8878380000 end_va = 0x887977ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008878380000" filename = "" Region: id = 1256 start_va = 0x8879780000 end_va = 0x887987ffff entry_point = 0x0 region_type = private name = "private_0x0000008879780000" filename = "" Region: id = 1257 start_va = 0x88798f0000 end_va = 0x88798fffff entry_point = 0x0 region_type = private name = "private_0x00000088798f0000" filename = "" Region: id = 1258 start_va = 0x7df5ffcc0000 end_va = 0x7ff5ffcbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffcc0000" filename = "" Region: id = 1259 start_va = 0x7ff6a3fcc000 end_va = 0x7ff6a3fcdfff entry_point = 0x0 region_type = private name = "private_0x00007ff6a3fcc000" filename = "" Region: id = 1260 start_va = 0x7ff6a3fce000 end_va = 0x7ff6a3fcffff entry_point = 0x0 region_type = private name = "private_0x00007ff6a3fce000" filename = "" Region: id = 1261 start_va = 0x7ff6a3fd0000 end_va = 0x7ff6a40cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6a3fd0000" filename = "" Region: id = 1262 start_va = 0x7ff6a40d0000 end_va = 0x7ff6a40f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6a40d0000" filename = "" Region: id = 1263 start_va = 0x7ff6a40f4000 end_va = 0x7ff6a40f5fff entry_point = 0x0 region_type = private name = "private_0x00007ff6a40f4000" filename = "" Region: id = 1264 start_va = 0x7ff6a40f6000 end_va = 0x7ff6a40f7fff entry_point = 0x0 region_type = private name = "private_0x00007ff6a40f6000" filename = "" Region: id = 1265 start_va = 0x7ff6a40f8000 end_va = 0x7ff6a40f9fff entry_point = 0x0 region_type = private name = "private_0x00007ff6a40f8000" filename = "" Region: id = 1266 start_va = 0x7ff6a40fa000 end_va = 0x7ff6a40fbfff entry_point = 0x0 region_type = private name = "private_0x00007ff6a40fa000" filename = "" Region: id = 1267 start_va = 0x7ff6a40fc000 end_va = 0x7ff6a40fdfff entry_point = 0x0 region_type = private name = "private_0x00007ff6a40fc000" filename = "" Region: id = 1268 start_va = 0x7ff6a40fe000 end_va = 0x7ff6a40fefff entry_point = 0x0 region_type = private name = "private_0x00007ff6a40fe000" filename = "" Region: id = 1269 start_va = 0x7ff6a4de0000 end_va = 0x7ff6a4de6fff entry_point = 0x7ff6a4de0000 region_type = mapped_file name = "dllhost.exe" filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe") Region: id = 1270 start_va = 0x7ff8dd900000 end_va = 0x7ff8dd94afff entry_point = 0x7ff8dd900000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 1271 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 1272 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1273 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1274 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1275 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1276 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1277 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1278 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1279 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1280 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1281 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1282 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1283 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1284 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1285 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1286 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1287 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1288 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1289 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1290 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1291 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1292 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1293 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1294 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1295 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1296 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1297 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1298 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1299 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1306 start_va = 0x88775e0000 end_va = 0x88775e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000088775e0000" filename = "" Region: id = 1307 start_va = 0x8877610000 end_va = 0x8877610fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008877610000" filename = "" Region: id = 1308 start_va = 0x88779e0000 end_va = 0x88779f2fff entry_point = 0x88779e0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 1309 start_va = 0x7ff8d1100000 end_va = 0x7ff8d117afff entry_point = 0x7ff8d1100000 region_type = mapped_file name = "mfmkvsrcsnk.dll" filename = "\\Windows\\System32\\mfmkvsrcsnk.dll" (normalized: "c:\\windows\\system32\\mfmkvsrcsnk.dll") Region: id = 1310 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1311 start_va = 0x7ff8e60a0000 end_va = 0x7ff8e6131fff entry_point = 0x7ff8e60a0000 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 1312 start_va = 0x7ff8e6440000 end_va = 0x7ff8e646ffff entry_point = 0x7ff8e6440000 region_type = mapped_file name = "rtworkq.dll" filename = "\\Windows\\System32\\RTWorkQ.dll" (normalized: "c:\\windows\\system32\\rtworkq.dll") Region: id = 1313 start_va = 0x7ff8e6470000 end_va = 0x7ff8e657bfff entry_point = 0x7ff8e6470000 region_type = mapped_file name = "mfplat.dll" filename = "\\Windows\\System32\\mfplat.dll" (normalized: "c:\\windows\\system32\\mfplat.dll") Region: id = 1314 start_va = 0x7ff8e75b0000 end_va = 0x7ff8e75bafff entry_point = 0x7ff8e75b0000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 1315 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1316 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1317 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1607 start_va = 0x8879a00000 end_va = 0x8879afffff entry_point = 0x0 region_type = private name = "private_0x0000008879a00000" filename = "" Region: id = 1608 start_va = 0x7ff8e2f70000 end_va = 0x7ff8e2fdafff entry_point = 0x7ff8e2f70000 region_type = mapped_file name = "photometadatahandler.dll" filename = "\\Windows\\System32\\PhotoMetadataHandler.dll" (normalized: "c:\\windows\\system32\\photometadatahandler.dll") Region: id = 1609 start_va = 0x7ff8e86a0000 end_va = 0x7ff8e8851fff entry_point = 0x7ff8e86a0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 2360 start_va = 0x7ff8d0cf0000 end_va = 0x7ff8d0debfff entry_point = 0x7ff8d0cf0000 region_type = mapped_file name = "mfsrcsnk.dll" filename = "\\Windows\\System32\\mfsrcsnk.dll" (normalized: "c:\\windows\\system32\\mfsrcsnk.dll") Region: id = 2919 start_va = 0x7ff8d0bf0000 end_va = 0x7ff8d0ceffff entry_point = 0x7ff8d0bf0000 region_type = mapped_file name = "mfmp4srcsnk.dll" filename = "\\Windows\\System32\\mfmp4srcsnk.dll" (normalized: "c:\\windows\\system32\\mfmp4srcsnk.dll") Thread: id = 93 os_tid = 0xc54 Thread: id = 94 os_tid = 0x374 Thread: id = 95 os_tid = 0x738 Thread: id = 96 os_tid = 0x5f0 Thread: id = 97 os_tid = 0x858 Thread: id = 98 os_tid = 0x1a8 Thread: id = 99 os_tid = 0x87c Thread: id = 100 os_tid = 0x888 Thread: id = 108 os_tid = 0xc10 Thread: id = 111 os_tid = 0x1f8 Thread: id = 121 os_tid = 0xc30 Thread: id = 128 os_tid = 0x56c Thread: id = 151 os_tid = 0x834 Thread: id = 152 os_tid = 0xcfc Thread: id = 232 os_tid = 0xe00 Thread: id = 239 os_tid = 0xe08 Thread: id = 241 os_tid = 0x118 Thread: id = 242 os_tid = 0xe88 Thread: id = 295 os_tid = 0x1f8 Thread: id = 296 os_tid = 0xc10 Thread: id = 297 os_tid = 0x56c Thread: id = 298 os_tid = 0xc30 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x426b5000" os_pid = "0x600" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0xfb8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xa], "NT SERVICE\\tiledatamodelsvc" [0xe], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:00015b86" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1339 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1340 start_va = 0x5120a40000 end_va = 0x5120a4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120a40000" filename = "" Region: id = 1341 start_va = 0x5120a50000 end_va = 0x5120a50fff entry_point = 0x5120a50000 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 1342 start_va = 0x5120a60000 end_va = 0x5120a73fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120a60000" filename = "" Region: id = 1343 start_va = 0x5120a80000 end_va = 0x5120afffff entry_point = 0x0 region_type = private name = "private_0x0000005120a80000" filename = "" Region: id = 1344 start_va = 0x5120b00000 end_va = 0x5120b03fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120b00000" filename = "" Region: id = 1345 start_va = 0x5120b10000 end_va = 0x5120b10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120b10000" filename = "" Region: id = 1346 start_va = 0x5120b20000 end_va = 0x5120b21fff entry_point = 0x0 region_type = private name = "private_0x0000005120b20000" filename = "" Region: id = 1347 start_va = 0x5120b30000 end_va = 0x5120b30fff entry_point = 0x0 region_type = private name = "private_0x0000005120b30000" filename = "" Region: id = 1348 start_va = 0x5120b40000 end_va = 0x5120b46fff entry_point = 0x0 region_type = private name = "private_0x0000005120b40000" filename = "" Region: id = 1349 start_va = 0x5120b50000 end_va = 0x5120b5ffff entry_point = 0x5120b50000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1350 start_va = 0x5120b60000 end_va = 0x5120b6ffff entry_point = 0x5120b60000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1351 start_va = 0x5120b70000 end_va = 0x5120b7ffff entry_point = 0x5120b70000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1352 start_va = 0x5120b80000 end_va = 0x5120b8ffff entry_point = 0x5120b80000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1353 start_va = 0x5120b90000 end_va = 0x5120b9ffff entry_point = 0x5120b90000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1354 start_va = 0x5120ba0000 end_va = 0x5120baffff entry_point = 0x5120ba0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1355 start_va = 0x5120bb0000 end_va = 0x5120bbffff entry_point = 0x5120bb0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1356 start_va = 0x5120bc0000 end_va = 0x5120bc0fff entry_point = 0x0 region_type = private name = "private_0x0000005120bc0000" filename = "" Region: id = 1357 start_va = 0x5120bd0000 end_va = 0x5120bd0fff entry_point = 0x0 region_type = private name = "private_0x0000005120bd0000" filename = "" Region: id = 1358 start_va = 0x5120be0000 end_va = 0x5120be0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120be0000" filename = "" Region: id = 1359 start_va = 0x5120bf0000 end_va = 0x5120bfffff entry_point = 0x5120bf0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1360 start_va = 0x5120c00000 end_va = 0x5120cfffff entry_point = 0x0 region_type = private name = "private_0x0000005120c00000" filename = "" Region: id = 1361 start_va = 0x5120d00000 end_va = 0x5120dbdfff entry_point = 0x5120d00000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1362 start_va = 0x5120dc0000 end_va = 0x5120e7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120dc0000" filename = "" Region: id = 1363 start_va = 0x5120e80000 end_va = 0x5120e87fff entry_point = 0x5120e80000 region_type = mapped_file name = "staterepository-machine.srd-shm" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd-shm" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd-shm") Region: id = 1364 start_va = 0x5120e90000 end_va = 0x5120e90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120e90000" filename = "" Region: id = 1365 start_va = 0x5120ea0000 end_va = 0x5120ea0fff entry_point = 0x0 region_type = private name = "private_0x0000005120ea0000" filename = "" Region: id = 1366 start_va = 0x5120eb0000 end_va = 0x5120eb0fff entry_point = 0x0 region_type = private name = "private_0x0000005120eb0000" filename = "" Region: id = 1367 start_va = 0x5120ec0000 end_va = 0x5120ecffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120ec0000" filename = "" Region: id = 1368 start_va = 0x5120ed0000 end_va = 0x5120edffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120ed0000" filename = "" Region: id = 1369 start_va = 0x5120ee0000 end_va = 0x5120eeffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120ee0000" filename = "" Region: id = 1370 start_va = 0x5120ef0000 end_va = 0x5120efffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120ef0000" filename = "" Region: id = 1371 start_va = 0x5120f00000 end_va = 0x5120f00fff entry_point = 0x0 region_type = private name = "private_0x0000005120f00000" filename = "" Region: id = 1372 start_va = 0x5120f10000 end_va = 0x5120f10fff entry_point = 0x0 region_type = private name = "private_0x0000005120f10000" filename = "" Region: id = 1373 start_va = 0x5120f20000 end_va = 0x5120f20fff entry_point = 0x0 region_type = private name = "private_0x0000005120f20000" filename = "" Region: id = 1374 start_va = 0x5120f30000 end_va = 0x5120f36fff entry_point = 0x0 region_type = private name = "private_0x0000005120f30000" filename = "" Region: id = 1375 start_va = 0x5120f40000 end_va = 0x5120f4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120f40000" filename = "" Region: id = 1376 start_va = 0x5120f50000 end_va = 0x5120f5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120f50000" filename = "" Region: id = 1377 start_va = 0x5120f60000 end_va = 0x5120f6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120f60000" filename = "" Region: id = 1378 start_va = 0x5120f70000 end_va = 0x5120f7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005120f70000" filename = "" Region: id = 1379 start_va = 0x5120f80000 end_va = 0x5120f83fff entry_point = 0x0 region_type = private name = "private_0x0000005120f80000" filename = "" Region: id = 1380 start_va = 0x5120f90000 end_va = 0x5120f91fff entry_point = 0x0 region_type = private name = "private_0x0000005120f90000" filename = "" Region: id = 1381 start_va = 0x5120fa0000 end_va = 0x5120fa0fff entry_point = 0x0 region_type = private name = "private_0x0000005120fa0000" filename = "" Region: id = 1382 start_va = 0x5120fb0000 end_va = 0x5120fb0fff entry_point = 0x0 region_type = private name = "private_0x0000005120fb0000" filename = "" Region: id = 1383 start_va = 0x5120fc0000 end_va = 0x5120fdffff entry_point = 0x0 region_type = private name = "private_0x0000005120fc0000" filename = "" Region: id = 1384 start_va = 0x5120fe0000 end_va = 0x5120feffff entry_point = 0x5120fe0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1385 start_va = 0x5120ff0000 end_va = 0x5120ffffff entry_point = 0x5120ff0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1386 start_va = 0x5121000000 end_va = 0x51210fffff entry_point = 0x0 region_type = private name = "private_0x0000005121000000" filename = "" Region: id = 1387 start_va = 0x5121100000 end_va = 0x5121287fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005121100000" filename = "" Region: id = 1388 start_va = 0x5121290000 end_va = 0x5121410fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005121290000" filename = "" Region: id = 1389 start_va = 0x5121420000 end_va = 0x512151ffff entry_point = 0x0 region_type = private name = "private_0x0000005121420000" filename = "" Region: id = 1390 start_va = 0x5121520000 end_va = 0x512161ffff entry_point = 0x0 region_type = private name = "private_0x0000005121520000" filename = "" Region: id = 1391 start_va = 0x5121620000 end_va = 0x5121956fff entry_point = 0x5121620000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1392 start_va = 0x5121960000 end_va = 0x5121a5ffff entry_point = 0x0 region_type = private name = "private_0x0000005121960000" filename = "" Region: id = 1393 start_va = 0x5121b60000 end_va = 0x5121c5ffff entry_point = 0x0 region_type = private name = "private_0x0000005121b60000" filename = "" Region: id = 1394 start_va = 0x5121c60000 end_va = 0x5121d5ffff entry_point = 0x0 region_type = private name = "private_0x0000005121c60000" filename = "" Region: id = 1395 start_va = 0x5121d60000 end_va = 0x5122d5ffff entry_point = 0x0 region_type = private name = "private_0x0000005121d60000" filename = "" Region: id = 1396 start_va = 0x5122d60000 end_va = 0x5132d5ffff entry_point = 0x0 region_type = private name = "private_0x0000005122d60000" filename = "" Region: id = 1397 start_va = 0x5132d60000 end_va = 0x5142d5ffff entry_point = 0x0 region_type = private name = "private_0x0000005132d60000" filename = "" Region: id = 1398 start_va = 0x5142d60000 end_va = 0x5142d6ffff entry_point = 0x5142d60000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1399 start_va = 0x5142d70000 end_va = 0x5142d7ffff entry_point = 0x5142d70000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1400 start_va = 0x5142d80000 end_va = 0x5142d8ffff entry_point = 0x5142d80000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1401 start_va = 0x5142d90000 end_va = 0x5142d9ffff entry_point = 0x5142d90000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1402 start_va = 0x5142da0000 end_va = 0x5142daffff entry_point = 0x5142da0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1403 start_va = 0x5142db0000 end_va = 0x5142dbffff entry_point = 0x5142db0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1404 start_va = 0x5142dc0000 end_va = 0x5142dcffff entry_point = 0x5142dc0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1405 start_va = 0x5142dd0000 end_va = 0x5142ddffff entry_point = 0x5142dd0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1406 start_va = 0x5142de0000 end_va = 0x5142deffff entry_point = 0x5142de0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1407 start_va = 0x5142df0000 end_va = 0x5142dfffff entry_point = 0x5142df0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1408 start_va = 0x5142e00000 end_va = 0x5142e0ffff entry_point = 0x5142e00000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1409 start_va = 0x5142e10000 end_va = 0x5142e1ffff entry_point = 0x5142e10000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1410 start_va = 0x5142e20000 end_va = 0x5142e2ffff entry_point = 0x5142e20000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1411 start_va = 0x5142e30000 end_va = 0x5142eaffff entry_point = 0x0 region_type = private name = "private_0x0000005142e30000" filename = "" Region: id = 1412 start_va = 0x5142eb0000 end_va = 0x5142ebffff entry_point = 0x5142eb0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1413 start_va = 0x5142ec0000 end_va = 0x5142ec0fff entry_point = 0x0 region_type = private name = "private_0x0000005142ec0000" filename = "" Region: id = 1414 start_va = 0x5142ed0000 end_va = 0x5142edffff entry_point = 0x5142ed0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1415 start_va = 0x5142ee0000 end_va = 0x5142eeffff entry_point = 0x5142ee0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1416 start_va = 0x5142ef0000 end_va = 0x5142efffff entry_point = 0x5142ef0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1417 start_va = 0x5142f00000 end_va = 0x5142f0ffff entry_point = 0x5142f00000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1418 start_va = 0x5142f10000 end_va = 0x5142f1ffff entry_point = 0x5142f10000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1419 start_va = 0x5142f20000 end_va = 0x5142f2ffff entry_point = 0x5142f20000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1420 start_va = 0x5142f30000 end_va = 0x5142f3ffff entry_point = 0x5142f30000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1421 start_va = 0x5142f40000 end_va = 0x5142f4ffff entry_point = 0x5142f40000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1422 start_va = 0x5142f50000 end_va = 0x5142f5ffff entry_point = 0x5142f50000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1423 start_va = 0x5142f60000 end_va = 0x5142f6ffff entry_point = 0x5142f60000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1424 start_va = 0x5142f70000 end_va = 0x5142f7ffff entry_point = 0x5142f70000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1425 start_va = 0x5142f80000 end_va = 0x5142f8ffff entry_point = 0x5142f80000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1426 start_va = 0x5142f90000 end_va = 0x5142f9ffff entry_point = 0x5142f90000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1427 start_va = 0x5142fa0000 end_va = 0x5142faffff entry_point = 0x5142fa0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1428 start_va = 0x5142fb0000 end_va = 0x5142fbffff entry_point = 0x5142fb0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1429 start_va = 0x5142fc0000 end_va = 0x5142fcffff entry_point = 0x5142fc0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1430 start_va = 0x5142fd0000 end_va = 0x5142fdffff entry_point = 0x5142fd0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1431 start_va = 0x5142fe0000 end_va = 0x5142feffff entry_point = 0x5142fe0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1432 start_va = 0x5142ff0000 end_va = 0x5142ffffff entry_point = 0x5142ff0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1433 start_va = 0x5143000000 end_va = 0x514300ffff entry_point = 0x5143000000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1434 start_va = 0x5143010000 end_va = 0x514301ffff entry_point = 0x5143010000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1435 start_va = 0x5143020000 end_va = 0x514302ffff entry_point = 0x5143020000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1436 start_va = 0x5143030000 end_va = 0x514303ffff entry_point = 0x5143030000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1437 start_va = 0x5143040000 end_va = 0x514304ffff entry_point = 0x5143040000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1438 start_va = 0x5143050000 end_va = 0x514305ffff entry_point = 0x5143050000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1439 start_va = 0x5143060000 end_va = 0x514306ffff entry_point = 0x5143060000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1440 start_va = 0x5143070000 end_va = 0x514307ffff entry_point = 0x5143070000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1441 start_va = 0x5143080000 end_va = 0x51430a9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005143080000" filename = "" Region: id = 1442 start_va = 0x51430b0000 end_va = 0x51430bffff entry_point = 0x51430b0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1443 start_va = 0x51430c0000 end_va = 0x51430cffff entry_point = 0x51430c0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1444 start_va = 0x51430d0000 end_va = 0x51430dffff entry_point = 0x51430d0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1445 start_va = 0x51430e0000 end_va = 0x51430effff entry_point = 0x51430e0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1446 start_va = 0x51430f0000 end_va = 0x51430fffff entry_point = 0x51430f0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1447 start_va = 0x5143100000 end_va = 0x514310ffff entry_point = 0x5143100000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1448 start_va = 0x5143210000 end_va = 0x514321ffff entry_point = 0x5143210000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1449 start_va = 0x5143220000 end_va = 0x514322ffff entry_point = 0x5143220000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1450 start_va = 0x5143230000 end_va = 0x514323ffff entry_point = 0x5143230000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1451 start_va = 0x5143240000 end_va = 0x514324ffff entry_point = 0x5143240000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1452 start_va = 0x5143250000 end_va = 0x514325ffff entry_point = 0x5143250000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1453 start_va = 0x5143260000 end_va = 0x514326ffff entry_point = 0x5143260000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1454 start_va = 0x5143270000 end_va = 0x514327ffff entry_point = 0x5143270000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1455 start_va = 0x5143280000 end_va = 0x514328ffff entry_point = 0x5143280000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1456 start_va = 0x5143290000 end_va = 0x514329ffff entry_point = 0x5143290000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1457 start_va = 0x51432a0000 end_va = 0x51432affff entry_point = 0x51432a0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1458 start_va = 0x51432b0000 end_va = 0x51432bffff entry_point = 0x51432b0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1459 start_va = 0x51432c0000 end_va = 0x51432cffff entry_point = 0x51432c0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1460 start_va = 0x51432d0000 end_va = 0x51432dffff entry_point = 0x51432d0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1461 start_va = 0x51432e0000 end_va = 0x51432effff entry_point = 0x51432e0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1462 start_va = 0x51432f0000 end_va = 0x51432f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051432f0000" filename = "" Region: id = 1463 start_va = 0x5143300000 end_va = 0x51433fffff entry_point = 0x0 region_type = private name = "private_0x0000005143300000" filename = "" Region: id = 1464 start_va = 0x5143400000 end_va = 0x514340ffff entry_point = 0x5143400000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1465 start_va = 0x5143410000 end_va = 0x514341ffff entry_point = 0x5143410000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1466 start_va = 0x5143420000 end_va = 0x514342ffff entry_point = 0x5143420000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1467 start_va = 0x5143430000 end_va = 0x514352ffff entry_point = 0x0 region_type = private name = "private_0x0000005143430000" filename = "" Region: id = 1468 start_va = 0x5143530000 end_va = 0x514353ffff entry_point = 0x5143530000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1469 start_va = 0x5143540000 end_va = 0x514354ffff entry_point = 0x5143540000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1470 start_va = 0x5143550000 end_va = 0x514355ffff entry_point = 0x5143550000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1471 start_va = 0x5143560000 end_va = 0x514356ffff entry_point = 0x5143560000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1472 start_va = 0x5143570000 end_va = 0x514357ffff entry_point = 0x5143570000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1473 start_va = 0x5143580000 end_va = 0x514358ffff entry_point = 0x5143580000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1474 start_va = 0x5143590000 end_va = 0x514359ffff entry_point = 0x5143590000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1475 start_va = 0x51435a0000 end_va = 0x51435affff entry_point = 0x51435a0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1476 start_va = 0x51435b0000 end_va = 0x51435bffff entry_point = 0x51435b0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1477 start_va = 0x51435c0000 end_va = 0x51435cffff entry_point = 0x51435c0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1478 start_va = 0x51435d0000 end_va = 0x51435dffff entry_point = 0x51435d0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1479 start_va = 0x51435e0000 end_va = 0x51435effff entry_point = 0x51435e0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1480 start_va = 0x51435f0000 end_va = 0x51435fffff entry_point = 0x51435f0000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1481 start_va = 0x5143600000 end_va = 0x514360ffff entry_point = 0x5143600000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1482 start_va = 0x5143610000 end_va = 0x514361ffff entry_point = 0x5143610000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1483 start_va = 0x5143620000 end_va = 0x5143620fff entry_point = 0x0 region_type = private name = "private_0x0000005143620000" filename = "" Region: id = 1484 start_va = 0x5143630000 end_va = 0x5143630fff entry_point = 0x0 region_type = private name = "private_0x0000005143630000" filename = "" Region: id = 1485 start_va = 0x5143640000 end_va = 0x5143640fff entry_point = 0x0 region_type = private name = "private_0x0000005143640000" filename = "" Region: id = 1486 start_va = 0x5143650000 end_va = 0x5143650fff entry_point = 0x0 region_type = private name = "private_0x0000005143650000" filename = "" Region: id = 1487 start_va = 0x5143660000 end_va = 0x514366ffff entry_point = 0x5143660000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1488 start_va = 0x5143670000 end_va = 0x5143670fff entry_point = 0x0 region_type = private name = "private_0x0000005143670000" filename = "" Region: id = 1489 start_va = 0x5143680000 end_va = 0x514368ffff entry_point = 0x5143680000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1490 start_va = 0x5143690000 end_va = 0x514369ffff entry_point = 0x5143690000 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 1491 start_va = 0x7df5ff480000 end_va = 0x7ff5ff47ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff480000" filename = "" Region: id = 1492 start_va = 0x7ff6733d8000 end_va = 0x7ff6733d9fff entry_point = 0x0 region_type = private name = "private_0x00007ff6733d8000" filename = "" Region: id = 1493 start_va = 0x7ff6733dc000 end_va = 0x7ff6733ddfff entry_point = 0x0 region_type = private name = "private_0x00007ff6733dc000" filename = "" Region: id = 1494 start_va = 0x7ff6733de000 end_va = 0x7ff6733dffff entry_point = 0x0 region_type = private name = "private_0x00007ff6733de000" filename = "" Region: id = 1495 start_va = 0x7ff6733e0000 end_va = 0x7ff6734dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6733e0000" filename = "" Region: id = 1496 start_va = 0x7ff6734e0000 end_va = 0x7ff673502fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6734e0000" filename = "" Region: id = 1497 start_va = 0x7ff673503000 end_va = 0x7ff673504fff entry_point = 0x0 region_type = private name = "private_0x00007ff673503000" filename = "" Region: id = 1498 start_va = 0x7ff673509000 end_va = 0x7ff67350afff entry_point = 0x0 region_type = private name = "private_0x00007ff673509000" filename = "" Region: id = 1499 start_va = 0x7ff67350b000 end_va = 0x7ff67350bfff entry_point = 0x0 region_type = private name = "private_0x00007ff67350b000" filename = "" Region: id = 1500 start_va = 0x7ff67350c000 end_va = 0x7ff67350dfff entry_point = 0x0 region_type = private name = "private_0x00007ff67350c000" filename = "" Region: id = 1501 start_va = 0x7ff67350e000 end_va = 0x7ff67350ffff entry_point = 0x0 region_type = private name = "private_0x00007ff67350e000" filename = "" Region: id = 1502 start_va = 0x7ff673b40000 end_va = 0x7ff673b4cfff entry_point = 0x7ff673b40000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1503 start_va = 0x7ff8dc6e0000 end_va = 0x7ff8dc778fff entry_point = 0x7ff8dc6e0000 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 1504 start_va = 0x7ff8dc780000 end_va = 0x7ff8dca11fff entry_point = 0x7ff8dc780000 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 1505 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1506 start_va = 0x7ff8e0a60000 end_va = 0x7ff8e0bf6fff entry_point = 0x7ff8e0a60000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 1507 start_va = 0x7ff8e0c00000 end_va = 0x7ff8e0c80fff entry_point = 0x7ff8e0c00000 region_type = mapped_file name = "tileobjserver.dll" filename = "\\Windows\\System32\\tileobjserver.dll" (normalized: "c:\\windows\\system32\\tileobjserver.dll") Region: id = 1508 start_va = 0x7ff8e1940000 end_va = 0x7ff8e1c21fff entry_point = 0x7ff8e1940000 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 1509 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1510 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 1511 start_va = 0x7ff8e8ad0000 end_va = 0x7ff8e8ae2fff entry_point = 0x7ff8e8ad0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1512 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 1513 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1514 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1515 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1516 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1517 start_va = 0x7ff8ea820000 end_va = 0x7ff8ea877fff entry_point = 0x7ff8ea820000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1518 start_va = 0x7ff8ea9d0000 end_va = 0x7ff8ea9fbfff entry_point = 0x7ff8ea9d0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1519 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1520 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1521 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1522 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1523 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1524 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1525 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1526 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1527 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1528 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1529 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1530 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1531 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1532 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1533 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1534 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1535 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1536 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1537 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1538 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 114 os_tid = 0xac0 Thread: id = 115 os_tid = 0x9f8 Thread: id = 116 os_tid = 0x97c Thread: id = 117 os_tid = 0x978 Thread: id = 118 os_tid = 0x6cc Thread: id = 119 os_tid = 0x604 Thread: id = 120 os_tid = 0xc48 Thread: id = 142 os_tid = 0x920 Thread: id = 143 os_tid = 0x564 Thread: id = 267 os_tid = 0x958 Thread: id = 315 os_tid = 0xec4 Process: id = "9" image_name = "openwith.exe" filename = "c:\\windows\\system32\\openwith.exe" page_root = "0x2828a000" os_pid = "0x4d8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xdd4" cmd_line = "C:\\Windows\\system32\\OpenWith.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1539 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1540 start_va = 0x1ebc9a0000 end_va = 0x1ebc9affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebc9a0000" filename = "" Region: id = 1541 start_va = 0x1ebc9b0000 end_va = 0x1ebc9b6fff entry_point = 0x0 region_type = private name = "private_0x0000001ebc9b0000" filename = "" Region: id = 1542 start_va = 0x1ebc9c0000 end_va = 0x1ebc9d3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebc9c0000" filename = "" Region: id = 1543 start_va = 0x1ebc9e0000 end_va = 0x1ebca5ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebc9e0000" filename = "" Region: id = 1544 start_va = 0x1ebca60000 end_va = 0x1ebca63fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebca60000" filename = "" Region: id = 1545 start_va = 0x1ebca70000 end_va = 0x1ebca72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebca70000" filename = "" Region: id = 1546 start_va = 0x1ebca80000 end_va = 0x1ebca81fff entry_point = 0x0 region_type = private name = "private_0x0000001ebca80000" filename = "" Region: id = 1547 start_va = 0x1ebca90000 end_va = 0x1ebcb0ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebca90000" filename = "" Region: id = 1548 start_va = 0x1ebcb10000 end_va = 0x1ebcb16fff entry_point = 0x0 region_type = private name = "private_0x0000001ebcb10000" filename = "" Region: id = 1549 start_va = 0x1ebcb20000 end_va = 0x1ebcb20fff entry_point = 0x1ebcb20000 region_type = mapped_file name = "openwith.exe.mui" filename = "\\Windows\\System32\\en-US\\OpenWith.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\openwith.exe.mui") Region: id = 1550 start_va = 0x1ebcb30000 end_va = 0x1ebcb30fff entry_point = 0x0 region_type = private name = "private_0x0000001ebcb30000" filename = "" Region: id = 1551 start_va = 0x1ebcb40000 end_va = 0x1ebcc3ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebcb40000" filename = "" Region: id = 1552 start_va = 0x1ebcc40000 end_va = 0x1ebccfdfff entry_point = 0x1ebcc40000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1553 start_va = 0x1ebcd00000 end_va = 0x1ebce87fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebcd00000" filename = "" Region: id = 1554 start_va = 0x1ebce90000 end_va = 0x1ebd010fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebce90000" filename = "" Region: id = 1555 start_va = 0x1ebd020000 end_va = 0x1ebd020fff entry_point = 0x0 region_type = private name = "private_0x0000001ebd020000" filename = "" Region: id = 1556 start_va = 0x1ebd030000 end_va = 0x1ebd030fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebd030000" filename = "" Region: id = 1557 start_va = 0x1ebd040000 end_va = 0x1ebd041fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebd040000" filename = "" Region: id = 1558 start_va = 0x1ebd080000 end_va = 0x1ebd08ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebd080000" filename = "" Region: id = 1559 start_va = 0x1ebd090000 end_va = 0x1ebe48ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebd090000" filename = "" Region: id = 1560 start_va = 0x1ebe490000 end_va = 0x1ebe50ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebe490000" filename = "" Region: id = 1561 start_va = 0x1ebe510000 end_va = 0x1ebe58ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebe510000" filename = "" Region: id = 1562 start_va = 0x1ebe590000 end_va = 0x1ebe60ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebe590000" filename = "" Region: id = 1563 start_va = 0x1ebe640000 end_va = 0x1ebe64ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebe640000" filename = "" Region: id = 1564 start_va = 0x1ebe650000 end_va = 0x1ebe986fff entry_point = 0x1ebe650000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1565 start_va = 0x1ebe990000 end_va = 0x1ebea0ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebe990000" filename = "" Region: id = 1566 start_va = 0x7df5ff2d0000 end_va = 0x7ff5ff2cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff2d0000" filename = "" Region: id = 1567 start_va = 0x7ff7bd0f0000 end_va = 0x7ff7bd1effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bd0f0000" filename = "" Region: id = 1568 start_va = 0x7ff7bd1f0000 end_va = 0x7ff7bd212fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bd1f0000" filename = "" Region: id = 1569 start_va = 0x7ff7bd213000 end_va = 0x7ff7bd214fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd213000" filename = "" Region: id = 1570 start_va = 0x7ff7bd215000 end_va = 0x7ff7bd216fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd215000" filename = "" Region: id = 1571 start_va = 0x7ff7bd217000 end_va = 0x7ff7bd218fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd217000" filename = "" Region: id = 1572 start_va = 0x7ff7bd219000 end_va = 0x7ff7bd219fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd219000" filename = "" Region: id = 1573 start_va = 0x7ff7bd21a000 end_va = 0x7ff7bd21bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd21a000" filename = "" Region: id = 1574 start_va = 0x7ff7bd21c000 end_va = 0x7ff7bd21dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd21c000" filename = "" Region: id = 1575 start_va = 0x7ff7bd21e000 end_va = 0x7ff7bd21ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd21e000" filename = "" Region: id = 1576 start_va = 0x7ff7bd650000 end_va = 0x7ff7bd669fff entry_point = 0x7ff7bd650000 region_type = mapped_file name = "openwith.exe" filename = "\\Windows\\System32\\OpenWith.exe" (normalized: "c:\\windows\\system32\\openwith.exe") Region: id = 1577 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1578 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 1579 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1580 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1581 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1582 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1583 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1584 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1585 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1586 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1587 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1588 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1589 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1590 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1591 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1592 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1593 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1594 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1595 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1596 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1597 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1598 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1599 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1600 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1601 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1602 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1603 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1604 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1605 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1606 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1610 start_va = 0x1ebd050000 end_va = 0x1ebd050fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebd050000" filename = "" Region: id = 1611 start_va = 0x1ebd060000 end_va = 0x1ebd060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebd060000" filename = "" Region: id = 1612 start_va = 0x7ff8ddbd0000 end_va = 0x7ff8de6dcfff entry_point = 0x7ff8ddbd0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 1613 start_va = 0x7ff8e9860000 end_va = 0x7ff8e994dfff entry_point = 0x7ff8e9860000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1614 start_va = 0x7ff8e3a70000 end_va = 0x7ff8e3c26fff entry_point = 0x7ff8e3a70000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 1615 start_va = 0x1ebd070000 end_va = 0x1ebd072fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebd070000" filename = "" Region: id = 1616 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1617 start_va = 0x7ff8e7430000 end_va = 0x7ff8e7560fff entry_point = 0x7ff8e7430000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1618 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2609 start_va = 0x1ebe610000 end_va = 0x1ebe639fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebe610000" filename = "" Region: id = 2610 start_va = 0x1ebea10000 end_va = 0x1ebea10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebea10000" filename = "" Region: id = 2611 start_va = 0x1ebea20000 end_va = 0x1ebea21fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebea20000" filename = "" Region: id = 2612 start_va = 0x1ebea30000 end_va = 0x1ebeaaffff entry_point = 0x0 region_type = private name = "private_0x0000001ebea30000" filename = "" Region: id = 2613 start_va = 0x1ebeab0000 end_va = 0x1ebeb2ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebeab0000" filename = "" Region: id = 2614 start_va = 0x1ebeb30000 end_va = 0x1ebeb31fff entry_point = 0x1ebeb30000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 2615 start_va = 0x1ebeb40000 end_va = 0x1ebeb43fff entry_point = 0x1ebeb40000 region_type = mapped_file name = "windows.ui.immersive.dll.mui" filename = "\\Windows\\System32\\en-US\\Windows.UI.Immersive.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.ui.immersive.dll.mui") Region: id = 2616 start_va = 0x1ebeb50000 end_va = 0x1ebebcffff entry_point = 0x0 region_type = private name = "private_0x0000001ebeb50000" filename = "" Region: id = 2617 start_va = 0x1ebebd0000 end_va = 0x1ebeccffff entry_point = 0x0 region_type = private name = "private_0x0000001ebebd0000" filename = "" Region: id = 2618 start_va = 0x1ebecd0000 end_va = 0x1ebecd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebecd0000" filename = "" Region: id = 2619 start_va = 0x1ebece0000 end_va = 0x1ebece0fff entry_point = 0x0 region_type = private name = "private_0x0000001ebece0000" filename = "" Region: id = 2620 start_va = 0x1ebecf0000 end_va = 0x1ebecf0fff entry_point = 0x0 region_type = private name = "private_0x0000001ebecf0000" filename = "" Region: id = 2621 start_va = 0x1ebed00000 end_va = 0x1ebed7ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebed00000" filename = "" Region: id = 2622 start_va = 0x1ebed80000 end_va = 0x1ebed80fff entry_point = 0x0 region_type = private name = "private_0x0000001ebed80000" filename = "" Region: id = 2623 start_va = 0x1ebed90000 end_va = 0x1ebed90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebed90000" filename = "" Region: id = 2624 start_va = 0x1ebeda0000 end_va = 0x1ebedb3fff entry_point = 0x1ebeda0000 region_type = mapped_file name = "twinui.dll.mui" filename = "\\Windows\\System32\\en-US\\twinui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\twinui.dll.mui") Region: id = 2625 start_va = 0x1ebedc0000 end_va = 0x1ebedc1fff entry_point = 0x1ebedc0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 2626 start_va = 0x1ebedd0000 end_va = 0x1ebedd4fff entry_point = 0x1ebedd0000 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 2627 start_va = 0x1ebede0000 end_va = 0x1ebeedffff entry_point = 0x0 region_type = private name = "private_0x0000001ebede0000" filename = "" Region: id = 2628 start_va = 0x1ebeee0000 end_va = 0x1ebeee3fff entry_point = 0x1ebeee0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 2629 start_va = 0x1ebeef0000 end_va = 0x1ebef02fff entry_point = 0x1ebeef0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 2630 start_va = 0x1ebef10000 end_va = 0x1ebef10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebef10000" filename = "" Region: id = 2631 start_va = 0x1ebef20000 end_va = 0x1ebef9ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebef20000" filename = "" Region: id = 2632 start_va = 0x1ebefa0000 end_va = 0x1ebefbbfff entry_point = 0x1ebefa0000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db") Region: id = 2633 start_va = 0x1ebefc0000 end_va = 0x1ebf03ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebefc0000" filename = "" Region: id = 2634 start_va = 0x1ebf040000 end_va = 0x1ebf043fff entry_point = 0x1ebf040000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2635 start_va = 0x1ebf050000 end_va = 0x1ebf092fff entry_point = 0x1ebf050000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db") Region: id = 2636 start_va = 0x1ebf0a0000 end_va = 0x1ebf0a3fff entry_point = 0x1ebf0a0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2637 start_va = 0x1ebf0b0000 end_va = 0x1ebf13afff entry_point = 0x1ebf0b0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 2638 start_va = 0x1ebf140000 end_va = 0x1ebf23ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebf140000" filename = "" Region: id = 2639 start_va = 0x1ebf240000 end_va = 0x1ebf242fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebf240000" filename = "" Region: id = 2640 start_va = 0x1ebf250000 end_va = 0x1ebf250fff entry_point = 0x0 region_type = private name = "private_0x0000001ebf250000" filename = "" Region: id = 2641 start_va = 0x1ebf260000 end_va = 0x1ebf263fff entry_point = 0x1ebf260000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 2642 start_va = 0x1ebf270000 end_va = 0x1ebf271fff entry_point = 0x1ebf270000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 2643 start_va = 0x1ebf280000 end_va = 0x1ebf288fff entry_point = 0x0 region_type = private name = "private_0x0000001ebf280000" filename = "" Region: id = 2644 start_va = 0x1ebf290000 end_va = 0x1ebf290fff entry_point = 0x0 region_type = private name = "private_0x0000001ebf290000" filename = "" Region: id = 2645 start_va = 0x1ebf2a0000 end_va = 0x1ebf2c3fff entry_point = 0x0 region_type = private name = "private_0x0000001ebf2a0000" filename = "" Region: id = 2646 start_va = 0x1ebf2d0000 end_va = 0x1ebf2d8fff entry_point = 0x0 region_type = private name = "private_0x0000001ebf2d0000" filename = "" Region: id = 2647 start_va = 0x1ebf2e0000 end_va = 0x1ebf3dffff entry_point = 0x0 region_type = private name = "private_0x0000001ebf2e0000" filename = "" Region: id = 2648 start_va = 0x1ebf3e0000 end_va = 0x1ebf3e3fff entry_point = 0x1ebf3e0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2649 start_va = 0x1ebf3f0000 end_va = 0x1ebf3f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebf3f0000" filename = "" Region: id = 2650 start_va = 0x1ebf400000 end_va = 0x1ebf401fff entry_point = 0x1ebf400000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 2651 start_va = 0x1ebf410000 end_va = 0x1ebf50ffff entry_point = 0x1ebf410000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 2652 start_va = 0x1ebf510000 end_va = 0x1ebf557fff entry_point = 0x0 region_type = private name = "private_0x0000001ebf510000" filename = "" Region: id = 2653 start_va = 0x1ebf560000 end_va = 0x1ebf570fff entry_point = 0x1ebf560000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 2654 start_va = 0x1ebf580000 end_va = 0x1ebf67ffff entry_point = 0x1ebf580000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 2655 start_va = 0x1ebf680000 end_va = 0x1ebf680fff entry_point = 0x0 region_type = private name = "private_0x0000001ebf680000" filename = "" Region: id = 2656 start_va = 0x1ebf690000 end_va = 0x1ebf690fff entry_point = 0x0 region_type = private name = "private_0x0000001ebf690000" filename = "" Region: id = 2657 start_va = 0x1ebf6a0000 end_va = 0x1ebf6a0fff entry_point = 0x0 region_type = private name = "private_0x0000001ebf6a0000" filename = "" Region: id = 2658 start_va = 0x1ebf6c0000 end_va = 0x1ebf6c0fff entry_point = 0x0 region_type = private name = "private_0x0000001ebf6c0000" filename = "" Region: id = 2659 start_va = 0x1ebf6d0000 end_va = 0x1ebf74ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebf6d0000" filename = "" Region: id = 2660 start_va = 0x7ff7bd0e2000 end_va = 0x7ff7bd0e3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd0e2000" filename = "" Region: id = 2661 start_va = 0x7ff7bd0e4000 end_va = 0x7ff7bd0e5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd0e4000" filename = "" Region: id = 2662 start_va = 0x7ff7bd0e6000 end_va = 0x7ff7bd0e7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd0e6000" filename = "" Region: id = 2663 start_va = 0x7ff7bd0e8000 end_va = 0x7ff7bd0e9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd0e8000" filename = "" Region: id = 2664 start_va = 0x7ff7bd0ea000 end_va = 0x7ff7bd0ebfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd0ea000" filename = "" Region: id = 2665 start_va = 0x7ff7bd0ec000 end_va = 0x7ff7bd0edfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd0ec000" filename = "" Region: id = 2666 start_va = 0x7ff7bd0ee000 end_va = 0x7ff7bd0effff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd0ee000" filename = "" Region: id = 2667 start_va = 0x7ff8d1180000 end_va = 0x7ff8d132ffff entry_point = 0x7ff8d1180000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 2668 start_va = 0x7ff8d1330000 end_va = 0x7ff8d147bfff entry_point = 0x7ff8d1330000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 2669 start_va = 0x7ff8d76a0000 end_va = 0x7ff8d7738fff entry_point = 0x7ff8d76a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 2670 start_va = 0x7ff8dc6e0000 end_va = 0x7ff8dc778fff entry_point = 0x7ff8dc6e0000 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 2671 start_va = 0x7ff8dc780000 end_va = 0x7ff8dca11fff entry_point = 0x7ff8dc780000 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 2672 start_va = 0x7ff8dcfd0000 end_va = 0x7ff8dd018fff entry_point = 0x7ff8dcfd0000 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 2673 start_va = 0x7ff8dd900000 end_va = 0x7ff8dd94afff entry_point = 0x7ff8dd900000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 2674 start_va = 0x7ff8debc0000 end_va = 0x7ff8dec28fff entry_point = 0x7ff8debc0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 2675 start_va = 0x7ff8e37f0000 end_va = 0x7ff8e3a48fff entry_point = 0x7ff8e37f0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 2676 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2677 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 2678 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 2679 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2680 start_va = 0x7ff8e8650000 end_va = 0x7ff8e869afff entry_point = 0x7ff8e8650000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 2681 start_va = 0x7ff8e86a0000 end_va = 0x7ff8e8851fff entry_point = 0x7ff8e86a0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 2682 start_va = 0x7ff8e8860000 end_va = 0x7ff8e8acdfff entry_point = 0x7ff8e8860000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 2683 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 2684 start_va = 0x7ff8e8c60000 end_va = 0x7ff8e8cfbfff entry_point = 0x7ff8e8c60000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2685 start_va = 0x7ff8e8d00000 end_va = 0x7ff8e8fa2fff entry_point = 0x7ff8e8d00000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 2686 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 2687 start_va = 0x7ff8e9130000 end_va = 0x7ff8e9200fff entry_point = 0x7ff8e9130000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 2688 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 2689 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2923 start_va = 0x1ebf6c0000 end_va = 0x1ebf6c7fff entry_point = 0x0 region_type = private name = "private_0x0000001ebf6c0000" filename = "" Region: id = 2924 start_va = 0x1ebf750000 end_va = 0x1ebf94ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebf750000" filename = "" Region: id = 2925 start_va = 0x1ebf960000 end_va = 0x1ebf960fff entry_point = 0x0 region_type = private name = "private_0x0000001ebf960000" filename = "" Region: id = 2926 start_va = 0x1ebf970000 end_va = 0x1ebf97ffff entry_point = 0x0 region_type = private name = "private_0x0000001ebf970000" filename = "" Region: id = 2927 start_va = 0x1ebfa10000 end_va = 0x1ebfa8bfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ebfa10000" filename = "" Region: id = 2928 start_va = 0x1ebfb30000 end_va = 0x1ebfba5fff entry_point = 0x1ebfb30000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 2929 start_va = 0x1ebfbb0000 end_va = 0x1ec0baffff entry_point = 0x1ebfbb0000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 2930 start_va = 0x1ec0bb0000 end_va = 0x1ec13affff entry_point = 0x1ec0bb0000 region_type = mapped_file name = "~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1462094071-1423818996-289466292-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat") Region: id = 2931 start_va = 0x1ec13b0000 end_va = 0x1ec148efff entry_point = 0x1ec13b0000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 2932 start_va = 0x1ec1490000 end_va = 0x1ec1572fff entry_point = 0x1ec1490000 region_type = mapped_file name = "seguisb.ttf" filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf") Region: id = 2933 start_va = 0x1ec1580000 end_va = 0x1ec1642fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ec1580000" filename = "" Region: id = 2934 start_va = 0x1ec1650000 end_va = 0x1ec16cbfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ec1650000" filename = "" Region: id = 2935 start_va = 0x1ec17a0000 end_va = 0x1ec1862fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ec17a0000" filename = "" Region: id = 2936 start_va = 0x1ec1870000 end_va = 0x1ec1873fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001ec1870000" filename = "" Region: id = 2937 start_va = 0x7ff8e3070000 end_va = 0x7ff8e30f8fff entry_point = 0x7ff8e3070000 region_type = mapped_file name = "directmanipulation.dll" filename = "\\Windows\\System32\\directmanipulation.dll" (normalized: "c:\\windows\\system32\\directmanipulation.dll") Region: id = 2938 start_va = 0x7ff8eac70000 end_va = 0x7ff8ead07fff entry_point = 0x7ff8eac70000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Thread: id = 122 os_tid = 0xc28 Thread: id = 123 os_tid = 0xc38 Thread: id = 124 os_tid = 0xc34 Thread: id = 125 os_tid = 0xc2c Thread: id = 126 os_tid = 0xc24 Thread: id = 127 os_tid = 0xa2c [0081.069] TranslateMessage (lpMsg=0x1ebca5fc88) returned 0 [0081.069] DispatchMessageW (lpMsg=0x1ebca5fc88) returned 0x1 [0081.074] GetMessageW (in: lpMsg=0x1ebca5fc88, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebca5fc88) returned 1 [0081.220] TranslateMessage (lpMsg=0x1ebca5fc88) returned 0 [0081.220] DispatchMessageW (lpMsg=0x1ebca5fc88) returned 0x1 [0082.042] IUnknown_Set (in: ppunk=0x1ebd085f60*=0x0, punk=0x1ebcb77b18 | out: ppunk=0x1ebd085f60*=0x1ebcb77b18) [0082.042] GetMessageW (in: lpMsg=0x1ebca5fc88, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebca5fc88) returned 1 [0082.096] TranslateMessage (lpMsg=0x1ebca5fc88) returned 0 [0082.096] DispatchMessageW (lpMsg=0x1ebca5fc88) returned 0x1 [0082.096] GetMessageW (in: lpMsg=0x1ebca5fc88, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebca5fc88) returned 1 [0082.124] TranslateMessage (lpMsg=0x1ebca5fc88) returned 0 [0082.124] DispatchMessageW (lpMsg=0x1ebca5fc88) returned 0x1 [0082.124] Str_SetPtrW (in: ppsz=0x1ebd085fa8*=0x0, psz="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: ppsz=0x1ebd085fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0082.124] GetMessageW (in: lpMsg=0x1ebca5fc88, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebca5fc88) returned 1 [0082.137] TranslateMessage (lpMsg=0x1ebca5fc88) returned 0 [0082.137] DispatchMessageW (lpMsg=0x1ebca5fc88) returned 0x1 [0082.138] GetMessageW (in: lpMsg=0x1ebca5fc88, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebca5fc88) returned 1 [0082.153] TranslateMessage (lpMsg=0x1ebca5fc88) returned 0 [0082.153] DispatchMessageW (lpMsg=0x1ebca5fc88) returned 0x1 [0082.154] GetMessageW (in: lpMsg=0x1ebca5fc88, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebca5fc88) returned 1 [0082.201] TranslateMessage (lpMsg=0x1ebca5fc88) returned 0 [0082.201] DispatchMessageW (lpMsg=0x1ebca5fc88) returned 0x1 [0082.210] IUnknown_Set (in: ppunk=0x1ebd085fc0*=0x0, punk=0x1ebcb71028 | out: ppunk=0x1ebd085fc0*=0x1ebcb71028) [0082.210] GetMessageW (in: lpMsg=0x1ebca5fc88, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebca5fc88) returned 1 [0082.228] TranslateMessage (lpMsg=0x1ebca5fc88) returned 0 [0082.228] DispatchMessageW (lpMsg=0x1ebca5fc88) returned 0x1 [0082.228] GetMessageW (in: lpMsg=0x1ebca5fc88, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebca5fc88) returned 1 [0082.240] TranslateMessage (lpMsg=0x1ebca5fc88) returned 0 [0082.240] DispatchMessageW (lpMsg=0x1ebca5fc88) returned 0x1 [0082.241] GetMessageW (in: lpMsg=0x1ebca5fc88, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebca5fc88) returned 1 [0082.292] TranslateMessage (lpMsg=0x1ebca5fc88) returned 0 [0082.292] DispatchMessageW (lpMsg=0x1ebca5fc88) returned 0x1 [0082.293] CoTaskMemAlloc (cb=0xa) returned 0x1ebcb5da30 [0082.312] GetMessageW (in: lpMsg=0x1ebca5fc88, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebca5fc88) returned 1 [0082.315] TranslateMessage (lpMsg=0x1ebca5fc88) returned 0 [0082.315] DispatchMessageW (lpMsg=0x1ebca5fc88) returned 0x1 [0082.316] GetMessageW (in: lpMsg=0x1ebca5fc88, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebca5fc88) returned 1 [0082.317] TranslateMessage (lpMsg=0x1ebca5fc88) returned 0 [0082.317] DispatchMessageW (lpMsg=0x1ebca5fc88) returned 0x1 [0082.318] GetMessageW (in: lpMsg=0x1ebca5fc88, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebca5fc88) returned 1 [0082.318] TranslateMessage (lpMsg=0x1ebca5fc88) returned 0 [0082.318] DispatchMessageW (lpMsg=0x1ebca5fc88) returned 0x1 [0082.318] KillTimer (hWnd=0x0, uIDEvent=0x7f89) returned 1 [0082.318] CompareStringOrdinal (lpString1="InvokeDefaultVerbInOtherProcess", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 1 [0082.318] CoCreateInstance (in: rclsid=0x7ff7bd6575b0*(Data1=0x94b23d4d, Data2=0x1040, Data3=0x4c4b, Data4=([0]=0x90, [1]=0x81, [2]=0x85, [3]=0xd8, [4]=0xd6, [5]=0xfa, [6]=0x36, [7]=0xc4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7bd657a50*(Data1=0xce149b23, Data2=0x5941, Data3=0x4079, Data4=([0]=0x92, [1]=0x23, [2]=0x52, [3]=0xc0, [4]=0xa9, [5]=0x91, [6]=0xec, [7]=0x48)), ppv=0x1ebd085fe0 | out: ppv=0x1ebd085fe0*=0x1ebd089620) returned 0x0 [0082.344] IUnknown_SetSite (punk=0x1ebd089620, punkSite=0x1ebd085f40) returned 0x0 [0082.344] IUnknown:QueryInterface (This=0x1ebd085f40, riid=0x7ff8ee00d438*(Data1=0x114, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1ebca5e5d0) [0082.344] IUnknown:QueryInterface (This=0x1ebd085f40, riid=0x7ff8ee00d468*(Data1=0x79eac9ed, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x1ebca5e5c0) [0082.344] IUnknown:QueryInterface (This=0x1ebd085f40, riid=0x7ff8ee00d458*(Data1=0x214e3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1ebca5e5c8) [0082.344] IUnknown:QueryInterface (This=0x1ebd085f40, riid=0x7ff8ee00d448*(Data1=0x45d64a29, Data2=0xa63e, Data3=0x4cb6, Data4=([0]=0xb4, [1]=0x98, [2]=0x57, [3]=0x81, [4]=0xd2, [5]=0x98, [6]=0xcb, [7]=0x4f)), ppvObject=0x1ebca5e5d8) [0082.345] IUnknown:QueryInterface (This=0x1ebd085f40, riid=0x7ff8eb8347d8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1ebca5e600) [0082.345] IUnknown:QueryInterface (in: This=0x1ebcb77b18, riid=0x7ff8de1e0bd8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1ebca5e630 | out: ppvObject=0x1ebca5e630*=0x1ebcb77b18) returned 0x0 [0082.359] IUnknown:QueryInterface (This=0x1ebd085f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1ebca5e630) [0082.359] IUnknown:AddRef (This=0x1ebd085f40) returned 0xe [0082.359] IUnknown_QueryService (in: punk=0x1ebcb77b18, guidService=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), riid=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), ppvOut=0x1ebd0896e0 | out: ppvOut=0x1ebd0896e0*=0x0) returned 0x80004001 [0082.362] IUnknown:Release (This=0x1ebd085f40) returned 0xd [0082.362] IUnknown:QueryInterface (This=0x1ebd085f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1ebca5e630) [0082.362] IUnknown:AddRef (This=0x1ebd085f40) returned 0xe [0082.362] IUnknown_QueryService (in: punk=0x1ebcb77b18, guidService=0x7ff8de1c0980*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), riid=0x7ff8de1c0a40*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), ppvOut=0x1ebd0896e8 | out: ppvOut=0x1ebd0896e8*=0x0) returned 0x80004001 [0082.363] IUnknown:Release (This=0x1ebd085f40) returned 0xd [0082.363] IUnknown:QueryInterface (This=0x1ebd085f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1ebca5e630) [0082.363] IUnknown:AddRef (This=0x1ebd085f40) returned 0xe [0082.363] IUnknown_QueryService (in: punk=0x1ebcb77b18, guidService=0x7ff8de1c0950*(Data1=0xcde725b0, Data2=0xccc9, Data3=0x4519, Data4=([0]=0x91, [1]=0x7e, [2]=0x32, [3]=0x5d, [4]=0x72, [5]=0xfa, [6]=0xb4, [7]=0xce)), riid=0x7ff8de1d2fb0*(Data1=0x1af3a467, Data2=0x214f, Data3=0x4298, Data4=([0]=0x90, [1]=0x8e, [2]=0x6, [3]=0xb0, [4]=0x3e, [5]=0xb, [6]=0x39, [7]=0xf9)), ppvOut=0x1ebd0896f0 | out: ppvOut=0x1ebd0896f0*=0x0) returned 0x80004001 [0082.364] IUnknown:Release (This=0x1ebd085f40) returned 0xd [0082.364] IUnknown:QueryInterface (This=0x1ebd085f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1ebca5e630) [0082.364] IUnknown:AddRef (This=0x1ebd085f40) returned 0xe [0082.364] IUnknown_QueryService (in: punk=0x1ebcb77b18, guidService=0x7ff8de1c0800*(Data1=0x80605492, Data2=0x67d9, Data3=0x414f, Data4=([0]=0xaf, [1]=0x89, [2]=0xa1, [3]=0xcd, [4]=0xf1, [5]=0x24, [6]=0x2b, [7]=0xc1)), riid=0x7ff8de1c0068*(Data1=0xe5aa01f7, Data2=0x1fb8, Data3=0x4830, Data4=([0]=0x87, [1]=0x20, [2]=0x4e, [3]=0x67, [4]=0x34, [5]=0xcb, [6]=0xd5, [7]=0xf3)), ppvOut=0x1ebd0896f8 | out: ppvOut=0x1ebd0896f8*=0x0) returned 0x80004001 [0082.368] IUnknown:Release (This=0x1ebd085f40) returned 0xd [0082.368] IUnknown:QueryInterface (This=0x1ebd085f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1ebca5e630) [0082.368] IUnknown:AddRef (This=0x1ebd085f40) returned 0xe [0082.368] IUnknown_QueryService (in: punk=0x1ebcb77b18, guidService=0x7ff8de1c0810*(Data1=0x2ce78010, Data2=0x74db, Data3=0x48bc, Data4=([0]=0x9c, [1]=0x6a, [2]=0x10, [3]=0xf3, [4]=0x72, [5]=0x49, [6]=0x57, [7]=0x23)), riid=0x7ff8de1bfb70*(Data1=0x989191ac, Data2=0x28ff, Data3=0x4cf0, Data4=([0]=0x95, [1]=0x84, [2]=0xe0, [3]=0xd0, [4]=0x78, [5]=0xbc, [6]=0x23, [7]=0x96)), ppvOut=0x1ebd089700 | out: ppvOut=0x1ebd089700*=0x0) returned 0x80004001 [0082.369] IUnknown:Release (This=0x1ebd085f40) returned 0xd [0082.369] IUnknown:QueryInterface (This=0x1ebd085f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1ebca5e630) [0082.369] IUnknown:AddRef (This=0x1ebd085f40) returned 0xe [0082.369] IUnknown_QueryService (in: punk=0x1ebcb77b18, guidService=0x7ff8de1c0078*(Data1=0x26db2472, Data2=0xb7b7, Data3=0x406b, Data4=([0]=0x97, [1]=0x2, [2]=0x73, [3]=0xa, [4]=0x4e, [5]=0x20, [6]=0xd3, [7]=0xbf)), riid=0x7ff8de1c0a10*(Data1=0x2f0666c6, Data2=0x12f7, Data3=0x4360, Data4=([0]=0xb5, [1]=0x11, [2]=0xa3, [3]=0x94, [4]=0xa0, [5]=0x55, [6]=0x37, [7]=0x25)), ppvOut=0x1ebd089708 | out: ppvOut=0x1ebd089708*=0x0) returned 0x80004001 [0082.370] IUnknown:Release (This=0x1ebd085f40) returned 0xd [0082.370] IUnknown:QueryInterface (This=0x1ebd085f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1ebca5e630) [0082.370] IUnknown:AddRef (This=0x1ebd085f40) returned 0xe [0082.370] IUnknown_QueryService (in: punk=0x1ebcb77b18, guidService=0x7ff8de1c0930*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), riid=0x7ff8de1c0a30*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), ppvOut=0x1ebd089bf0 | out: ppvOut=0x1ebd089bf0*=0x0) returned 0x80004001 [0082.371] IUnknown:Release (This=0x1ebd085f40) returned 0xd [0082.371] IUnknown:QueryInterface (This=0x1ebd085f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1ebca5e630) [0082.371] IUnknown:AddRef (This=0x1ebd085f40) returned 0xe [0082.371] IUnknown_QueryService (in: punk=0x1ebcb77b18, guidService=0x7ff8de27c2c0*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff8de27fc98*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0x1ebca5e670 | out: ppvOut=0x1ebca5e670*=0x0) returned 0x80004001 [0082.373] IUnknown:Release (This=0x1ebd085f40) returned 0xd [0082.373] IUnknown:AddRef (This=0x1ebd085f40) returned 0xe [0082.373] GetCurrentThreadId () returned 0xa2c [0082.373] PostThreadMessageW (idThread=0xa2c, Msg=0x8001, wParam=0x0, lParam=0x0) returned 1 [0082.373] GetMessageW (in: lpMsg=0x1ebca5fc88, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebca5fc88) returned 1 [0082.373] CompareStringOrdinal (lpString1="openas", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0082.373] CompareStringOrdinal (lpString1="OpenWithSetDefaultOn", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0082.373] IUnknown_QueryService (in: punk=0x1ebcb77b18, guidService=0x7ff7bd657da0*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), riid=0x7ff7bd657910*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), ppvOut=0x1ebca5fd18 | out: ppvOut=0x1ebca5fd18*=0x1ebcb7b138) returned 0x0 [0082.406] IUnknown_Set (in: ppunk=0x1ebd085f60*=0x1ebcb77b18, punk=0x0 | out: ppunk=0x1ebd085f60*=0x0) [0082.507] IUnknown_QueryService (in: punk=0x0, guidService=0x7ff7bd657d60*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff7bd657950*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0x1ebca5fc68 | out: ppvOut=0x1ebca5fc68*=0x0) returned 0x80004001 [0082.507] QISearch (in: that=0x1ebd085f30, pqit=0x7ff7bd657970, riid=0x7ff7bd657ac0*(Data1=0x1c9cd5bb, Data2=0x98e9, Data3=0x4491, Data4=([0]=0xa6, [1]=0xf, [2]=0x31, [3]=0xaa, [4]=0xcc, [5]=0x72, [6]=0xb8, [7]=0x3c)), ppv=0x1ebca5fbc8 | out: that=0x1ebd085f30, ppv=0x1ebca5fbc8*=0x1ebd085f78) returned 0x0 [0082.508] IUnknown:QueryInterface (in: This=0x1ebcb71028, riid=0x7ff7bd657930*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0x1ebca5fc60 | out: ppvObject=0x1ebca5fc60*=0x1ebcb71028) returned 0x0 [0082.508] IShellItemArray:GetItemAt (in: This=0x1ebcb71028, dwIndex=0x0, ppsi=0x1ebca5fc50 | out: ppsi=0x1ebca5fc50*=0x1ebcb7bba8) returned 0x0 [0082.508] IUnknown:QueryInterface (in: This=0x1ebcb7bba8, riid=0x7ff7bd657b10*(Data1=0x7e9fb0d3, Data2=0x919f, Data3=0x4307, Data4=([0]=0xab, [1]=0x2e, [2]=0x9b, [3]=0x18, [4]=0x60, [5]=0x31, [6]=0xc, [7]=0x93)), ppvObject=0x1ebca5fc58 | out: ppvObject=0x1ebca5fc58*=0x1ebcb7bba8) returned 0x0 [0082.508] IUnknown:Release (This=0x1ebcb7bba8) returned 0x1 [0082.508] IShellItem:BindToHandler (in: This=0x1ebcb7bba8, pbc=0x0, bhid=0x7ff7bd657db0, riid=0x7ff7bd657920, ppv=0x1ebca5fc50 | out: ppv=0x1ebca5fc50) returned 0x0 [0082.513] IUnknown:Release (This=0x1ebcb7bba8) returned 0x0 [0082.513] IUnknown:Release (This=0x1ebcb71028) returned 0x1 [0082.513] IUnknown:AddRef (This=0x1ebd085f78) returned 0xf [0082.513] IObjectWithSelection:GetSelection (in: This=0x1ebd085f78, riid=0x7ff8de1c76a8, ppv=0x1ebd089718 | out: ppv=0x1ebd089718) returned 0x0 [0082.513] IUnknown:QueryInterface (in: This=0x1ebcb71028, riid=0x7ff8de1c76a8*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0x1ebd089718 | out: ppvObject=0x1ebd089718*=0x1ebcb71028) returned 0x0 [0082.513] IUnknown:Release (This=0x1ebd085f78) returned 0xe [0082.523] IUnknown:Release (This=0x1ebd085f78) returned 0x7 [0082.523] IUnknown:Release (This=0x1ebd085f78) returned 0x6 [0107.403] IUnknown:Release (This=0x1ebcb71028) returned 0x1 [0107.403] IUnknown_SetSite (punk=0x1ebd089620, punkSite=0x0) returned 0x0 [0107.403] IUnknown:Release (This=0x1ebd085f40) returned 0x2 [0107.403] PostQuitMessage (nExitCode=0) [0107.403] TranslateMessage (lpMsg=0x1ebca5fc88) returned 0 [0107.403] DispatchMessageW (lpMsg=0x1ebca5fc88) returned 0x0 [0107.403] GetMessageW (in: lpMsg=0x1ebca5fc88, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebca5fc88) returned 0 [0107.404] CoRevokeClassObject (dwRegister=0x10) returned 0x0 [0107.643] IUnknown:Release (This=0x1ebd089620) returned 0x0 [0107.839] CoTaskMemFree (pv=0x1ebcb5da30) [0107.839] Str_SetPtrW (in: ppsz=0x1ebd085fa0*=0x0, psz=0x0 | out: ppsz=0x1ebd085fa0*=0x0) returned 1 [0107.839] Str_SetPtrW (in: ppsz=0x1ebd085fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop", psz=0x0 | out: ppsz=0x1ebd085fa8*=0x0) returned 1 [0107.839] SHSetThreadRef (punk=0x0) returned 0x0 [0107.839] CoUninitialize () [0108.356] LocalFree (hMem=0x1ebcb4b7a0) returned 0x0 [0108.356] EtwEventUnregister (RegHandle=0x28001ebcb50230) returned 0x0 [0108.356] exit (_Code=0) Thread: id = 144 os_tid = 0xaec Thread: id = 145 os_tid = 0x8d8 Thread: id = 146 os_tid = 0x450 Thread: id = 148 os_tid = 0xa6c Thread: id = 149 os_tid = 0x574 Thread: id = 150 os_tid = 0x5fc Thread: id = 230 os_tid = 0xdf4 Thread: id = 231 os_tid = 0xdfc Process: id = "10" image_name = "openwith.exe" filename = "c:\\windows\\system32\\openwith.exe" page_root = "0x27695000" os_pid = "0xa54" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xdd4" cmd_line = "C:\\Windows\\system32\\OpenWith.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1621 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1622 start_va = 0xe0f9380000 end_va = 0xe0f938ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0f9380000" filename = "" Region: id = 1623 start_va = 0xe0f9390000 end_va = 0xe0f9396fff entry_point = 0x0 region_type = private name = "private_0x000000e0f9390000" filename = "" Region: id = 1624 start_va = 0xe0f93a0000 end_va = 0xe0f93b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0f93a0000" filename = "" Region: id = 1625 start_va = 0xe0f93c0000 end_va = 0xe0f943ffff entry_point = 0x0 region_type = private name = "private_0x000000e0f93c0000" filename = "" Region: id = 1626 start_va = 0xe0f9440000 end_va = 0xe0f9443fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0f9440000" filename = "" Region: id = 1627 start_va = 0xe0f9450000 end_va = 0xe0f9452fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0f9450000" filename = "" Region: id = 1628 start_va = 0xe0f9460000 end_va = 0xe0f9461fff entry_point = 0x0 region_type = private name = "private_0x000000e0f9460000" filename = "" Region: id = 1629 start_va = 0xe0f9470000 end_va = 0xe0f952dfff entry_point = 0xe0f9470000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1630 start_va = 0xe0f9530000 end_va = 0xe0f95affff entry_point = 0x0 region_type = private name = "private_0x000000e0f9530000" filename = "" Region: id = 1631 start_va = 0xe0f95b0000 end_va = 0xe0f95b6fff entry_point = 0x0 region_type = private name = "private_0x000000e0f95b0000" filename = "" Region: id = 1632 start_va = 0xe0f95c0000 end_va = 0xe0f95c0fff entry_point = 0xe0f95c0000 region_type = mapped_file name = "openwith.exe.mui" filename = "\\Windows\\System32\\en-US\\OpenWith.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\openwith.exe.mui") Region: id = 1633 start_va = 0xe0f95d0000 end_va = 0xe0f95d0fff entry_point = 0x0 region_type = private name = "private_0x000000e0f95d0000" filename = "" Region: id = 1634 start_va = 0xe0f95e0000 end_va = 0xe0f95e0fff entry_point = 0x0 region_type = private name = "private_0x000000e0f95e0000" filename = "" Region: id = 1635 start_va = 0xe0f95f0000 end_va = 0xe0f95f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0f95f0000" filename = "" Region: id = 1636 start_va = 0xe0f9600000 end_va = 0xe0f9601fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0f9600000" filename = "" Region: id = 1637 start_va = 0xe0f9620000 end_va = 0xe0f971ffff entry_point = 0x0 region_type = private name = "private_0x000000e0f9620000" filename = "" Region: id = 1638 start_va = 0xe0f9720000 end_va = 0xe0f98a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0f9720000" filename = "" Region: id = 1639 start_va = 0xe0f98b0000 end_va = 0xe0f992ffff entry_point = 0x0 region_type = private name = "private_0x000000e0f98b0000" filename = "" Region: id = 1640 start_va = 0xe0f9930000 end_va = 0xe0f993ffff entry_point = 0x0 region_type = private name = "private_0x000000e0f9930000" filename = "" Region: id = 1641 start_va = 0xe0f9940000 end_va = 0xe0f9ac0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0f9940000" filename = "" Region: id = 1642 start_va = 0xe0f9ad0000 end_va = 0xe0faecffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0f9ad0000" filename = "" Region: id = 1643 start_va = 0xe0faed0000 end_va = 0xe0faf4ffff entry_point = 0x0 region_type = private name = "private_0x000000e0faed0000" filename = "" Region: id = 1644 start_va = 0xe0faf50000 end_va = 0xe0fafcffff entry_point = 0x0 region_type = private name = "private_0x000000e0faf50000" filename = "" Region: id = 1645 start_va = 0xe0fafd0000 end_va = 0xe0fb04ffff entry_point = 0x0 region_type = private name = "private_0x000000e0fafd0000" filename = "" Region: id = 1646 start_va = 0xe0fb0c0000 end_va = 0xe0fb0cffff entry_point = 0x0 region_type = private name = "private_0x000000e0fb0c0000" filename = "" Region: id = 1647 start_va = 0xe0fb0d0000 end_va = 0xe0fb406fff entry_point = 0xe0fb0d0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1648 start_va = 0x7df5ff210000 end_va = 0x7ff5ff20ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff210000" filename = "" Region: id = 1649 start_va = 0x7ff7bcd50000 end_va = 0x7ff7bce4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bcd50000" filename = "" Region: id = 1650 start_va = 0x7ff7bce50000 end_va = 0x7ff7bce72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bce50000" filename = "" Region: id = 1651 start_va = 0x7ff7bce73000 end_va = 0x7ff7bce74fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bce73000" filename = "" Region: id = 1652 start_va = 0x7ff7bce75000 end_va = 0x7ff7bce76fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bce75000" filename = "" Region: id = 1653 start_va = 0x7ff7bce77000 end_va = 0x7ff7bce77fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bce77000" filename = "" Region: id = 1654 start_va = 0x7ff7bce78000 end_va = 0x7ff7bce79fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bce78000" filename = "" Region: id = 1655 start_va = 0x7ff7bce7a000 end_va = 0x7ff7bce7bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bce7a000" filename = "" Region: id = 1656 start_va = 0x7ff7bce7c000 end_va = 0x7ff7bce7dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bce7c000" filename = "" Region: id = 1657 start_va = 0x7ff7bce7e000 end_va = 0x7ff7bce7ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bce7e000" filename = "" Region: id = 1658 start_va = 0x7ff7bd650000 end_va = 0x7ff7bd669fff entry_point = 0x7ff7bd650000 region_type = mapped_file name = "openwith.exe" filename = "\\Windows\\System32\\OpenWith.exe" (normalized: "c:\\windows\\system32\\openwith.exe") Region: id = 1659 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1660 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 1661 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1662 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1663 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1664 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1665 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1666 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1667 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1668 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1669 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1670 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1671 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1672 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1673 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1674 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1675 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1676 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1677 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1678 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1679 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1680 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1681 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1682 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1683 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1684 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1685 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1686 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1687 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1688 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1689 start_va = 0xe0f9610000 end_va = 0xe0f9610fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0f9610000" filename = "" Region: id = 1690 start_va = 0xe0fb050000 end_va = 0xe0fb050fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0fb050000" filename = "" Region: id = 1691 start_va = 0x7ff8ddbd0000 end_va = 0x7ff8de6dcfff entry_point = 0x7ff8ddbd0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 1692 start_va = 0x7ff8e9860000 end_va = 0x7ff8e994dfff entry_point = 0x7ff8e9860000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1693 start_va = 0x7ff8e3a70000 end_va = 0x7ff8e3c26fff entry_point = 0x7ff8e3a70000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 1694 start_va = 0xe0fb060000 end_va = 0xe0fb062fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0fb060000" filename = "" Region: id = 1695 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1696 start_va = 0x7ff8e7430000 end_va = 0x7ff8e7560fff entry_point = 0x7ff8e7430000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1697 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1845 start_va = 0xe0fb070000 end_va = 0xe0fb099fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0fb070000" filename = "" Region: id = 1846 start_va = 0xe0fb0a0000 end_va = 0xe0fb0a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0fb0a0000" filename = "" Region: id = 1847 start_va = 0xe0fb0b0000 end_va = 0xe0fb0b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0fb0b0000" filename = "" Region: id = 1848 start_va = 0xe0fb410000 end_va = 0xe0fb48ffff entry_point = 0x0 region_type = private name = "private_0x000000e0fb410000" filename = "" Region: id = 1849 start_va = 0xe0fb490000 end_va = 0xe0fb50ffff entry_point = 0x0 region_type = private name = "private_0x000000e0fb490000" filename = "" Region: id = 1850 start_va = 0xe0fb510000 end_va = 0xe0fb511fff entry_point = 0xe0fb510000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 1851 start_va = 0xe0fb520000 end_va = 0xe0fb523fff entry_point = 0xe0fb520000 region_type = mapped_file name = "windows.ui.immersive.dll.mui" filename = "\\Windows\\System32\\en-US\\Windows.UI.Immersive.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.ui.immersive.dll.mui") Region: id = 1852 start_va = 0xe0fb530000 end_va = 0xe0fb5affff entry_point = 0x0 region_type = private name = "private_0x000000e0fb530000" filename = "" Region: id = 1853 start_va = 0xe0fb5b0000 end_va = 0xe0fb6affff entry_point = 0x0 region_type = private name = "private_0x000000e0fb5b0000" filename = "" Region: id = 1854 start_va = 0xe0fb6b0000 end_va = 0xe0fb6b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0fb6b0000" filename = "" Region: id = 1855 start_va = 0xe0fb6c0000 end_va = 0xe0fb6c0fff entry_point = 0x0 region_type = private name = "private_0x000000e0fb6c0000" filename = "" Region: id = 1856 start_va = 0xe0fb6d0000 end_va = 0xe0fb6d0fff entry_point = 0x0 region_type = private name = "private_0x000000e0fb6d0000" filename = "" Region: id = 1857 start_va = 0xe0fb6e0000 end_va = 0xe0fb75ffff entry_point = 0x0 region_type = private name = "private_0x000000e0fb6e0000" filename = "" Region: id = 1858 start_va = 0xe0fb760000 end_va = 0xe0fb760fff entry_point = 0x0 region_type = private name = "private_0x000000e0fb760000" filename = "" Region: id = 1859 start_va = 0xe0fb770000 end_va = 0xe0fb770fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0fb770000" filename = "" Region: id = 1860 start_va = 0xe0fb780000 end_va = 0xe0fb793fff entry_point = 0xe0fb780000 region_type = mapped_file name = "twinui.dll.mui" filename = "\\Windows\\System32\\en-US\\twinui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\twinui.dll.mui") Region: id = 1861 start_va = 0xe0fb7a0000 end_va = 0xe0fb7a1fff entry_point = 0xe0fb7a0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 1862 start_va = 0xe0fb7b0000 end_va = 0xe0fb7b4fff entry_point = 0xe0fb7b0000 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 1863 start_va = 0xe0fb7c0000 end_va = 0xe0fb8bffff entry_point = 0x0 region_type = private name = "private_0x000000e0fb7c0000" filename = "" Region: id = 1864 start_va = 0xe0fb8d0000 end_va = 0xe0fb8e2fff entry_point = 0xe0fb8d0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 1865 start_va = 0xe0fb8f0000 end_va = 0xe0fb8f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0fb8f0000" filename = "" Region: id = 1866 start_va = 0x7ff7bcd48000 end_va = 0x7ff7bcd49fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcd48000" filename = "" Region: id = 1867 start_va = 0x7ff7bcd4a000 end_va = 0x7ff7bcd4bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcd4a000" filename = "" Region: id = 1868 start_va = 0x7ff7bcd4c000 end_va = 0x7ff7bcd4dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcd4c000" filename = "" Region: id = 1869 start_va = 0x7ff7bcd4e000 end_va = 0x7ff7bcd4ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcd4e000" filename = "" Region: id = 1870 start_va = 0x7ff8d1180000 end_va = 0x7ff8d132ffff entry_point = 0x7ff8d1180000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 1871 start_va = 0x7ff8d1330000 end_va = 0x7ff8d147bfff entry_point = 0x7ff8d1330000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 1872 start_va = 0x7ff8d76a0000 end_va = 0x7ff8d7738fff entry_point = 0x7ff8d76a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 1873 start_va = 0x7ff8debc0000 end_va = 0x7ff8dec28fff entry_point = 0x7ff8debc0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 1874 start_va = 0x7ff8e37f0000 end_va = 0x7ff8e3a48fff entry_point = 0x7ff8e37f0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 1875 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1876 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 1877 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 1878 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1879 start_va = 0x7ff8e8650000 end_va = 0x7ff8e869afff entry_point = 0x7ff8e8650000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 1880 start_va = 0x7ff8e8860000 end_va = 0x7ff8e8acdfff entry_point = 0x7ff8e8860000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 1881 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 1882 start_va = 0x7ff8e8c60000 end_va = 0x7ff8e8cfbfff entry_point = 0x7ff8e8c60000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 1883 start_va = 0x7ff8e8d00000 end_va = 0x7ff8e8fa2fff entry_point = 0x7ff8e8d00000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 1884 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 1885 start_va = 0x7ff8e9130000 end_va = 0x7ff8e9200fff entry_point = 0x7ff8e9130000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 1886 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1887 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Thread: id = 136 os_tid = 0x654 Thread: id = 137 os_tid = 0x420 Thread: id = 138 os_tid = 0x784 Thread: id = 139 os_tid = 0x630 Thread: id = 140 os_tid = 0xb50 [0083.906] GetMessageW (in: lpMsg=0xe0f943fce8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0f943fce8) returned 1 [0083.906] TranslateMessage (lpMsg=0xe0f943fce8) returned 0 [0083.906] DispatchMessageW (lpMsg=0xe0f943fce8) returned 0x1 [0083.910] GetMessageW (in: lpMsg=0xe0f943fce8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0f943fce8) returned 1 [0083.992] TranslateMessage (lpMsg=0xe0f943fce8) returned 0 [0083.992] DispatchMessageW (lpMsg=0xe0f943fce8) returned 0x1 [0084.129] IUnknown_Set (in: ppunk=0xe0f9935f60*=0x0, punk=0xe0f964ae28 | out: ppunk=0xe0f9935f60*=0xe0f964ae28) [0084.129] GetMessageW (in: lpMsg=0xe0f943fce8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0f943fce8) returned 1 [0084.148] TranslateMessage (lpMsg=0xe0f943fce8) returned 0 [0084.148] DispatchMessageW (lpMsg=0xe0f943fce8) returned 0x1 [0084.149] GetMessageW (in: lpMsg=0xe0f943fce8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0f943fce8) returned 1 [0084.187] TranslateMessage (lpMsg=0xe0f943fce8) returned 0 [0084.187] DispatchMessageW (lpMsg=0xe0f943fce8) returned 0x1 [0084.187] Str_SetPtrW (in: ppsz=0xe0f9935fa8*=0x0, psz="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: ppsz=0xe0f9935fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0084.188] GetMessageW (in: lpMsg=0xe0f943fce8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0f943fce8) returned 1 [0084.200] TranslateMessage (lpMsg=0xe0f943fce8) returned 0 [0084.200] DispatchMessageW (lpMsg=0xe0f943fce8) returned 0x1 [0084.201] GetMessageW (in: lpMsg=0xe0f943fce8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0f943fce8) returned 1 [0084.251] TranslateMessage (lpMsg=0xe0f943fce8) returned 0 [0084.251] DispatchMessageW (lpMsg=0xe0f943fce8) returned 0x1 [0084.252] GetMessageW (in: lpMsg=0xe0f943fce8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0f943fce8) returned 1 [0084.286] TranslateMessage (lpMsg=0xe0f943fce8) returned 0 [0084.286] DispatchMessageW (lpMsg=0xe0f943fce8) returned 0x1 [0084.296] IUnknown_Set (in: ppunk=0xe0f9935fc0*=0x0, punk=0xe0f9658078 | out: ppunk=0xe0f9935fc0*=0xe0f9658078) [0084.296] GetMessageW (in: lpMsg=0xe0f943fce8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0f943fce8) returned 1 [0084.320] TranslateMessage (lpMsg=0xe0f943fce8) returned 0 [0084.320] DispatchMessageW (lpMsg=0xe0f943fce8) returned 0x1 [0084.321] GetMessageW (in: lpMsg=0xe0f943fce8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0f943fce8) returned 1 [0084.359] TranslateMessage (lpMsg=0xe0f943fce8) returned 0 [0084.360] DispatchMessageW (lpMsg=0xe0f943fce8) returned 0x1 [0084.360] GetMessageW (in: lpMsg=0xe0f943fce8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0f943fce8) returned 1 [0084.389] TranslateMessage (lpMsg=0xe0f943fce8) returned 0 [0084.389] DispatchMessageW (lpMsg=0xe0f943fce8) returned 0x1 [0084.390] CoTaskMemAlloc (cb=0xa) returned 0xe0f963d830 [0084.427] GetMessageW (in: lpMsg=0xe0f943fce8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0f943fce8) returned 1 [0084.428] TranslateMessage (lpMsg=0xe0f943fce8) returned 0 [0084.428] DispatchMessageW (lpMsg=0xe0f943fce8) returned 0x1 [0084.428] GetMessageW (in: lpMsg=0xe0f943fce8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0f943fce8) returned 1 [0084.429] TranslateMessage (lpMsg=0xe0f943fce8) returned 0 [0084.429] DispatchMessageW (lpMsg=0xe0f943fce8) returned 0x1 [0084.429] GetMessageW (in: lpMsg=0xe0f943fce8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0f943fce8) returned 1 [0084.430] TranslateMessage (lpMsg=0xe0f943fce8) returned 0 [0084.430] DispatchMessageW (lpMsg=0xe0f943fce8) returned 0x1 [0084.430] KillTimer (hWnd=0x0, uIDEvent=0x7f85) returned 1 [0084.430] CompareStringOrdinal (lpString1="InvokeDefaultVerbInOtherProcess", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 1 [0084.430] CoCreateInstance (in: rclsid=0x7ff7bd6575b0*(Data1=0x94b23d4d, Data2=0x1040, Data3=0x4c4b, Data4=([0]=0x90, [1]=0x81, [2]=0x85, [3]=0xd8, [4]=0xd6, [5]=0xfa, [6]=0x36, [7]=0xc4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7bd657a50*(Data1=0xce149b23, Data2=0x5941, Data3=0x4079, Data4=([0]=0x92, [1]=0x23, [2]=0x52, [3]=0xc0, [4]=0xa9, [5]=0x91, [6]=0xec, [7]=0x48)), ppv=0xe0f9935fe0 | out: ppv=0xe0f9935fe0*=0xe0f9939620) returned 0x0 [0084.453] IUnknown_SetSite (punk=0xe0f9939620, punkSite=0xe0f9935f40) returned 0x0 [0084.453] IUnknown:QueryInterface (This=0xe0f9935f40, riid=0x7ff8ee00d438*(Data1=0x114, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xe0f943e630) [0084.453] IUnknown:QueryInterface (This=0xe0f9935f40, riid=0x7ff8ee00d468*(Data1=0x79eac9ed, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xe0f943e620) [0084.453] IUnknown:QueryInterface (This=0xe0f9935f40, riid=0x7ff8ee00d458*(Data1=0x214e3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xe0f943e628) [0084.453] IUnknown:QueryInterface (This=0xe0f9935f40, riid=0x7ff8ee00d448*(Data1=0x45d64a29, Data2=0xa63e, Data3=0x4cb6, Data4=([0]=0xb4, [1]=0x98, [2]=0x57, [3]=0x81, [4]=0xd2, [5]=0x98, [6]=0xcb, [7]=0x4f)), ppvObject=0xe0f943e638) [0084.453] IUnknown:QueryInterface (This=0xe0f9935f40, riid=0x7ff8eb8347d8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0xe0f943e660) [0084.453] IUnknown:QueryInterface (in: This=0xe0f964ae28, riid=0x7ff8de1e0bd8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xe0f943e690 | out: ppvObject=0xe0f943e690*=0xe0f964ae28) returned 0x0 [0084.588] IUnknown:QueryInterface (This=0xe0f9935f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe0f943e690) [0084.588] IUnknown:AddRef (This=0xe0f9935f40) returned 0xe [0084.588] IUnknown_QueryService (in: punk=0xe0f964ae28, guidService=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), riid=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), ppvOut=0xe0f99396e0 | out: ppvOut=0xe0f99396e0*=0x0) returned 0x80004001 [0084.638] IUnknown:Release (This=0xe0f9935f40) returned 0xd [0084.638] IUnknown:QueryInterface (This=0xe0f9935f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe0f943e690) [0084.638] IUnknown:AddRef (This=0xe0f9935f40) returned 0xe [0084.638] IUnknown_QueryService (in: punk=0xe0f964ae28, guidService=0x7ff8de1c0980*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), riid=0x7ff8de1c0a40*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), ppvOut=0xe0f99396e8 | out: ppvOut=0xe0f99396e8*=0x0) returned 0x80004001 [0084.639] IUnknown:Release (This=0xe0f9935f40) returned 0xd [0084.639] IUnknown:QueryInterface (This=0xe0f9935f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe0f943e690) [0084.639] IUnknown:AddRef (This=0xe0f9935f40) returned 0xe [0084.639] IUnknown_QueryService (in: punk=0xe0f964ae28, guidService=0x7ff8de1c0950*(Data1=0xcde725b0, Data2=0xccc9, Data3=0x4519, Data4=([0]=0x91, [1]=0x7e, [2]=0x32, [3]=0x5d, [4]=0x72, [5]=0xfa, [6]=0xb4, [7]=0xce)), riid=0x7ff8de1d2fb0*(Data1=0x1af3a467, Data2=0x214f, Data3=0x4298, Data4=([0]=0x90, [1]=0x8e, [2]=0x6, [3]=0xb0, [4]=0x3e, [5]=0xb, [6]=0x39, [7]=0xf9)), ppvOut=0xe0f99396f0 | out: ppvOut=0xe0f99396f0*=0x0) returned 0x80004001 [0084.640] IUnknown:Release (This=0xe0f9935f40) returned 0xd [0084.640] IUnknown:QueryInterface (This=0xe0f9935f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe0f943e690) [0084.640] IUnknown:AddRef (This=0xe0f9935f40) returned 0xe [0084.640] IUnknown_QueryService (in: punk=0xe0f964ae28, guidService=0x7ff8de1c0800*(Data1=0x80605492, Data2=0x67d9, Data3=0x414f, Data4=([0]=0xaf, [1]=0x89, [2]=0xa1, [3]=0xcd, [4]=0xf1, [5]=0x24, [6]=0x2b, [7]=0xc1)), riid=0x7ff8de1c0068*(Data1=0xe5aa01f7, Data2=0x1fb8, Data3=0x4830, Data4=([0]=0x87, [1]=0x20, [2]=0x4e, [3]=0x67, [4]=0x34, [5]=0xcb, [6]=0xd5, [7]=0xf3)), ppvOut=0xe0f99396f8 | out: ppvOut=0xe0f99396f8*=0x0) returned 0x80004001 [0084.640] IUnknown:Release (This=0xe0f9935f40) returned 0xd [0084.640] IUnknown:QueryInterface (This=0xe0f9935f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe0f943e690) [0084.640] IUnknown:AddRef (This=0xe0f9935f40) returned 0xe [0084.640] IUnknown_QueryService (in: punk=0xe0f964ae28, guidService=0x7ff8de1c0810*(Data1=0x2ce78010, Data2=0x74db, Data3=0x48bc, Data4=([0]=0x9c, [1]=0x6a, [2]=0x10, [3]=0xf3, [4]=0x72, [5]=0x49, [6]=0x57, [7]=0x23)), riid=0x7ff8de1bfb70*(Data1=0x989191ac, Data2=0x28ff, Data3=0x4cf0, Data4=([0]=0x95, [1]=0x84, [2]=0xe0, [3]=0xd0, [4]=0x78, [5]=0xbc, [6]=0x23, [7]=0x96)), ppvOut=0xe0f9939700 | out: ppvOut=0xe0f9939700*=0x0) returned 0x80004001 [0084.641] IUnknown:Release (This=0xe0f9935f40) returned 0xd [0084.641] IUnknown:QueryInterface (This=0xe0f9935f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe0f943e690) [0084.641] IUnknown:AddRef (This=0xe0f9935f40) returned 0xe [0084.642] IUnknown_QueryService (in: punk=0xe0f964ae28, guidService=0x7ff8de1c0078*(Data1=0x26db2472, Data2=0xb7b7, Data3=0x406b, Data4=([0]=0x97, [1]=0x2, [2]=0x73, [3]=0xa, [4]=0x4e, [5]=0x20, [6]=0xd3, [7]=0xbf)), riid=0x7ff8de1c0a10*(Data1=0x2f0666c6, Data2=0x12f7, Data3=0x4360, Data4=([0]=0xb5, [1]=0x11, [2]=0xa3, [3]=0x94, [4]=0xa0, [5]=0x55, [6]=0x37, [7]=0x25)), ppvOut=0xe0f9939708 | out: ppvOut=0xe0f9939708*=0x0) returned 0x80004001 [0084.642] IUnknown:Release (This=0xe0f9935f40) returned 0xd [0084.642] IUnknown:QueryInterface (This=0xe0f9935f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe0f943e690) [0084.642] IUnknown:AddRef (This=0xe0f9935f40) returned 0xe [0084.642] IUnknown_QueryService (in: punk=0xe0f964ae28, guidService=0x7ff8de1c0930*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), riid=0x7ff8de1c0a30*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), ppvOut=0xe0f9939bf0 | out: ppvOut=0xe0f9939bf0*=0x0) returned 0x80004001 [0084.643] IUnknown:Release (This=0xe0f9935f40) returned 0xd [0084.643] IUnknown:QueryInterface (This=0xe0f9935f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe0f943e690) [0084.643] IUnknown:AddRef (This=0xe0f9935f40) returned 0xe [0084.643] IUnknown_QueryService (in: punk=0xe0f964ae28, guidService=0x7ff8de27c2c0*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff8de27fc98*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xe0f943e6d0 | out: ppvOut=0xe0f943e6d0*=0x0) returned 0x80004001 [0084.644] IUnknown:Release (This=0xe0f9935f40) returned 0xd [0084.644] IUnknown:AddRef (This=0xe0f9935f40) returned 0xe [0084.644] GetCurrentThreadId () returned 0xb50 [0084.644] PostThreadMessageW (idThread=0xb50, Msg=0x8001, wParam=0x0, lParam=0x0) returned 1 [0084.644] GetMessageW (in: lpMsg=0xe0f943fce8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0f943fce8) returned 1 [0084.644] CompareStringOrdinal (lpString1="openas", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0084.644] CompareStringOrdinal (lpString1="OpenWithSetDefaultOn", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0084.644] IUnknown_QueryService (in: punk=0xe0f964ae28, guidService=0x7ff7bd657da0*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), riid=0x7ff7bd657910*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), ppvOut=0xe0f943fd78 | out: ppvOut=0xe0f943fd78*=0xe0f965c358) returned 0x0 [0084.659] IUnknown_Set (in: ppunk=0xe0f9935f60*=0xe0f964ae28, punk=0x0 | out: ppunk=0xe0f9935f60*=0x0) [0084.662] IUnknown_QueryService (in: punk=0x0, guidService=0x7ff7bd657d60*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff7bd657950*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xe0f943fcc8 | out: ppvOut=0xe0f943fcc8*=0x0) returned 0x80004001 [0084.662] QISearch (in: that=0xe0f9935f30, pqit=0x7ff7bd657970, riid=0x7ff7bd657ac0*(Data1=0x1c9cd5bb, Data2=0x98e9, Data3=0x4491, Data4=([0]=0xa6, [1]=0xf, [2]=0x31, [3]=0xaa, [4]=0xcc, [5]=0x72, [6]=0xb8, [7]=0x3c)), ppv=0xe0f943fc28 | out: that=0xe0f9935f30, ppv=0xe0f943fc28*=0xe0f9935f78) returned 0x0 [0084.663] IUnknown:QueryInterface (in: This=0xe0f9658078, riid=0x7ff7bd657930*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xe0f943fcc0 | out: ppvObject=0xe0f943fcc0*=0xe0f9658078) returned 0x0 [0084.663] IShellItemArray:GetItemAt (in: This=0xe0f9658078, dwIndex=0x0, ppsi=0xe0f943fcb0 | out: ppsi=0xe0f943fcb0*=0xe0f965cb28) returned 0x0 [0084.663] IUnknown:QueryInterface (in: This=0xe0f965cb28, riid=0x7ff7bd657b10*(Data1=0x7e9fb0d3, Data2=0x919f, Data3=0x4307, Data4=([0]=0xab, [1]=0x2e, [2]=0x9b, [3]=0x18, [4]=0x60, [5]=0x31, [6]=0xc, [7]=0x93)), ppvObject=0xe0f943fcb8 | out: ppvObject=0xe0f943fcb8*=0xe0f965cb28) returned 0x0 [0084.663] IUnknown:Release (This=0xe0f965cb28) returned 0x1 [0084.663] IShellItem:BindToHandler (in: This=0xe0f965cb28, pbc=0x0, bhid=0x7ff7bd657db0, riid=0x7ff7bd657920, ppv=0xe0f943fcb0 | out: ppv=0xe0f943fcb0) returned 0x0 [0084.669] IUnknown:Release (This=0xe0f965cb28) returned 0x0 [0084.669] IUnknown:Release (This=0xe0f9658078) returned 0x1 [0084.669] IUnknown:AddRef (This=0xe0f9935f78) returned 0xf [0084.669] IObjectWithSelection:GetSelection (in: This=0xe0f9935f78, riid=0x7ff8de1c76a8, ppv=0xe0f9939718 | out: ppv=0xe0f9939718) returned 0x0 [0084.669] IUnknown:QueryInterface (in: This=0xe0f9658078, riid=0x7ff8de1c76a8*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xe0f9939718 | out: ppvObject=0xe0f9939718*=0xe0f9658078) returned 0x0 [0084.669] IUnknown:Release (This=0xe0f9935f78) returned 0xe [0084.693] IUnknown:Release (This=0xe0f9935f78) returned 0x7 [0084.693] IUnknown:Release (This=0xe0f9935f78) returned 0x6 Thread: id = 141 os_tid = 0xae0 Thread: id = 159 os_tid = 0xd6c Thread: id = 160 os_tid = 0x318 Thread: id = 161 os_tid = 0xd2c Thread: id = 163 os_tid = 0xd10 Thread: id = 164 os_tid = 0x370 Thread: id = 165 os_tid = 0xf4 Thread: id = 250 os_tid = 0x35c Thread: id = 251 os_tid = 0x32c Thread: id = 306 os_tid = 0xb84 Thread: id = 313 os_tid = 0x1f8 Process: id = "11" image_name = "openwith.exe" filename = "c:\\windows\\system32\\openwith.exe" page_root = "0x2bc94000" os_pid = "0x7c0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xdd4" cmd_line = "C:\\Windows\\system32\\OpenWith.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1706 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1707 start_va = 0xe9af30000 end_va = 0xe9af3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9af30000" filename = "" Region: id = 1708 start_va = 0xe9af40000 end_va = 0xe9af46fff entry_point = 0x0 region_type = private name = "private_0x0000000e9af40000" filename = "" Region: id = 1709 start_va = 0xe9af50000 end_va = 0xe9af63fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9af50000" filename = "" Region: id = 1710 start_va = 0xe9af70000 end_va = 0xe9afeffff entry_point = 0x0 region_type = private name = "private_0x0000000e9af70000" filename = "" Region: id = 1711 start_va = 0xe9aff0000 end_va = 0xe9aff3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9aff0000" filename = "" Region: id = 1712 start_va = 0xe9b000000 end_va = 0xe9b002fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9b000000" filename = "" Region: id = 1713 start_va = 0xe9b010000 end_va = 0xe9b011fff entry_point = 0x0 region_type = private name = "private_0x0000000e9b010000" filename = "" Region: id = 1714 start_va = 0xe9b020000 end_va = 0xe9b026fff entry_point = 0x0 region_type = private name = "private_0x0000000e9b020000" filename = "" Region: id = 1715 start_va = 0xe9b030000 end_va = 0xe9b030fff entry_point = 0xe9b030000 region_type = mapped_file name = "openwith.exe.mui" filename = "\\Windows\\System32\\en-US\\OpenWith.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\openwith.exe.mui") Region: id = 1716 start_va = 0xe9b040000 end_va = 0xe9b040fff entry_point = 0x0 region_type = private name = "private_0x0000000e9b040000" filename = "" Region: id = 1717 start_va = 0xe9b050000 end_va = 0xe9b050fff entry_point = 0x0 region_type = private name = "private_0x0000000e9b050000" filename = "" Region: id = 1718 start_va = 0xe9b060000 end_va = 0xe9b06ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9b060000" filename = "" Region: id = 1719 start_va = 0xe9b070000 end_va = 0xe9b070fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9b070000" filename = "" Region: id = 1720 start_va = 0xe9b080000 end_va = 0xe9b17ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9b080000" filename = "" Region: id = 1721 start_va = 0xe9b180000 end_va = 0xe9b23dfff entry_point = 0xe9b180000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1722 start_va = 0xe9b240000 end_va = 0xe9b2bffff entry_point = 0x0 region_type = private name = "private_0x0000000e9b240000" filename = "" Region: id = 1723 start_va = 0xe9b2c0000 end_va = 0xe9b447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9b2c0000" filename = "" Region: id = 1724 start_va = 0xe9b450000 end_va = 0xe9b5d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9b450000" filename = "" Region: id = 1725 start_va = 0xe9b5e0000 end_va = 0xe9c9dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9b5e0000" filename = "" Region: id = 1726 start_va = 0xe9c9e0000 end_va = 0xe9c9e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9c9e0000" filename = "" Region: id = 1727 start_va = 0xe9c9f0000 end_va = 0xe9ca6ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9c9f0000" filename = "" Region: id = 1728 start_va = 0xe9ca70000 end_va = 0xe9caeffff entry_point = 0x0 region_type = private name = "private_0x0000000e9ca70000" filename = "" Region: id = 1729 start_va = 0xe9caf0000 end_va = 0xe9cb6ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9caf0000" filename = "" Region: id = 1730 start_va = 0xe9cb70000 end_va = 0xe9cb7ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9cb70000" filename = "" Region: id = 1731 start_va = 0xe9cb80000 end_va = 0xe9ceb6fff entry_point = 0xe9cb80000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1732 start_va = 0xe9cec0000 end_va = 0xe9cf3ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9cec0000" filename = "" Region: id = 1733 start_va = 0x7df5fff10000 end_va = 0x7ff5fff0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fff10000" filename = "" Region: id = 1734 start_va = 0x7ff7bc6be000 end_va = 0x7ff7bc6bffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6be000" filename = "" Region: id = 1735 start_va = 0x7ff7bc6c0000 end_va = 0x7ff7bc7bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bc6c0000" filename = "" Region: id = 1736 start_va = 0x7ff7bc7c0000 end_va = 0x7ff7bc7e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bc7c0000" filename = "" Region: id = 1737 start_va = 0x7ff7bc7e4000 end_va = 0x7ff7bc7e5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc7e4000" filename = "" Region: id = 1738 start_va = 0x7ff7bc7e6000 end_va = 0x7ff7bc7e7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc7e6000" filename = "" Region: id = 1739 start_va = 0x7ff7bc7e8000 end_va = 0x7ff7bc7e9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc7e8000" filename = "" Region: id = 1740 start_va = 0x7ff7bc7ea000 end_va = 0x7ff7bc7ebfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc7ea000" filename = "" Region: id = 1741 start_va = 0x7ff7bc7ec000 end_va = 0x7ff7bc7edfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc7ec000" filename = "" Region: id = 1742 start_va = 0x7ff7bc7ee000 end_va = 0x7ff7bc7eefff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc7ee000" filename = "" Region: id = 1743 start_va = 0x7ff7bd650000 end_va = 0x7ff7bd669fff entry_point = 0x7ff7bd650000 region_type = mapped_file name = "openwith.exe" filename = "\\Windows\\System32\\OpenWith.exe" (normalized: "c:\\windows\\system32\\openwith.exe") Region: id = 1744 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1745 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 1746 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1747 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1748 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1749 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1750 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1751 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1752 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1753 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1754 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1755 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1756 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1757 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1758 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1759 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1760 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1761 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1762 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1763 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1764 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1765 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1766 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1767 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1768 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1769 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1770 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1771 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1772 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1773 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1774 start_va = 0xe9cf40000 end_va = 0xe9cf40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9cf40000" filename = "" Region: id = 1775 start_va = 0xe9cf50000 end_va = 0xe9cf50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9cf50000" filename = "" Region: id = 1776 start_va = 0x7ff8ddbd0000 end_va = 0x7ff8de6dcfff entry_point = 0x7ff8ddbd0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 1777 start_va = 0x7ff8e9860000 end_va = 0x7ff8e994dfff entry_point = 0x7ff8e9860000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1778 start_va = 0x7ff8e3a70000 end_va = 0x7ff8e3c26fff entry_point = 0x7ff8e3a70000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 1779 start_va = 0xe9cf60000 end_va = 0xe9cf62fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9cf60000" filename = "" Region: id = 1780 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1781 start_va = 0x7ff8e7430000 end_va = 0x7ff8e7560fff entry_point = 0x7ff8e7430000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1782 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1968 start_va = 0xe9cf70000 end_va = 0xe9cf99fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9cf70000" filename = "" Region: id = 1969 start_va = 0xe9cfa0000 end_va = 0xe9cfa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9cfa0000" filename = "" Region: id = 1970 start_va = 0xe9cfb0000 end_va = 0xe9cfb1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9cfb0000" filename = "" Region: id = 1971 start_va = 0xe9cfc0000 end_va = 0xe9d03ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9cfc0000" filename = "" Region: id = 1972 start_va = 0xe9d040000 end_va = 0xe9d0bffff entry_point = 0x0 region_type = private name = "private_0x0000000e9d040000" filename = "" Region: id = 1973 start_va = 0xe9d0c0000 end_va = 0xe9d0c1fff entry_point = 0xe9d0c0000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 1974 start_va = 0xe9d0d0000 end_va = 0xe9d0d3fff entry_point = 0xe9d0d0000 region_type = mapped_file name = "windows.ui.immersive.dll.mui" filename = "\\Windows\\System32\\en-US\\Windows.UI.Immersive.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.ui.immersive.dll.mui") Region: id = 1975 start_va = 0xe9d0e0000 end_va = 0xe9d15ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9d0e0000" filename = "" Region: id = 1976 start_va = 0xe9d160000 end_va = 0xe9d28afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9d160000" filename = "" Region: id = 1977 start_va = 0xe9d290000 end_va = 0xe9d38ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9d290000" filename = "" Region: id = 1978 start_va = 0xe9d390000 end_va = 0xe9d390fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9d390000" filename = "" Region: id = 1979 start_va = 0xe9d3a0000 end_va = 0xe9d3a0fff entry_point = 0x0 region_type = private name = "private_0x0000000e9d3a0000" filename = "" Region: id = 1980 start_va = 0xe9d3b0000 end_va = 0xe9d3b0fff entry_point = 0x0 region_type = private name = "private_0x0000000e9d3b0000" filename = "" Region: id = 1981 start_va = 0xe9d3c0000 end_va = 0xe9d43ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9d3c0000" filename = "" Region: id = 1982 start_va = 0xe9d440000 end_va = 0xe9d440fff entry_point = 0x0 region_type = private name = "private_0x0000000e9d440000" filename = "" Region: id = 1983 start_va = 0xe9d450000 end_va = 0xe9d450fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9d450000" filename = "" Region: id = 1984 start_va = 0xe9d460000 end_va = 0xe9d473fff entry_point = 0xe9d460000 region_type = mapped_file name = "twinui.dll.mui" filename = "\\Windows\\System32\\en-US\\twinui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\twinui.dll.mui") Region: id = 1985 start_va = 0xe9d480000 end_va = 0xe9d481fff entry_point = 0xe9d480000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 1986 start_va = 0xe9d490000 end_va = 0xe9d494fff entry_point = 0xe9d490000 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 1987 start_va = 0xe9d4a0000 end_va = 0xe9d59ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9d4a0000" filename = "" Region: id = 1988 start_va = 0xe9d5a0000 end_va = 0xe9d5a3fff entry_point = 0xe9d5a0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 1989 start_va = 0xe9d5b0000 end_va = 0xe9d5c2fff entry_point = 0xe9d5b0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 1990 start_va = 0xe9d5d0000 end_va = 0xe9d5d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9d5d0000" filename = "" Region: id = 1991 start_va = 0xe9d5e0000 end_va = 0xe9d5fbfff entry_point = 0xe9d5e0000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db") Region: id = 1992 start_va = 0xe9d600000 end_va = 0xe9d67ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9d600000" filename = "" Region: id = 1993 start_va = 0x7ff7bc6b4000 end_va = 0x7ff7bc6b5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6b4000" filename = "" Region: id = 1994 start_va = 0x7ff7bc6b6000 end_va = 0x7ff7bc6b7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6b6000" filename = "" Region: id = 1995 start_va = 0x7ff7bc6b8000 end_va = 0x7ff7bc6b9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6b8000" filename = "" Region: id = 1996 start_va = 0x7ff7bc6ba000 end_va = 0x7ff7bc6bbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6ba000" filename = "" Region: id = 1997 start_va = 0x7ff7bc6bc000 end_va = 0x7ff7bc6bdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6bc000" filename = "" Region: id = 1998 start_va = 0x7ff8d1180000 end_va = 0x7ff8d132ffff entry_point = 0x7ff8d1180000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 1999 start_va = 0x7ff8d1330000 end_va = 0x7ff8d147bfff entry_point = 0x7ff8d1330000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 2000 start_va = 0x7ff8d76a0000 end_va = 0x7ff8d7738fff entry_point = 0x7ff8d76a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 2001 start_va = 0x7ff8debc0000 end_va = 0x7ff8dec28fff entry_point = 0x7ff8debc0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 2002 start_va = 0x7ff8e37f0000 end_va = 0x7ff8e3a48fff entry_point = 0x7ff8e37f0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 2003 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2004 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 2005 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 2006 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2007 start_va = 0x7ff8e8650000 end_va = 0x7ff8e869afff entry_point = 0x7ff8e8650000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 2008 start_va = 0x7ff8e8860000 end_va = 0x7ff8e8acdfff entry_point = 0x7ff8e8860000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 2009 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 2010 start_va = 0x7ff8e8c60000 end_va = 0x7ff8e8cfbfff entry_point = 0x7ff8e8c60000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2011 start_va = 0x7ff8e8d00000 end_va = 0x7ff8e8fa2fff entry_point = 0x7ff8e8d00000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 2012 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 2013 start_va = 0x7ff8e9130000 end_va = 0x7ff8e9200fff entry_point = 0x7ff8e9130000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 2014 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 2015 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3088 start_va = 0xe9d160000 end_va = 0xe9d163fff entry_point = 0xe9d160000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3089 start_va = 0xe9d170000 end_va = 0xe9d1b2fff entry_point = 0xe9d170000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db") Region: id = 3090 start_va = 0xe9d1c0000 end_va = 0xe9d1c3fff entry_point = 0xe9d1c0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3091 start_va = 0xe9d1d0000 end_va = 0xe9d25afff entry_point = 0xe9d1d0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 3092 start_va = 0xe9d260000 end_va = 0xe9d262fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9d260000" filename = "" Region: id = 3093 start_va = 0xe9d270000 end_va = 0xe9d278fff entry_point = 0x0 region_type = private name = "private_0x0000000e9d270000" filename = "" Region: id = 3094 start_va = 0xe9d280000 end_va = 0xe9d280fff entry_point = 0x0 region_type = private name = "private_0x0000000e9d280000" filename = "" Region: id = 3095 start_va = 0xe9d680000 end_va = 0xe9d6fffff entry_point = 0x0 region_type = private name = "private_0x0000000e9d680000" filename = "" Region: id = 3096 start_va = 0xe9d700000 end_va = 0xe9d7fffff entry_point = 0x0 region_type = private name = "private_0x0000000e9d700000" filename = "" Region: id = 3097 start_va = 0xe9d810000 end_va = 0xe9d813fff entry_point = 0xe9d810000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3098 start_va = 0xe9d820000 end_va = 0xe9d821fff entry_point = 0xe9d820000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 3099 start_va = 0xe9d830000 end_va = 0xe9d853fff entry_point = 0x0 region_type = private name = "private_0x0000000e9d830000" filename = "" Region: id = 3100 start_va = 0xe9d860000 end_va = 0xe9d868fff entry_point = 0x0 region_type = private name = "private_0x0000000e9d860000" filename = "" Region: id = 3101 start_va = 0xe9d870000 end_va = 0xe9d96ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9d870000" filename = "" Region: id = 3102 start_va = 0xe9d970000 end_va = 0xe9d973fff entry_point = 0xe9d970000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3103 start_va = 0xe9d980000 end_va = 0xe9d982fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000e9d980000" filename = "" Region: id = 3104 start_va = 0xe9d990000 end_va = 0xe9d991fff entry_point = 0xe9d990000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 3105 start_va = 0xe9d9a0000 end_va = 0xe9da9ffff entry_point = 0xe9d9a0000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 3106 start_va = 0xe9daa0000 end_va = 0xe9dae7fff entry_point = 0x0 region_type = private name = "private_0x0000000e9daa0000" filename = "" Region: id = 3107 start_va = 0xe9daf0000 end_va = 0xe9db00fff entry_point = 0xe9daf0000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 3108 start_va = 0xe9db10000 end_va = 0xe9dc0ffff entry_point = 0xe9db10000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 3109 start_va = 0xe9dc50000 end_va = 0xe9dc57fff entry_point = 0x0 region_type = private name = "private_0x0000000e9dc50000" filename = "" Region: id = 3110 start_va = 0xe9dc60000 end_va = 0xe9de5ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9dc60000" filename = "" Region: id = 3111 start_va = 0xe9de60000 end_va = 0xe9dedffff entry_point = 0x0 region_type = private name = "private_0x0000000e9de60000" filename = "" Region: id = 3112 start_va = 0xe9def0000 end_va = 0xe9def0fff entry_point = 0x0 region_type = private name = "private_0x0000000e9def0000" filename = "" Region: id = 3113 start_va = 0xe9df30000 end_va = 0xe9df3ffff entry_point = 0x0 region_type = private name = "private_0x0000000e9df30000" filename = "" Region: id = 3114 start_va = 0xe9dfc0000 end_va = 0xe9e035fff entry_point = 0xe9dfc0000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 3115 start_va = 0xe9e040000 end_va = 0xe9f03ffff entry_point = 0xe9e040000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 3116 start_va = 0xe9f040000 end_va = 0xe9f83ffff entry_point = 0xe9f040000 region_type = mapped_file name = "~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1462094071-1423818996-289466292-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat") Region: id = 3117 start_va = 0xe9f840000 end_va = 0xe9f91efff entry_point = 0xe9f840000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 3118 start_va = 0xe9f920000 end_va = 0xe9fa02fff entry_point = 0xe9f920000 region_type = mapped_file name = "seguisb.ttf" filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf") Region: id = 3119 start_va = 0x7ff7bc6b0000 end_va = 0x7ff7bc6b1fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6b0000" filename = "" Region: id = 3120 start_va = 0x7ff7bc6b2000 end_va = 0x7ff7bc6b3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc6b2000" filename = "" Region: id = 3121 start_va = 0x7ff8dc6e0000 end_va = 0x7ff8dc778fff entry_point = 0x7ff8dc6e0000 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 3122 start_va = 0x7ff8dc780000 end_va = 0x7ff8dca11fff entry_point = 0x7ff8dc780000 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 3123 start_va = 0x7ff8dcfd0000 end_va = 0x7ff8dd018fff entry_point = 0x7ff8dcfd0000 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 3124 start_va = 0x7ff8dd900000 end_va = 0x7ff8dd94afff entry_point = 0x7ff8dd900000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 3125 start_va = 0x7ff8e3070000 end_va = 0x7ff8e30f8fff entry_point = 0x7ff8e3070000 region_type = mapped_file name = "directmanipulation.dll" filename = "\\Windows\\System32\\directmanipulation.dll" (normalized: "c:\\windows\\system32\\directmanipulation.dll") Region: id = 3126 start_va = 0x7ff8e86a0000 end_va = 0x7ff8e8851fff entry_point = 0x7ff8e86a0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 3127 start_va = 0x7ff8eac70000 end_va = 0x7ff8ead07fff entry_point = 0x7ff8eac70000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Thread: id = 153 os_tid = 0x854 Thread: id = 154 os_tid = 0x2fc Thread: id = 155 os_tid = 0xcc8 Thread: id = 156 os_tid = 0xb58 Thread: id = 157 os_tid = 0xb14 [0086.482] TranslateMessage (lpMsg=0xe9afef608) returned 0 [0086.482] DispatchMessageW (lpMsg=0xe9afef608) returned 0x1 [0086.487] GetMessageW (in: lpMsg=0xe9afef608, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe9afef608) returned 1 [0086.488] TranslateMessage (lpMsg=0xe9afef608) returned 0 [0086.488] DispatchMessageW (lpMsg=0xe9afef608) returned 0x1 [0086.769] IUnknown_Set (in: ppunk=0xe9b065f60*=0x0, punk=0xe9b0b2b48 | out: ppunk=0xe9b065f60*=0xe9b0b2b48) [0086.770] GetMessageW (in: lpMsg=0xe9afef608, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe9afef608) returned 1 [0086.797] TranslateMessage (lpMsg=0xe9afef608) returned 0 [0086.797] DispatchMessageW (lpMsg=0xe9afef608) returned 0x1 [0086.797] GetMessageW (in: lpMsg=0xe9afef608, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe9afef608) returned 1 [0086.815] TranslateMessage (lpMsg=0xe9afef608) returned 0 [0086.815] DispatchMessageW (lpMsg=0xe9afef608) returned 0x1 [0086.815] Str_SetPtrW (in: ppsz=0xe9b065fa8*=0x0, psz="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: ppsz=0xe9b065fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0086.815] GetMessageW (in: lpMsg=0xe9afef608, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe9afef608) returned 1 [0086.839] TranslateMessage (lpMsg=0xe9afef608) returned 0 [0086.839] DispatchMessageW (lpMsg=0xe9afef608) returned 0x1 [0086.840] GetMessageW (in: lpMsg=0xe9afef608, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe9afef608) returned 1 [0086.875] TranslateMessage (lpMsg=0xe9afef608) returned 0 [0086.875] DispatchMessageW (lpMsg=0xe9afef608) returned 0x1 [0086.877] GetMessageW (in: lpMsg=0xe9afef608, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe9afef608) returned 1 [0086.903] TranslateMessage (lpMsg=0xe9afef608) returned 0 [0086.903] DispatchMessageW (lpMsg=0xe9afef608) returned 0x1 [0086.914] IUnknown_Set (in: ppunk=0xe9b065fc0*=0x0, punk=0xe9b0b7f48 | out: ppunk=0xe9b065fc0*=0xe9b0b7f48) [0086.915] GetMessageW (in: lpMsg=0xe9afef608, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe9afef608) returned 1 [0086.991] TranslateMessage (lpMsg=0xe9afef608) returned 0 [0086.991] DispatchMessageW (lpMsg=0xe9afef608) returned 0x1 [0086.991] GetMessageW (in: lpMsg=0xe9afef608, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe9afef608) returned 1 [0087.004] TranslateMessage (lpMsg=0xe9afef608) returned 0 [0087.004] DispatchMessageW (lpMsg=0xe9afef608) returned 0x1 [0087.005] GetMessageW (in: lpMsg=0xe9afef608, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe9afef608) returned 1 [0087.052] TranslateMessage (lpMsg=0xe9afef608) returned 0 [0087.052] DispatchMessageW (lpMsg=0xe9afef608) returned 0x1 [0087.052] CoTaskMemAlloc (cb=0xa) returned 0xe9b09d730 [0087.121] GetMessageW (in: lpMsg=0xe9afef608, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe9afef608) returned 1 [0087.187] TranslateMessage (lpMsg=0xe9afef608) returned 0 [0087.187] DispatchMessageW (lpMsg=0xe9afef608) returned 0x1 [0087.189] GetMessageW (in: lpMsg=0xe9afef608, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe9afef608) returned 1 [0087.343] TranslateMessage (lpMsg=0xe9afef608) returned 0 [0087.343] DispatchMessageW (lpMsg=0xe9afef608) returned 0x1 [0087.343] GetMessageW (in: lpMsg=0xe9afef608, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe9afef608) returned 1 [0087.357] TranslateMessage (lpMsg=0xe9afef608) returned 0 [0087.357] DispatchMessageW (lpMsg=0xe9afef608) returned 0x1 [0087.357] KillTimer (hWnd=0x0, uIDEvent=0x7f81) returned 1 [0087.357] CompareStringOrdinal (lpString1="InvokeDefaultVerbInOtherProcess", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 1 [0087.357] CoCreateInstance (in: rclsid=0x7ff7bd6575b0*(Data1=0x94b23d4d, Data2=0x1040, Data3=0x4c4b, Data4=([0]=0x90, [1]=0x81, [2]=0x85, [3]=0xd8, [4]=0xd6, [5]=0xfa, [6]=0x36, [7]=0xc4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7bd657a50*(Data1=0xce149b23, Data2=0x5941, Data3=0x4079, Data4=([0]=0x92, [1]=0x23, [2]=0x52, [3]=0xc0, [4]=0xa9, [5]=0x91, [6]=0xec, [7]=0x48)), ppv=0xe9b065fe0 | out: ppv=0xe9b065fe0*=0xe9b069620) returned 0x0 [0087.487] IUnknown_SetSite (punk=0xe9b069620, punkSite=0xe9b065f40) returned 0x0 [0087.488] IUnknown:QueryInterface (This=0xe9b065f40, riid=0x7ff8ee00d438*(Data1=0x114, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xe9afedf50) [0087.488] IUnknown:QueryInterface (This=0xe9b065f40, riid=0x7ff8ee00d468*(Data1=0x79eac9ed, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xe9afedf40) [0087.488] IUnknown:QueryInterface (This=0xe9b065f40, riid=0x7ff8ee00d458*(Data1=0x214e3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xe9afedf48) [0087.488] IUnknown:QueryInterface (This=0xe9b065f40, riid=0x7ff8ee00d448*(Data1=0x45d64a29, Data2=0xa63e, Data3=0x4cb6, Data4=([0]=0xb4, [1]=0x98, [2]=0x57, [3]=0x81, [4]=0xd2, [5]=0x98, [6]=0xcb, [7]=0x4f)), ppvObject=0xe9afedf58) [0087.488] IUnknown:QueryInterface (This=0xe9b065f40, riid=0x7ff8eb8347d8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0xe9afedf80) [0087.488] IUnknown:QueryInterface (in: This=0xe9b0b2b48, riid=0x7ff8de1e0bd8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xe9afedfb0 | out: ppvObject=0xe9afedfb0*=0xe9b0b2b48) returned 0x0 [0087.609] IUnknown:QueryInterface (This=0xe9b065f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe9afedfb0) [0087.609] IUnknown:AddRef (This=0xe9b065f40) returned 0xe [0087.609] IUnknown_QueryService (in: punk=0xe9b0b2b48, guidService=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), riid=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), ppvOut=0xe9b0696e0 | out: ppvOut=0xe9b0696e0*=0x0) returned 0x80004001 [0087.629] IUnknown:Release (This=0xe9b065f40) returned 0xd [0087.629] IUnknown:QueryInterface (This=0xe9b065f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe9afedfb0) [0087.629] IUnknown:AddRef (This=0xe9b065f40) returned 0xe [0087.629] IUnknown_QueryService (in: punk=0xe9b0b2b48, guidService=0x7ff8de1c0980*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), riid=0x7ff8de1c0a40*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), ppvOut=0xe9b0696e8 | out: ppvOut=0xe9b0696e8*=0x0) returned 0x80004001 [0087.630] IUnknown:Release (This=0xe9b065f40) returned 0xd [0087.630] IUnknown:QueryInterface (This=0xe9b065f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe9afedfb0) [0087.630] IUnknown:AddRef (This=0xe9b065f40) returned 0xe [0087.630] IUnknown_QueryService (in: punk=0xe9b0b2b48, guidService=0x7ff8de1c0950*(Data1=0xcde725b0, Data2=0xccc9, Data3=0x4519, Data4=([0]=0x91, [1]=0x7e, [2]=0x32, [3]=0x5d, [4]=0x72, [5]=0xfa, [6]=0xb4, [7]=0xce)), riid=0x7ff8de1d2fb0*(Data1=0x1af3a467, Data2=0x214f, Data3=0x4298, Data4=([0]=0x90, [1]=0x8e, [2]=0x6, [3]=0xb0, [4]=0x3e, [5]=0xb, [6]=0x39, [7]=0xf9)), ppvOut=0xe9b0696f0 | out: ppvOut=0xe9b0696f0*=0x0) returned 0x80004001 [0087.631] IUnknown:Release (This=0xe9b065f40) returned 0xd [0087.631] IUnknown:QueryInterface (This=0xe9b065f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe9afedfb0) [0087.631] IUnknown:AddRef (This=0xe9b065f40) returned 0xe [0087.631] IUnknown_QueryService (in: punk=0xe9b0b2b48, guidService=0x7ff8de1c0800*(Data1=0x80605492, Data2=0x67d9, Data3=0x414f, Data4=([0]=0xaf, [1]=0x89, [2]=0xa1, [3]=0xcd, [4]=0xf1, [5]=0x24, [6]=0x2b, [7]=0xc1)), riid=0x7ff8de1c0068*(Data1=0xe5aa01f7, Data2=0x1fb8, Data3=0x4830, Data4=([0]=0x87, [1]=0x20, [2]=0x4e, [3]=0x67, [4]=0x34, [5]=0xcb, [6]=0xd5, [7]=0xf3)), ppvOut=0xe9b0696f8 | out: ppvOut=0xe9b0696f8*=0x0) returned 0x80004001 [0087.632] IUnknown:Release (This=0xe9b065f40) returned 0xd [0087.632] IUnknown:QueryInterface (This=0xe9b065f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe9afedfb0) [0087.632] IUnknown:AddRef (This=0xe9b065f40) returned 0xe [0087.632] IUnknown_QueryService (in: punk=0xe9b0b2b48, guidService=0x7ff8de1c0810*(Data1=0x2ce78010, Data2=0x74db, Data3=0x48bc, Data4=([0]=0x9c, [1]=0x6a, [2]=0x10, [3]=0xf3, [4]=0x72, [5]=0x49, [6]=0x57, [7]=0x23)), riid=0x7ff8de1bfb70*(Data1=0x989191ac, Data2=0x28ff, Data3=0x4cf0, Data4=([0]=0x95, [1]=0x84, [2]=0xe0, [3]=0xd0, [4]=0x78, [5]=0xbc, [6]=0x23, [7]=0x96)), ppvOut=0xe9b069700 | out: ppvOut=0xe9b069700*=0x0) returned 0x80004001 [0087.633] IUnknown:Release (This=0xe9b065f40) returned 0xd [0087.633] IUnknown:QueryInterface (This=0xe9b065f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe9afedfb0) [0087.633] IUnknown:AddRef (This=0xe9b065f40) returned 0xe [0087.633] IUnknown_QueryService (in: punk=0xe9b0b2b48, guidService=0x7ff8de1c0078*(Data1=0x26db2472, Data2=0xb7b7, Data3=0x406b, Data4=([0]=0x97, [1]=0x2, [2]=0x73, [3]=0xa, [4]=0x4e, [5]=0x20, [6]=0xd3, [7]=0xbf)), riid=0x7ff8de1c0a10*(Data1=0x2f0666c6, Data2=0x12f7, Data3=0x4360, Data4=([0]=0xb5, [1]=0x11, [2]=0xa3, [3]=0x94, [4]=0xa0, [5]=0x55, [6]=0x37, [7]=0x25)), ppvOut=0xe9b069708 | out: ppvOut=0xe9b069708*=0x0) returned 0x80004001 [0087.634] IUnknown:Release (This=0xe9b065f40) returned 0xd [0087.634] IUnknown:QueryInterface (This=0xe9b065f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe9afedfb0) [0087.634] IUnknown:AddRef (This=0xe9b065f40) returned 0xe [0087.634] IUnknown_QueryService (in: punk=0xe9b0b2b48, guidService=0x7ff8de1c0930*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), riid=0x7ff8de1c0a30*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), ppvOut=0xe9b069bf0 | out: ppvOut=0xe9b069bf0*=0x0) returned 0x80004001 [0087.635] IUnknown:Release (This=0xe9b065f40) returned 0xd [0087.635] IUnknown:QueryInterface (This=0xe9b065f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xe9afedfb0) [0087.635] IUnknown:AddRef (This=0xe9b065f40) returned 0xe [0087.635] IUnknown_QueryService (in: punk=0xe9b0b2b48, guidService=0x7ff8de27c2c0*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff8de27fc98*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xe9afedff0 | out: ppvOut=0xe9afedff0*=0x0) returned 0x80004001 [0087.636] IUnknown:Release (This=0xe9b065f40) returned 0xd [0087.636] IUnknown:AddRef (This=0xe9b065f40) returned 0xe [0087.636] GetCurrentThreadId () returned 0xb14 [0087.636] PostThreadMessageW (idThread=0xb14, Msg=0x8001, wParam=0x0, lParam=0x0) returned 1 [0087.636] GetMessageW (in: lpMsg=0xe9afef608, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe9afef608) returned 1 [0087.636] CompareStringOrdinal (lpString1="openas", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0087.636] CompareStringOrdinal (lpString1="OpenWithSetDefaultOn", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0087.636] IUnknown_QueryService (in: punk=0xe9b0b2b48, guidService=0x7ff7bd657da0*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), riid=0x7ff7bd657910*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), ppvOut=0xe9afef698 | out: ppvOut=0xe9afef698*=0xe9b0bc3e8) returned 0x0 [0087.666] IUnknown_Set (in: ppunk=0xe9b065f60*=0xe9b0b2b48, punk=0x0 | out: ppunk=0xe9b065f60*=0x0) [0087.669] IUnknown_QueryService (in: punk=0x0, guidService=0x7ff7bd657d60*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff7bd657950*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xe9afef5e8 | out: ppvOut=0xe9afef5e8*=0x0) returned 0x80004001 [0087.669] QISearch (in: that=0xe9b065f30, pqit=0x7ff7bd657970, riid=0x7ff7bd657ac0*(Data1=0x1c9cd5bb, Data2=0x98e9, Data3=0x4491, Data4=([0]=0xa6, [1]=0xf, [2]=0x31, [3]=0xaa, [4]=0xcc, [5]=0x72, [6]=0xb8, [7]=0x3c)), ppv=0xe9afef548 | out: that=0xe9b065f30, ppv=0xe9afef548*=0xe9b065f78) returned 0x0 [0087.669] IUnknown:QueryInterface (in: This=0xe9b0b7f48, riid=0x7ff7bd657930*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xe9afef5e0 | out: ppvObject=0xe9afef5e0*=0xe9b0b7f48) returned 0x0 [0087.669] IShellItemArray:GetItemAt (in: This=0xe9b0b7f48, dwIndex=0x0, ppsi=0xe9afef5d0 | out: ppsi=0xe9afef5d0*=0xe9b0b2a28) returned 0x0 [0087.670] IUnknown:QueryInterface (in: This=0xe9b0b2a28, riid=0x7ff7bd657b10*(Data1=0x7e9fb0d3, Data2=0x919f, Data3=0x4307, Data4=([0]=0xab, [1]=0x2e, [2]=0x9b, [3]=0x18, [4]=0x60, [5]=0x31, [6]=0xc, [7]=0x93)), ppvObject=0xe9afef5d8 | out: ppvObject=0xe9afef5d8*=0xe9b0b2a28) returned 0x0 [0087.670] IUnknown:Release (This=0xe9b0b2a28) returned 0x1 [0087.670] IShellItem:BindToHandler (in: This=0xe9b0b2a28, pbc=0x0, bhid=0x7ff7bd657db0, riid=0x7ff7bd657920, ppv=0xe9afef5d0 | out: ppv=0xe9afef5d0) returned 0x0 [0087.676] IUnknown:Release (This=0xe9b0b2a28) returned 0x0 [0087.676] IUnknown:Release (This=0xe9b0b7f48) returned 0x1 [0087.676] IUnknown:AddRef (This=0xe9b065f78) returned 0xf [0087.676] IObjectWithSelection:GetSelection (in: This=0xe9b065f78, riid=0x7ff8de1c76a8, ppv=0xe9b069718 | out: ppv=0xe9b069718) returned 0x0 [0087.676] IUnknown:QueryInterface (in: This=0xe9b0b7f48, riid=0x7ff8de1c76a8*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xe9b069718 | out: ppvObject=0xe9b069718*=0xe9b0b7f48) returned 0x0 [0087.676] IUnknown:Release (This=0xe9b065f78) returned 0xe [0087.729] IUnknown:Release (This=0xe9b065f78) returned 0x7 [0087.729] IUnknown:Release (This=0xe9b065f78) returned 0x6 [0110.981] IUnknown:Release (This=0xe9b0b7f48) returned 0x1 [0110.981] IUnknown_SetSite (punk=0xe9b069620, punkSite=0x0) returned 0x0 [0110.981] IUnknown:Release (This=0xe9b065f40) returned 0x2 [0110.981] PostQuitMessage (nExitCode=0) [0110.981] TranslateMessage (lpMsg=0xe9afef608) returned 0 [0110.981] DispatchMessageW (lpMsg=0xe9afef608) returned 0x0 [0110.981] GetMessageW (in: lpMsg=0xe9afef608, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe9afef608) returned 0 [0110.981] CoRevokeClassObject (dwRegister=0x10) returned 0x0 [0111.273] IUnknown:Release (This=0xe9b069620) returned 0x0 [0111.436] CoTaskMemFree (pv=0xe9b09d730) [0111.436] Str_SetPtrW (in: ppsz=0xe9b065fa0*=0x0, psz=0x0 | out: ppsz=0xe9b065fa0*=0x0) returned 1 [0111.436] Str_SetPtrW (in: ppsz=0xe9b065fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop", psz=0x0 | out: ppsz=0xe9b065fa8*=0x0) returned 1 [0111.436] SHSetThreadRef (punk=0x0) returned 0x0 [0111.436] CoUninitialize () [0111.491] LocalFree (hMem=0xe9b08b710) returned 0x0 [0111.491] EtwEventUnregister (RegHandle=0x28000e9b090230) returned 0x0 [0111.492] exit (_Code=0) Thread: id = 158 os_tid = 0xce0 Thread: id = 173 os_tid = 0x7a8 Thread: id = 174 os_tid = 0xb84 Thread: id = 175 os_tid = 0x3a8 Thread: id = 176 os_tid = 0xde4 Thread: id = 177 os_tid = 0xde0 Thread: id = 178 os_tid = 0xdc0 Thread: id = 261 os_tid = 0x744 Thread: id = 262 os_tid = 0x5d8 Process: id = "12" image_name = "openwith.exe" filename = "c:\\windows\\system32\\openwith.exe" page_root = "0x25b99000" os_pid = "0x898" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xdd4" cmd_line = "C:\\Windows\\system32\\OpenWith.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1888 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1889 start_va = 0x59ac500000 end_va = 0x59ac50ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059ac500000" filename = "" Region: id = 1890 start_va = 0x59ac510000 end_va = 0x59ac516fff entry_point = 0x0 region_type = private name = "private_0x00000059ac510000" filename = "" Region: id = 1891 start_va = 0x59ac520000 end_va = 0x59ac533fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059ac520000" filename = "" Region: id = 1892 start_va = 0x59ac540000 end_va = 0x59ac5bffff entry_point = 0x0 region_type = private name = "private_0x00000059ac540000" filename = "" Region: id = 1893 start_va = 0x59ac5c0000 end_va = 0x59ac5c3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059ac5c0000" filename = "" Region: id = 1894 start_va = 0x59ac5d0000 end_va = 0x59ac5d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059ac5d0000" filename = "" Region: id = 1895 start_va = 0x59ac5e0000 end_va = 0x59ac5e1fff entry_point = 0x0 region_type = private name = "private_0x00000059ac5e0000" filename = "" Region: id = 1896 start_va = 0x59ac5f0000 end_va = 0x59ac5f6fff entry_point = 0x0 region_type = private name = "private_0x00000059ac5f0000" filename = "" Region: id = 1897 start_va = 0x59ac600000 end_va = 0x59ac600fff entry_point = 0x59ac600000 region_type = mapped_file name = "openwith.exe.mui" filename = "\\Windows\\System32\\en-US\\OpenWith.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\openwith.exe.mui") Region: id = 1898 start_va = 0x59ac610000 end_va = 0x59ac610fff entry_point = 0x0 region_type = private name = "private_0x00000059ac610000" filename = "" Region: id = 1899 start_va = 0x59ac620000 end_va = 0x59ac620fff entry_point = 0x0 region_type = private name = "private_0x00000059ac620000" filename = "" Region: id = 1900 start_va = 0x59ac630000 end_va = 0x59ac630fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059ac630000" filename = "" Region: id = 1901 start_va = 0x59ac640000 end_va = 0x59ac641fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059ac640000" filename = "" Region: id = 1902 start_va = 0x59ac660000 end_va = 0x59ac75ffff entry_point = 0x0 region_type = private name = "private_0x00000059ac660000" filename = "" Region: id = 1903 start_va = 0x59ac760000 end_va = 0x59ac81dfff entry_point = 0x59ac760000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1904 start_va = 0x59ac820000 end_va = 0x59ac89ffff entry_point = 0x0 region_type = private name = "private_0x00000059ac820000" filename = "" Region: id = 1905 start_va = 0x59ac8a0000 end_va = 0x59aca27fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059ac8a0000" filename = "" Region: id = 1906 start_va = 0x59aca30000 end_va = 0x59acaaffff entry_point = 0x0 region_type = private name = "private_0x00000059aca30000" filename = "" Region: id = 1907 start_va = 0x59acab0000 end_va = 0x59acabffff entry_point = 0x0 region_type = private name = "private_0x00000059acab0000" filename = "" Region: id = 1908 start_va = 0x59acac0000 end_va = 0x59acb3ffff entry_point = 0x0 region_type = private name = "private_0x00000059acac0000" filename = "" Region: id = 1909 start_va = 0x59acb70000 end_va = 0x59acb7ffff entry_point = 0x0 region_type = private name = "private_0x00000059acb70000" filename = "" Region: id = 1910 start_va = 0x59acb80000 end_va = 0x59acd00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059acb80000" filename = "" Region: id = 1911 start_va = 0x59acd10000 end_va = 0x59ae10ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059acd10000" filename = "" Region: id = 1912 start_va = 0x59ae110000 end_va = 0x59ae446fff entry_point = 0x59ae110000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1913 start_va = 0x59ae450000 end_va = 0x59ae4cffff entry_point = 0x0 region_type = private name = "private_0x00000059ae450000" filename = "" Region: id = 1914 start_va = 0x59ae4d0000 end_va = 0x59ae54ffff entry_point = 0x0 region_type = private name = "private_0x00000059ae4d0000" filename = "" Region: id = 1915 start_va = 0x7df5fff10000 end_va = 0x7ff5fff0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fff10000" filename = "" Region: id = 1916 start_va = 0x7ff7bcc60000 end_va = 0x7ff7bcd5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bcc60000" filename = "" Region: id = 1917 start_va = 0x7ff7bcd60000 end_va = 0x7ff7bcd82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bcd60000" filename = "" Region: id = 1918 start_va = 0x7ff7bcd83000 end_va = 0x7ff7bcd84fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcd83000" filename = "" Region: id = 1919 start_va = 0x7ff7bcd85000 end_va = 0x7ff7bcd86fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcd85000" filename = "" Region: id = 1920 start_va = 0x7ff7bcd87000 end_va = 0x7ff7bcd87fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcd87000" filename = "" Region: id = 1921 start_va = 0x7ff7bcd88000 end_va = 0x7ff7bcd89fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcd88000" filename = "" Region: id = 1922 start_va = 0x7ff7bcd8a000 end_va = 0x7ff7bcd8bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcd8a000" filename = "" Region: id = 1923 start_va = 0x7ff7bcd8c000 end_va = 0x7ff7bcd8dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcd8c000" filename = "" Region: id = 1924 start_va = 0x7ff7bcd8e000 end_va = 0x7ff7bcd8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcd8e000" filename = "" Region: id = 1925 start_va = 0x7ff7bd650000 end_va = 0x7ff7bd669fff entry_point = 0x7ff7bd650000 region_type = mapped_file name = "openwith.exe" filename = "\\Windows\\System32\\OpenWith.exe" (normalized: "c:\\windows\\system32\\openwith.exe") Region: id = 1926 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1927 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 1928 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1929 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1930 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1931 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1932 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1933 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1934 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1935 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1936 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1937 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1938 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1939 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1940 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1941 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1942 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1943 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1944 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1945 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1946 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1947 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1948 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1949 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1950 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1951 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1952 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1953 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1954 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1955 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1956 start_va = 0x59ac650000 end_va = 0x59ac650fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059ac650000" filename = "" Region: id = 1957 start_va = 0x59acb40000 end_va = 0x59acb40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059acb40000" filename = "" Region: id = 1958 start_va = 0x7ff8ddbd0000 end_va = 0x7ff8de6dcfff entry_point = 0x7ff8ddbd0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 1959 start_va = 0x7ff8e9860000 end_va = 0x7ff8e994dfff entry_point = 0x7ff8e9860000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1960 start_va = 0x7ff8e3a70000 end_va = 0x7ff8e3c26fff entry_point = 0x7ff8e3a70000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 1961 start_va = 0x59acb50000 end_va = 0x59acb52fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059acb50000" filename = "" Region: id = 1962 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1963 start_va = 0x7ff8e7430000 end_va = 0x7ff8e7560fff entry_point = 0x7ff8e7430000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1964 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2215 start_va = 0x59acb60000 end_va = 0x59acb60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059acb60000" filename = "" Region: id = 2216 start_va = 0x59ae550000 end_va = 0x59ae579fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059ae550000" filename = "" Region: id = 2217 start_va = 0x59ae580000 end_va = 0x59ae581fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059ae580000" filename = "" Region: id = 2218 start_va = 0x59ae590000 end_va = 0x59ae60ffff entry_point = 0x0 region_type = private name = "private_0x00000059ae590000" filename = "" Region: id = 2219 start_va = 0x59ae610000 end_va = 0x59ae68ffff entry_point = 0x0 region_type = private name = "private_0x00000059ae610000" filename = "" Region: id = 2220 start_va = 0x59ae690000 end_va = 0x59ae691fff entry_point = 0x59ae690000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 2221 start_va = 0x59ae6a0000 end_va = 0x59ae6a3fff entry_point = 0x59ae6a0000 region_type = mapped_file name = "windows.ui.immersive.dll.mui" filename = "\\Windows\\System32\\en-US\\Windows.UI.Immersive.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.ui.immersive.dll.mui") Region: id = 2222 start_va = 0x59ae6b0000 end_va = 0x59ae72ffff entry_point = 0x0 region_type = private name = "private_0x00000059ae6b0000" filename = "" Region: id = 2223 start_va = 0x59ae730000 end_va = 0x59ae82ffff entry_point = 0x0 region_type = private name = "private_0x00000059ae730000" filename = "" Region: id = 2224 start_va = 0x59ae830000 end_va = 0x59ae830fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059ae830000" filename = "" Region: id = 2225 start_va = 0x59ae840000 end_va = 0x59ae840fff entry_point = 0x0 region_type = private name = "private_0x00000059ae840000" filename = "" Region: id = 2226 start_va = 0x59ae850000 end_va = 0x59ae850fff entry_point = 0x0 region_type = private name = "private_0x00000059ae850000" filename = "" Region: id = 2227 start_va = 0x59ae860000 end_va = 0x59ae8dffff entry_point = 0x0 region_type = private name = "private_0x00000059ae860000" filename = "" Region: id = 2228 start_va = 0x59ae8e0000 end_va = 0x59ae8e0fff entry_point = 0x0 region_type = private name = "private_0x00000059ae8e0000" filename = "" Region: id = 2229 start_va = 0x59ae8f0000 end_va = 0x59ae8f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059ae8f0000" filename = "" Region: id = 2230 start_va = 0x59ae900000 end_va = 0x59ae913fff entry_point = 0x59ae900000 region_type = mapped_file name = "twinui.dll.mui" filename = "\\Windows\\System32\\en-US\\twinui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\twinui.dll.mui") Region: id = 2231 start_va = 0x59ae920000 end_va = 0x59ae921fff entry_point = 0x59ae920000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 2232 start_va = 0x59ae930000 end_va = 0x59ae934fff entry_point = 0x59ae930000 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 2233 start_va = 0x59ae940000 end_va = 0x59aea3ffff entry_point = 0x0 region_type = private name = "private_0x00000059ae940000" filename = "" Region: id = 2234 start_va = 0x7ff7bcc58000 end_va = 0x7ff7bcc59fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcc58000" filename = "" Region: id = 2235 start_va = 0x7ff7bcc5a000 end_va = 0x7ff7bcc5bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcc5a000" filename = "" Region: id = 2236 start_va = 0x7ff7bcc5c000 end_va = 0x7ff7bcc5dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcc5c000" filename = "" Region: id = 2237 start_va = 0x7ff7bcc5e000 end_va = 0x7ff7bcc5ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcc5e000" filename = "" Region: id = 2238 start_va = 0x7ff8d1180000 end_va = 0x7ff8d132ffff entry_point = 0x7ff8d1180000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 2239 start_va = 0x7ff8d1330000 end_va = 0x7ff8d147bfff entry_point = 0x7ff8d1330000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 2240 start_va = 0x7ff8d76a0000 end_va = 0x7ff8d7738fff entry_point = 0x7ff8d76a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 2241 start_va = 0x7ff8debc0000 end_va = 0x7ff8dec28fff entry_point = 0x7ff8debc0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 2242 start_va = 0x7ff8e37f0000 end_va = 0x7ff8e3a48fff entry_point = 0x7ff8e37f0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 2243 start_va = 0x7ff8e8650000 end_va = 0x7ff8e869afff entry_point = 0x7ff8e8650000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 2244 start_va = 0x7ff8e8860000 end_va = 0x7ff8e8acdfff entry_point = 0x7ff8e8860000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 2245 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 2246 start_va = 0x7ff8e8c60000 end_va = 0x7ff8e8cfbfff entry_point = 0x7ff8e8c60000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2247 start_va = 0x7ff8e8d00000 end_va = 0x7ff8e8fa2fff entry_point = 0x7ff8e8d00000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 2248 start_va = 0x7ff8e9130000 end_va = 0x7ff8e9200fff entry_point = 0x7ff8e9130000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 2249 start_va = 0x59aea50000 end_va = 0x59aea62fff entry_point = 0x59aea50000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 2250 start_va = 0x59aea70000 end_va = 0x59aea70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000059aea70000" filename = "" Region: id = 2251 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2252 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 2253 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 2254 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2255 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 2256 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 2257 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Thread: id = 166 os_tid = 0x430 Thread: id = 167 os_tid = 0x7b4 Thread: id = 168 os_tid = 0x41c Thread: id = 169 os_tid = 0xd3c Thread: id = 170 os_tid = 0x128 [0090.149] TranslateMessage (lpMsg=0x59ac5bfab8) returned 0 [0090.149] DispatchMessageW (lpMsg=0x59ac5bfab8) returned 0x1 [0090.154] GetMessageW (in: lpMsg=0x59ac5bfab8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x59ac5bfab8) returned 1 [0090.154] TranslateMessage (lpMsg=0x59ac5bfab8) returned 0 [0090.154] DispatchMessageW (lpMsg=0x59ac5bfab8) returned 0x1 [0090.542] IUnknown_Set (in: ppunk=0x59acb75f60*=0x0, punk=0x59ac692ad8 | out: ppunk=0x59acb75f60*=0x59ac692ad8) [0090.543] GetMessageW (in: lpMsg=0x59ac5bfab8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x59ac5bfab8) returned 1 [0090.613] TranslateMessage (lpMsg=0x59ac5bfab8) returned 0 [0090.613] DispatchMessageW (lpMsg=0x59ac5bfab8) returned 0x1 [0090.614] GetMessageW (in: lpMsg=0x59ac5bfab8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x59ac5bfab8) returned 1 [0090.643] TranslateMessage (lpMsg=0x59ac5bfab8) returned 0 [0090.643] DispatchMessageW (lpMsg=0x59ac5bfab8) returned 0x1 [0090.644] Str_SetPtrW (in: ppsz=0x59acb75fa8*=0x0, psz="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: ppsz=0x59acb75fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0090.644] GetMessageW (in: lpMsg=0x59ac5bfab8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x59ac5bfab8) returned 1 [0090.675] TranslateMessage (lpMsg=0x59ac5bfab8) returned 0 [0090.675] DispatchMessageW (lpMsg=0x59ac5bfab8) returned 0x1 [0090.676] GetMessageW (in: lpMsg=0x59ac5bfab8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x59ac5bfab8) returned 1 [0090.693] TranslateMessage (lpMsg=0x59ac5bfab8) returned 0 [0090.693] DispatchMessageW (lpMsg=0x59ac5bfab8) returned 0x1 [0090.695] GetMessageW (in: lpMsg=0x59ac5bfab8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x59ac5bfab8) returned 1 [0090.754] TranslateMessage (lpMsg=0x59ac5bfab8) returned 0 [0090.754] DispatchMessageW (lpMsg=0x59ac5bfab8) returned 0x1 [0090.767] IUnknown_Set (in: ppunk=0x59acb75fc0*=0x0, punk=0x59ac697f48 | out: ppunk=0x59acb75fc0*=0x59ac697f48) [0090.767] GetMessageW (in: lpMsg=0x59ac5bfab8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x59ac5bfab8) returned 1 [0090.882] TranslateMessage (lpMsg=0x59ac5bfab8) returned 0 [0090.882] DispatchMessageW (lpMsg=0x59ac5bfab8) returned 0x1 [0090.882] GetMessageW (in: lpMsg=0x59ac5bfab8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x59ac5bfab8) returned 1 [0090.919] TranslateMessage (lpMsg=0x59ac5bfab8) returned 0 [0090.919] DispatchMessageW (lpMsg=0x59ac5bfab8) returned 0x1 [0090.920] GetMessageW (in: lpMsg=0x59ac5bfab8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x59ac5bfab8) returned 1 [0091.004] TranslateMessage (lpMsg=0x59ac5bfab8) returned 0 [0091.004] DispatchMessageW (lpMsg=0x59ac5bfab8) returned 0x1 [0091.005] CoTaskMemAlloc (cb=0xa) returned 0x59ac67d770 [0091.049] GetMessageW (in: lpMsg=0x59ac5bfab8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x59ac5bfab8) returned 1 [0091.074] TranslateMessage (lpMsg=0x59ac5bfab8) returned 0 [0091.074] DispatchMessageW (lpMsg=0x59ac5bfab8) returned 0x1 [0091.075] GetMessageW (in: lpMsg=0x59ac5bfab8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x59ac5bfab8) returned 1 [0091.114] TranslateMessage (lpMsg=0x59ac5bfab8) returned 0 [0091.114] DispatchMessageW (lpMsg=0x59ac5bfab8) returned 0x1 [0091.115] GetMessageW (in: lpMsg=0x59ac5bfab8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x59ac5bfab8) returned 1 [0091.152] TranslateMessage (lpMsg=0x59ac5bfab8) returned 0 [0091.152] DispatchMessageW (lpMsg=0x59ac5bfab8) returned 0x1 [0091.152] KillTimer (hWnd=0x0, uIDEvent=0x7f7c) returned 1 [0091.152] CompareStringOrdinal (lpString1="InvokeDefaultVerbInOtherProcess", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 1 [0091.152] CoCreateInstance (in: rclsid=0x7ff7bd6575b0*(Data1=0x94b23d4d, Data2=0x1040, Data3=0x4c4b, Data4=([0]=0x90, [1]=0x81, [2]=0x85, [3]=0xd8, [4]=0xd6, [5]=0xfa, [6]=0x36, [7]=0xc4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7bd657a50*(Data1=0xce149b23, Data2=0x5941, Data3=0x4079, Data4=([0]=0x92, [1]=0x23, [2]=0x52, [3]=0xc0, [4]=0xa9, [5]=0x91, [6]=0xec, [7]=0x48)), ppv=0x59acb75fe0 | out: ppv=0x59acb75fe0*=0x59acb79620) returned 0x0 [0091.201] IUnknown_SetSite (punk=0x59acb79620, punkSite=0x59acb75f40) returned 0x0 [0091.201] IUnknown:QueryInterface (This=0x59acb75f40, riid=0x7ff8ee00d438*(Data1=0x114, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ac5be400) [0091.201] IUnknown:QueryInterface (This=0x59acb75f40, riid=0x7ff8ee00d468*(Data1=0x79eac9ed, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x59ac5be3f0) [0091.201] IUnknown:QueryInterface (This=0x59acb75f40, riid=0x7ff8ee00d458*(Data1=0x214e3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ac5be3f8) [0091.201] IUnknown:QueryInterface (This=0x59acb75f40, riid=0x7ff8ee00d448*(Data1=0x45d64a29, Data2=0xa63e, Data3=0x4cb6, Data4=([0]=0xb4, [1]=0x98, [2]=0x57, [3]=0x81, [4]=0xd2, [5]=0x98, [6]=0xcb, [7]=0x4f)), ppvObject=0x59ac5be408) [0091.202] IUnknown:QueryInterface (This=0x59acb75f40, riid=0x7ff8eb8347d8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x59ac5be430) [0091.202] IUnknown:QueryInterface (in: This=0x59ac692ad8, riid=0x7ff8de1e0bd8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ac5be460 | out: ppvObject=0x59ac5be460*=0x59ac692ad8) returned 0x0 [0091.319] IUnknown:QueryInterface (This=0x59acb75f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x59ac5be460) [0091.319] IUnknown:AddRef (This=0x59acb75f40) returned 0xe [0091.319] IUnknown_QueryService (in: punk=0x59ac692ad8, guidService=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), riid=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), ppvOut=0x59acb796e0 | out: ppvOut=0x59acb796e0*=0x0) returned 0x80004001 [0091.365] IUnknown:Release (This=0x59acb75f40) returned 0xd [0091.365] IUnknown:QueryInterface (This=0x59acb75f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x59ac5be460) [0091.365] IUnknown:AddRef (This=0x59acb75f40) returned 0xe [0091.365] IUnknown_QueryService (in: punk=0x59ac692ad8, guidService=0x7ff8de1c0980*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), riid=0x7ff8de1c0a40*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), ppvOut=0x59acb796e8 | out: ppvOut=0x59acb796e8*=0x0) returned 0x80004001 [0091.366] IUnknown:Release (This=0x59acb75f40) returned 0xd [0091.366] IUnknown:QueryInterface (This=0x59acb75f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x59ac5be460) [0091.366] IUnknown:AddRef (This=0x59acb75f40) returned 0xe [0091.366] IUnknown_QueryService (in: punk=0x59ac692ad8, guidService=0x7ff8de1c0950*(Data1=0xcde725b0, Data2=0xccc9, Data3=0x4519, Data4=([0]=0x91, [1]=0x7e, [2]=0x32, [3]=0x5d, [4]=0x72, [5]=0xfa, [6]=0xb4, [7]=0xce)), riid=0x7ff8de1d2fb0*(Data1=0x1af3a467, Data2=0x214f, Data3=0x4298, Data4=([0]=0x90, [1]=0x8e, [2]=0x6, [3]=0xb0, [4]=0x3e, [5]=0xb, [6]=0x39, [7]=0xf9)), ppvOut=0x59acb796f0 | out: ppvOut=0x59acb796f0*=0x0) returned 0x80004001 [0091.367] IUnknown:Release (This=0x59acb75f40) returned 0xd [0091.367] IUnknown:QueryInterface (This=0x59acb75f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x59ac5be460) [0091.367] IUnknown:AddRef (This=0x59acb75f40) returned 0xe [0091.367] IUnknown_QueryService (in: punk=0x59ac692ad8, guidService=0x7ff8de1c0800*(Data1=0x80605492, Data2=0x67d9, Data3=0x414f, Data4=([0]=0xaf, [1]=0x89, [2]=0xa1, [3]=0xcd, [4]=0xf1, [5]=0x24, [6]=0x2b, [7]=0xc1)), riid=0x7ff8de1c0068*(Data1=0xe5aa01f7, Data2=0x1fb8, Data3=0x4830, Data4=([0]=0x87, [1]=0x20, [2]=0x4e, [3]=0x67, [4]=0x34, [5]=0xcb, [6]=0xd5, [7]=0xf3)), ppvOut=0x59acb796f8 | out: ppvOut=0x59acb796f8*=0x0) returned 0x80004001 [0091.368] IUnknown:Release (This=0x59acb75f40) returned 0xd [0091.368] IUnknown:QueryInterface (This=0x59acb75f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x59ac5be460) [0091.368] IUnknown:AddRef (This=0x59acb75f40) returned 0xe [0091.368] IUnknown_QueryService (in: punk=0x59ac692ad8, guidService=0x7ff8de1c0810*(Data1=0x2ce78010, Data2=0x74db, Data3=0x48bc, Data4=([0]=0x9c, [1]=0x6a, [2]=0x10, [3]=0xf3, [4]=0x72, [5]=0x49, [6]=0x57, [7]=0x23)), riid=0x7ff8de1bfb70*(Data1=0x989191ac, Data2=0x28ff, Data3=0x4cf0, Data4=([0]=0x95, [1]=0x84, [2]=0xe0, [3]=0xd0, [4]=0x78, [5]=0xbc, [6]=0x23, [7]=0x96)), ppvOut=0x59acb79700 | out: ppvOut=0x59acb79700*=0x0) returned 0x80004001 [0091.368] IUnknown:Release (This=0x59acb75f40) returned 0xd [0091.369] IUnknown:QueryInterface (This=0x59acb75f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x59ac5be460) [0091.369] IUnknown:AddRef (This=0x59acb75f40) returned 0xe [0091.369] IUnknown_QueryService (in: punk=0x59ac692ad8, guidService=0x7ff8de1c0078*(Data1=0x26db2472, Data2=0xb7b7, Data3=0x406b, Data4=([0]=0x97, [1]=0x2, [2]=0x73, [3]=0xa, [4]=0x4e, [5]=0x20, [6]=0xd3, [7]=0xbf)), riid=0x7ff8de1c0a10*(Data1=0x2f0666c6, Data2=0x12f7, Data3=0x4360, Data4=([0]=0xb5, [1]=0x11, [2]=0xa3, [3]=0x94, [4]=0xa0, [5]=0x55, [6]=0x37, [7]=0x25)), ppvOut=0x59acb79708 | out: ppvOut=0x59acb79708*=0x0) returned 0x80004001 [0091.369] IUnknown:Release (This=0x59acb75f40) returned 0xd [0091.369] IUnknown:QueryInterface (This=0x59acb75f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x59ac5be460) [0091.369] IUnknown:AddRef (This=0x59acb75f40) returned 0xe [0091.369] IUnknown_QueryService (in: punk=0x59ac692ad8, guidService=0x7ff8de1c0930*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), riid=0x7ff8de1c0a30*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), ppvOut=0x59acb79bf0 | out: ppvOut=0x59acb79bf0*=0x0) returned 0x80004001 [0091.370] IUnknown:Release (This=0x59acb75f40) returned 0xd [0091.370] IUnknown:QueryInterface (This=0x59acb75f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x59ac5be460) [0091.370] IUnknown:AddRef (This=0x59acb75f40) returned 0xe [0091.370] IUnknown_QueryService (in: punk=0x59ac692ad8, guidService=0x7ff8de27c2c0*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff8de27fc98*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0x59ac5be4a0 | out: ppvOut=0x59ac5be4a0*=0x0) returned 0x80004001 [0091.371] IUnknown:Release (This=0x59acb75f40) returned 0xd [0091.371] IUnknown:AddRef (This=0x59acb75f40) returned 0xe [0091.371] GetCurrentThreadId () returned 0x128 [0091.371] PostThreadMessageW (idThread=0x128, Msg=0x8001, wParam=0x0, lParam=0x0) returned 1 [0091.372] GetMessageW (in: lpMsg=0x59ac5bfab8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x59ac5bfab8) returned 1 [0091.372] CompareStringOrdinal (lpString1="openas", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0091.372] CompareStringOrdinal (lpString1="OpenWithSetDefaultOn", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0091.372] IUnknown_QueryService (in: punk=0x59ac692ad8, guidService=0x7ff7bd657da0*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), riid=0x7ff7bd657910*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), ppvOut=0x59ac5bfb48 | out: ppvOut=0x59ac5bfb48*=0x59ac69c1b8) returned 0x0 [0091.405] IUnknown_Set (in: ppunk=0x59acb75f60*=0x59ac692ad8, punk=0x0 | out: ppunk=0x59acb75f60*=0x0) [0091.409] IUnknown_QueryService (in: punk=0x0, guidService=0x7ff7bd657d60*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff7bd657950*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0x59ac5bfa98 | out: ppvOut=0x59ac5bfa98*=0x0) returned 0x80004001 [0091.409] QISearch (in: that=0x59acb75f30, pqit=0x7ff7bd657970, riid=0x7ff7bd657ac0*(Data1=0x1c9cd5bb, Data2=0x98e9, Data3=0x4491, Data4=([0]=0xa6, [1]=0xf, [2]=0x31, [3]=0xaa, [4]=0xcc, [5]=0x72, [6]=0xb8, [7]=0x3c)), ppv=0x59ac5bf9f8 | out: that=0x59acb75f30, ppv=0x59ac5bf9f8*=0x59acb75f78) returned 0x0 [0091.409] IUnknown:QueryInterface (in: This=0x59ac697f48, riid=0x7ff7bd657930*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0x59ac5bfa90 | out: ppvObject=0x59ac5bfa90*=0x59ac697f48) returned 0x0 [0091.409] IShellItemArray:GetItemAt (in: This=0x59ac697f48, dwIndex=0x0, ppsi=0x59ac5bfa80 | out: ppsi=0x59ac5bfa80*=0x59ac6929b8) returned 0x0 [0091.409] IUnknown:QueryInterface (in: This=0x59ac6929b8, riid=0x7ff7bd657b10*(Data1=0x7e9fb0d3, Data2=0x919f, Data3=0x4307, Data4=([0]=0xab, [1]=0x2e, [2]=0x9b, [3]=0x18, [4]=0x60, [5]=0x31, [6]=0xc, [7]=0x93)), ppvObject=0x59ac5bfa88 | out: ppvObject=0x59ac5bfa88*=0x59ac6929b8) returned 0x0 [0091.410] IUnknown:Release (This=0x59ac6929b8) returned 0x1 [0091.410] IShellItem:BindToHandler (in: This=0x59ac6929b8, pbc=0x0, bhid=0x7ff7bd657db0, riid=0x7ff7bd657920, ppv=0x59ac5bfa80 | out: ppv=0x59ac5bfa80) returned 0x0 [0091.415] IUnknown:Release (This=0x59ac6929b8) returned 0x0 [0091.415] IUnknown:Release (This=0x59ac697f48) returned 0x1 [0091.415] IUnknown:AddRef (This=0x59acb75f78) returned 0xf [0091.415] IObjectWithSelection:GetSelection (in: This=0x59acb75f78, riid=0x7ff8de1c76a8, ppv=0x59acb79718 | out: ppv=0x59acb79718) returned 0x0 [0091.415] IUnknown:QueryInterface (in: This=0x59ac697f48, riid=0x7ff8de1c76a8*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0x59acb79718 | out: ppvObject=0x59acb79718*=0x59ac697f48) returned 0x0 [0091.415] IUnknown:Release (This=0x59acb75f78) returned 0xe [0091.460] IUnknown:Release (This=0x59acb75f78) returned 0x7 [0091.460] IUnknown:Release (This=0x59acb75f78) returned 0x6 Thread: id = 171 os_tid = 0x8dc Thread: id = 193 os_tid = 0xd84 Thread: id = 194 os_tid = 0xd8c Thread: id = 195 os_tid = 0xd90 Thread: id = 197 os_tid = 0xd88 Thread: id = 198 os_tid = 0xd80 Thread: id = 199 os_tid = 0xcf0 Thread: id = 268 os_tid = 0xa9c Thread: id = 269 os_tid = 0xa84 Thread: id = 307 os_tid = 0xf44 Thread: id = 314 os_tid = 0xee0 Process: id = "13" image_name = "openwith.exe" filename = "c:\\windows\\system32\\openwith.exe" page_root = "0x244a3000" os_pid = "0x5cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xdd4" cmd_line = "C:\\Windows\\system32\\OpenWith.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2016 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2017 start_va = 0x8511d60000 end_va = 0x8511d6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008511d60000" filename = "" Region: id = 2018 start_va = 0x8511d70000 end_va = 0x8511d76fff entry_point = 0x0 region_type = private name = "private_0x0000008511d70000" filename = "" Region: id = 2019 start_va = 0x8511d80000 end_va = 0x8511d93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008511d80000" filename = "" Region: id = 2020 start_va = 0x8511da0000 end_va = 0x8511e1ffff entry_point = 0x0 region_type = private name = "private_0x0000008511da0000" filename = "" Region: id = 2021 start_va = 0x8511e20000 end_va = 0x8511e23fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008511e20000" filename = "" Region: id = 2022 start_va = 0x8511e30000 end_va = 0x8511e32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008511e30000" filename = "" Region: id = 2023 start_va = 0x8511e40000 end_va = 0x8511e41fff entry_point = 0x0 region_type = private name = "private_0x0000008511e40000" filename = "" Region: id = 2024 start_va = 0x8511e50000 end_va = 0x8511f0dfff entry_point = 0x8511e50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2025 start_va = 0x8511f10000 end_va = 0x8511f8ffff entry_point = 0x0 region_type = private name = "private_0x0000008511f10000" filename = "" Region: id = 2026 start_va = 0x8511f90000 end_va = 0x8511f96fff entry_point = 0x0 region_type = private name = "private_0x0000008511f90000" filename = "" Region: id = 2027 start_va = 0x8511fa0000 end_va = 0x8511fa0fff entry_point = 0x8511fa0000 region_type = mapped_file name = "openwith.exe.mui" filename = "\\Windows\\System32\\en-US\\OpenWith.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\openwith.exe.mui") Region: id = 2028 start_va = 0x8511fb0000 end_va = 0x8511fb0fff entry_point = 0x0 region_type = private name = "private_0x0000008511fb0000" filename = "" Region: id = 2029 start_va = 0x8511fc0000 end_va = 0x8511fc0fff entry_point = 0x0 region_type = private name = "private_0x0000008511fc0000" filename = "" Region: id = 2030 start_va = 0x8511fd0000 end_va = 0x8511fd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008511fd0000" filename = "" Region: id = 2031 start_va = 0x8511fe0000 end_va = 0x8511fe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008511fe0000" filename = "" Region: id = 2032 start_va = 0x8512000000 end_va = 0x85120fffff entry_point = 0x0 region_type = private name = "private_0x0000008512000000" filename = "" Region: id = 2033 start_va = 0x8512100000 end_va = 0x8512287fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008512100000" filename = "" Region: id = 2034 start_va = 0x8512290000 end_va = 0x8512410fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008512290000" filename = "" Region: id = 2035 start_va = 0x8512430000 end_va = 0x851243ffff entry_point = 0x0 region_type = private name = "private_0x0000008512430000" filename = "" Region: id = 2036 start_va = 0x8512440000 end_va = 0x851383ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008512440000" filename = "" Region: id = 2037 start_va = 0x8513840000 end_va = 0x85138bffff entry_point = 0x0 region_type = private name = "private_0x0000008513840000" filename = "" Region: id = 2038 start_va = 0x85138f0000 end_va = 0x85138fffff entry_point = 0x0 region_type = private name = "private_0x00000085138f0000" filename = "" Region: id = 2039 start_va = 0x8513900000 end_va = 0x8513c36fff entry_point = 0x8513900000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2040 start_va = 0x8513c40000 end_va = 0x8513cbffff entry_point = 0x0 region_type = private name = "private_0x0000008513c40000" filename = "" Region: id = 2041 start_va = 0x8513cc0000 end_va = 0x8513d3ffff entry_point = 0x0 region_type = private name = "private_0x0000008513cc0000" filename = "" Region: id = 2042 start_va = 0x8513d40000 end_va = 0x8513dbffff entry_point = 0x0 region_type = private name = "private_0x0000008513d40000" filename = "" Region: id = 2043 start_va = 0x7df5ffd70000 end_va = 0x7ff5ffd6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffd70000" filename = "" Region: id = 2044 start_va = 0x7ff7bd4ee000 end_va = 0x7ff7bd4effff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd4ee000" filename = "" Region: id = 2045 start_va = 0x7ff7bd4f0000 end_va = 0x7ff7bd5effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bd4f0000" filename = "" Region: id = 2046 start_va = 0x7ff7bd5f0000 end_va = 0x7ff7bd612fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bd5f0000" filename = "" Region: id = 2047 start_va = 0x7ff7bd614000 end_va = 0x7ff7bd614fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd614000" filename = "" Region: id = 2048 start_va = 0x7ff7bd616000 end_va = 0x7ff7bd617fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd616000" filename = "" Region: id = 2049 start_va = 0x7ff7bd618000 end_va = 0x7ff7bd619fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd618000" filename = "" Region: id = 2050 start_va = 0x7ff7bd61a000 end_va = 0x7ff7bd61bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd61a000" filename = "" Region: id = 2051 start_va = 0x7ff7bd61c000 end_va = 0x7ff7bd61dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd61c000" filename = "" Region: id = 2052 start_va = 0x7ff7bd61e000 end_va = 0x7ff7bd61ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd61e000" filename = "" Region: id = 2053 start_va = 0x7ff7bd650000 end_va = 0x7ff7bd669fff entry_point = 0x7ff7bd650000 region_type = mapped_file name = "openwith.exe" filename = "\\Windows\\System32\\OpenWith.exe" (normalized: "c:\\windows\\system32\\openwith.exe") Region: id = 2054 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 2055 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 2056 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2057 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2058 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2059 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2060 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2061 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2062 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2063 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2064 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2065 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 2066 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2067 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2068 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2069 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2070 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2071 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2072 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2073 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2074 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2075 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2076 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2077 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2078 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2079 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2080 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2081 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2082 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2083 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2107 start_va = 0x8511ff0000 end_va = 0x8511ff0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008511ff0000" filename = "" Region: id = 2108 start_va = 0x8512420000 end_va = 0x8512420fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008512420000" filename = "" Region: id = 2116 start_va = 0x7ff8ddbd0000 end_va = 0x7ff8de6dcfff entry_point = 0x7ff8ddbd0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 2117 start_va = 0x7ff8e9860000 end_va = 0x7ff8e994dfff entry_point = 0x7ff8e9860000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 2118 start_va = 0x7ff8e3a70000 end_va = 0x7ff8e3c26fff entry_point = 0x7ff8e3a70000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 2119 start_va = 0x85138c0000 end_va = 0x85138c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000085138c0000" filename = "" Region: id = 2120 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2121 start_va = 0x7ff8e7430000 end_va = 0x7ff8e7560fff entry_point = 0x7ff8e7430000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 2122 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2350 start_va = 0x85138d0000 end_va = 0x85138d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000085138d0000" filename = "" Region: id = 2351 start_va = 0x85138e0000 end_va = 0x85138e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000085138e0000" filename = "" Region: id = 2352 start_va = 0x8513dc0000 end_va = 0x8513de9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008513dc0000" filename = "" Region: id = 2353 start_va = 0x8513df0000 end_va = 0x8513e6ffff entry_point = 0x0 region_type = private name = "private_0x0000008513df0000" filename = "" Region: id = 2354 start_va = 0x8513e70000 end_va = 0x8513eeffff entry_point = 0x0 region_type = private name = "private_0x0000008513e70000" filename = "" Region: id = 2355 start_va = 0x7ff7bd4ea000 end_va = 0x7ff7bd4ebfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd4ea000" filename = "" Region: id = 2356 start_va = 0x7ff7bd4ec000 end_va = 0x7ff7bd4edfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd4ec000" filename = "" Region: id = 2357 start_va = 0x7ff8d1180000 end_va = 0x7ff8d132ffff entry_point = 0x7ff8d1180000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 2358 start_va = 0x7ff8d1330000 end_va = 0x7ff8d147bfff entry_point = 0x7ff8d1330000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 2359 start_va = 0x7ff8d76a0000 end_va = 0x7ff8d7738fff entry_point = 0x7ff8d76a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 2361 start_va = 0x8513ef0000 end_va = 0x8513ef1fff entry_point = 0x8513ef0000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 2362 start_va = 0x8513f00000 end_va = 0x8513f03fff entry_point = 0x8513f00000 region_type = mapped_file name = "windows.ui.immersive.dll.mui" filename = "\\Windows\\System32\\en-US\\Windows.UI.Immersive.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.ui.immersive.dll.mui") Region: id = 2363 start_va = 0x8513f10000 end_va = 0x8513f8ffff entry_point = 0x0 region_type = private name = "private_0x0000008513f10000" filename = "" Region: id = 2364 start_va = 0x8513f90000 end_va = 0x85140bafff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008513f90000" filename = "" Region: id = 2365 start_va = 0x85140c0000 end_va = 0x85141bffff entry_point = 0x0 region_type = private name = "private_0x00000085140c0000" filename = "" Region: id = 2366 start_va = 0x85141c0000 end_va = 0x85141c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000085141c0000" filename = "" Region: id = 2367 start_va = 0x85141d0000 end_va = 0x85141d0fff entry_point = 0x0 region_type = private name = "private_0x00000085141d0000" filename = "" Region: id = 2368 start_va = 0x85141e0000 end_va = 0x85141e0fff entry_point = 0x0 region_type = private name = "private_0x00000085141e0000" filename = "" Region: id = 2369 start_va = 0x85141f0000 end_va = 0x851426ffff entry_point = 0x0 region_type = private name = "private_0x00000085141f0000" filename = "" Region: id = 2370 start_va = 0x8514270000 end_va = 0x8514270fff entry_point = 0x0 region_type = private name = "private_0x0000008514270000" filename = "" Region: id = 2371 start_va = 0x8514280000 end_va = 0x8514280fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008514280000" filename = "" Region: id = 2372 start_va = 0x8514290000 end_va = 0x85142a3fff entry_point = 0x8514290000 region_type = mapped_file name = "twinui.dll.mui" filename = "\\Windows\\System32\\en-US\\twinui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\twinui.dll.mui") Region: id = 2373 start_va = 0x85142b0000 end_va = 0x85142b1fff entry_point = 0x85142b0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 2374 start_va = 0x85142c0000 end_va = 0x85142c4fff entry_point = 0x85142c0000 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 2375 start_va = 0x85142d0000 end_va = 0x85143cffff entry_point = 0x0 region_type = private name = "private_0x00000085142d0000" filename = "" Region: id = 2376 start_va = 0x7ff7bd4e6000 end_va = 0x7ff7bd4e7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd4e6000" filename = "" Region: id = 2377 start_va = 0x7ff7bd4e8000 end_va = 0x7ff7bd4e9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd4e8000" filename = "" Region: id = 2378 start_va = 0x7ff8debc0000 end_va = 0x7ff8dec28fff entry_point = 0x7ff8debc0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 2379 start_va = 0x7ff8e37f0000 end_va = 0x7ff8e3a48fff entry_point = 0x7ff8e37f0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 2380 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 2381 start_va = 0x7ff8e8650000 end_va = 0x7ff8e869afff entry_point = 0x7ff8e8650000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 2382 start_va = 0x7ff8e8860000 end_va = 0x7ff8e8acdfff entry_point = 0x7ff8e8860000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 2383 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 2384 start_va = 0x7ff8e8c60000 end_va = 0x7ff8e8cfbfff entry_point = 0x7ff8e8c60000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2385 start_va = 0x7ff8e8d00000 end_va = 0x7ff8e8fa2fff entry_point = 0x7ff8e8d00000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 2386 start_va = 0x7ff8e9130000 end_va = 0x7ff8e9200fff entry_point = 0x7ff8e9130000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 2387 start_va = 0x85143e0000 end_va = 0x85143f2fff entry_point = 0x85143e0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 2388 start_va = 0x8514400000 end_va = 0x8514400fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008514400000" filename = "" Region: id = 2389 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2390 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 2391 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2392 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 2393 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 2394 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3128 start_va = 0x8513f90000 end_va = 0x8513f93fff entry_point = 0x8513f90000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3129 start_va = 0x8513fa0000 end_va = 0x8513fe2fff entry_point = 0x8513fa0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db") Region: id = 3130 start_va = 0x8513ff0000 end_va = 0x8513ff3fff entry_point = 0x8513ff0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3131 start_va = 0x8514000000 end_va = 0x851408afff entry_point = 0x8514000000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 3132 start_va = 0x8514090000 end_va = 0x8514092fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008514090000" filename = "" Region: id = 3133 start_va = 0x85140a0000 end_va = 0x85140a8fff entry_point = 0x0 region_type = private name = "private_0x00000085140a0000" filename = "" Region: id = 3134 start_va = 0x85140b0000 end_va = 0x85140b0fff entry_point = 0x0 region_type = private name = "private_0x00000085140b0000" filename = "" Region: id = 3135 start_va = 0x85143d0000 end_va = 0x85143d3fff entry_point = 0x85143d0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3136 start_va = 0x8514410000 end_va = 0x851442bfff entry_point = 0x8514410000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db") Region: id = 3137 start_va = 0x8514430000 end_va = 0x85144affff entry_point = 0x0 region_type = private name = "private_0x0000008514430000" filename = "" Region: id = 3138 start_va = 0x85144b0000 end_va = 0x85145affff entry_point = 0x0 region_type = private name = "private_0x00000085144b0000" filename = "" Region: id = 3139 start_va = 0x85145c0000 end_va = 0x85145c3fff entry_point = 0x85145c0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3140 start_va = 0x85145d0000 end_va = 0x85145d1fff entry_point = 0x85145d0000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 3141 start_va = 0x85145e0000 end_va = 0x8514603fff entry_point = 0x0 region_type = private name = "private_0x00000085145e0000" filename = "" Region: id = 3142 start_va = 0x8514610000 end_va = 0x8514618fff entry_point = 0x0 region_type = private name = "private_0x0000008514610000" filename = "" Region: id = 3143 start_va = 0x8514620000 end_va = 0x851471ffff entry_point = 0x0 region_type = private name = "private_0x0000008514620000" filename = "" Region: id = 3144 start_va = 0x8514720000 end_va = 0x8514723fff entry_point = 0x8514720000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3145 start_va = 0x8514730000 end_va = 0x8514732fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008514730000" filename = "" Region: id = 3146 start_va = 0x8514740000 end_va = 0x8514741fff entry_point = 0x8514740000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 3147 start_va = 0x8514750000 end_va = 0x851484ffff entry_point = 0x8514750000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 3148 start_va = 0x8514850000 end_va = 0x8514897fff entry_point = 0x0 region_type = private name = "private_0x0000008514850000" filename = "" Region: id = 3149 start_va = 0x85148a0000 end_va = 0x85148b0fff entry_point = 0x85148a0000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 3150 start_va = 0x85148c0000 end_va = 0x85149bffff entry_point = 0x85148c0000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 3151 start_va = 0x8514a00000 end_va = 0x8514a07fff entry_point = 0x0 region_type = private name = "private_0x0000008514a00000" filename = "" Region: id = 3152 start_va = 0x8514a10000 end_va = 0x8514a8ffff entry_point = 0x0 region_type = private name = "private_0x0000008514a10000" filename = "" Region: id = 3153 start_va = 0x8514a90000 end_va = 0x8514a90fff entry_point = 0x0 region_type = private name = "private_0x0000008514a90000" filename = "" Region: id = 3154 start_va = 0x8514aa0000 end_va = 0x8514aa0fff entry_point = 0x0 region_type = private name = "private_0x0000008514aa0000" filename = "" Region: id = 3155 start_va = 0x8514b00000 end_va = 0x8514b0ffff entry_point = 0x0 region_type = private name = "private_0x0000008514b00000" filename = "" Region: id = 3156 start_va = 0x8514b90000 end_va = 0x8514c05fff entry_point = 0x8514b90000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 3157 start_va = 0x8514c10000 end_va = 0x8515c0ffff entry_point = 0x8514c10000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 3158 start_va = 0x8515c10000 end_va = 0x851640ffff entry_point = 0x8515c10000 region_type = mapped_file name = "~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1462094071-1423818996-289466292-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat") Region: id = 3159 start_va = 0x8516410000 end_va = 0x85164eefff entry_point = 0x8516410000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 3160 start_va = 0x85164f0000 end_va = 0x85165d2fff entry_point = 0x85164f0000 region_type = mapped_file name = "seguisb.ttf" filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf") Region: id = 3161 start_va = 0x7ff7bd4e2000 end_va = 0x7ff7bd4e3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd4e2000" filename = "" Region: id = 3162 start_va = 0x7ff7bd4e4000 end_va = 0x7ff7bd4e5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd4e4000" filename = "" Region: id = 3163 start_va = 0x7ff8dc6e0000 end_va = 0x7ff8dc778fff entry_point = 0x7ff8dc6e0000 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 3164 start_va = 0x7ff8dc780000 end_va = 0x7ff8dca11fff entry_point = 0x7ff8dc780000 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 3165 start_va = 0x7ff8dcfd0000 end_va = 0x7ff8dd018fff entry_point = 0x7ff8dcfd0000 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 3166 start_va = 0x7ff8dd900000 end_va = 0x7ff8dd94afff entry_point = 0x7ff8dd900000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 3167 start_va = 0x7ff8e3070000 end_va = 0x7ff8e30f8fff entry_point = 0x7ff8e3070000 region_type = mapped_file name = "directmanipulation.dll" filename = "\\Windows\\System32\\directmanipulation.dll" (normalized: "c:\\windows\\system32\\directmanipulation.dll") Region: id = 3168 start_va = 0x7ff8e86a0000 end_va = 0x7ff8e8851fff entry_point = 0x7ff8e86a0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 3169 start_va = 0x7ff8eac70000 end_va = 0x7ff8ead07fff entry_point = 0x7ff8eac70000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Thread: id = 179 os_tid = 0xd98 Thread: id = 180 os_tid = 0xcf4 Thread: id = 181 os_tid = 0x380 Thread: id = 182 os_tid = 0x91c Thread: id = 183 os_tid = 0x88c [0092.675] TranslateMessage (lpMsg=0x8511e1fd68) returned 0 [0092.676] DispatchMessageW (lpMsg=0x8511e1fd68) returned 0x1 [0092.680] GetMessageW (in: lpMsg=0x8511e1fd68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8511e1fd68) returned 1 [0092.681] TranslateMessage (lpMsg=0x8511e1fd68) returned 0 [0092.681] DispatchMessageW (lpMsg=0x8511e1fd68) returned 0x1 [0092.869] IUnknown_Set (in: ppunk=0x8512435f60*=0x0, punk=0x8512032ad8 | out: ppunk=0x8512435f60*=0x8512032ad8) [0092.870] GetMessageW (in: lpMsg=0x8511e1fd68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8511e1fd68) returned 1 [0092.967] TranslateMessage (lpMsg=0x8511e1fd68) returned 0 [0092.967] DispatchMessageW (lpMsg=0x8511e1fd68) returned 0x1 [0092.967] GetMessageW (in: lpMsg=0x8511e1fd68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8511e1fd68) returned 1 [0092.972] TranslateMessage (lpMsg=0x8511e1fd68) returned 0 [0092.972] DispatchMessageW (lpMsg=0x8511e1fd68) returned 0x1 [0092.972] Str_SetPtrW (in: ppsz=0x8512435fa8*=0x0, psz="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: ppsz=0x8512435fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0092.973] GetMessageW (in: lpMsg=0x8511e1fd68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8511e1fd68) returned 1 [0092.974] TranslateMessage (lpMsg=0x8511e1fd68) returned 0 [0092.974] DispatchMessageW (lpMsg=0x8511e1fd68) returned 0x1 [0092.975] GetMessageW (in: lpMsg=0x8511e1fd68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8511e1fd68) returned 1 [0092.976] TranslateMessage (lpMsg=0x8511e1fd68) returned 0 [0092.976] DispatchMessageW (lpMsg=0x8511e1fd68) returned 0x1 [0092.978] GetMessageW (in: lpMsg=0x8511e1fd68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8511e1fd68) returned 1 [0092.985] TranslateMessage (lpMsg=0x8511e1fd68) returned 0 [0092.985] DispatchMessageW (lpMsg=0x8511e1fd68) returned 0x1 [0092.994] IUnknown_Set (in: ppunk=0x8512435fc0*=0x0, punk=0x8512037f48 | out: ppunk=0x8512435fc0*=0x8512037f48) [0092.994] GetMessageW (in: lpMsg=0x8511e1fd68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8511e1fd68) returned 1 [0092.997] TranslateMessage (lpMsg=0x8511e1fd68) returned 0 [0092.997] DispatchMessageW (lpMsg=0x8511e1fd68) returned 0x1 [0092.997] GetMessageW (in: lpMsg=0x8511e1fd68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8511e1fd68) returned 1 [0093.016] TranslateMessage (lpMsg=0x8511e1fd68) returned 0 [0093.016] DispatchMessageW (lpMsg=0x8511e1fd68) returned 0x1 [0093.018] GetMessageW (in: lpMsg=0x8511e1fd68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8511e1fd68) returned 1 [0093.032] TranslateMessage (lpMsg=0x8511e1fd68) returned 0 [0093.032] DispatchMessageW (lpMsg=0x8511e1fd68) returned 0x1 [0093.033] CoTaskMemAlloc (cb=0xa) returned 0x851201d830 [0093.060] GetMessageW (in: lpMsg=0x8511e1fd68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8511e1fd68) returned 1 [0093.090] TranslateMessage (lpMsg=0x8511e1fd68) returned 0 [0093.090] DispatchMessageW (lpMsg=0x8511e1fd68) returned 0x1 [0093.091] GetMessageW (in: lpMsg=0x8511e1fd68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8511e1fd68) returned 1 [0093.145] TranslateMessage (lpMsg=0x8511e1fd68) returned 0 [0093.145] DispatchMessageW (lpMsg=0x8511e1fd68) returned 0x1 [0093.146] GetMessageW (in: lpMsg=0x8511e1fd68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8511e1fd68) returned 1 [0093.346] TranslateMessage (lpMsg=0x8511e1fd68) returned 0 [0093.346] DispatchMessageW (lpMsg=0x8511e1fd68) returned 0x1 [0093.346] KillTimer (hWnd=0x0, uIDEvent=0x7f78) returned 1 [0093.347] CompareStringOrdinal (lpString1="InvokeDefaultVerbInOtherProcess", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 1 [0093.347] CoCreateInstance (in: rclsid=0x7ff7bd6575b0*(Data1=0x94b23d4d, Data2=0x1040, Data3=0x4c4b, Data4=([0]=0x90, [1]=0x81, [2]=0x85, [3]=0xd8, [4]=0xd6, [5]=0xfa, [6]=0x36, [7]=0xc4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7bd657a50*(Data1=0xce149b23, Data2=0x5941, Data3=0x4079, Data4=([0]=0x92, [1]=0x23, [2]=0x52, [3]=0xc0, [4]=0xa9, [5]=0x91, [6]=0xec, [7]=0x48)), ppv=0x8512435fe0 | out: ppv=0x8512435fe0*=0x8512439620) returned 0x0 [0093.374] IUnknown_SetSite (punk=0x8512439620, punkSite=0x8512435f40) returned 0x0 [0093.374] IUnknown:QueryInterface (This=0x8512435f40, riid=0x7ff8ee00d438*(Data1=0x114, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8511e1e6b0) [0093.374] IUnknown:QueryInterface (This=0x8512435f40, riid=0x7ff8ee00d468*(Data1=0x79eac9ed, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x8511e1e6a0) [0093.374] IUnknown:QueryInterface (This=0x8512435f40, riid=0x7ff8ee00d458*(Data1=0x214e3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8511e1e6a8) [0093.375] IUnknown:QueryInterface (This=0x8512435f40, riid=0x7ff8ee00d448*(Data1=0x45d64a29, Data2=0xa63e, Data3=0x4cb6, Data4=([0]=0xb4, [1]=0x98, [2]=0x57, [3]=0x81, [4]=0xd2, [5]=0x98, [6]=0xcb, [7]=0x4f)), ppvObject=0x8511e1e6b8) [0093.375] IUnknown:QueryInterface (This=0x8512435f40, riid=0x7ff8eb8347d8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x8511e1e6e0) [0093.375] IUnknown:QueryInterface (in: This=0x8512032ad8, riid=0x7ff8de1e0bd8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8511e1e710 | out: ppvObject=0x8511e1e710*=0x8512032ad8) returned 0x0 [0093.600] IUnknown:QueryInterface (This=0x8512435f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x8511e1e710) [0093.601] IUnknown:AddRef (This=0x8512435f40) returned 0xe [0093.601] IUnknown_QueryService (in: punk=0x8512032ad8, guidService=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), riid=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), ppvOut=0x85124396e0 | out: ppvOut=0x85124396e0*=0x0) returned 0x80004001 [0093.642] IUnknown:Release (This=0x8512435f40) returned 0xd [0093.642] IUnknown:QueryInterface (This=0x8512435f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x8511e1e710) [0093.642] IUnknown:AddRef (This=0x8512435f40) returned 0xe [0093.642] IUnknown_QueryService (in: punk=0x8512032ad8, guidService=0x7ff8de1c0980*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), riid=0x7ff8de1c0a40*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), ppvOut=0x85124396e8 | out: ppvOut=0x85124396e8*=0x0) returned 0x80004001 [0093.643] IUnknown:Release (This=0x8512435f40) returned 0xd [0093.643] IUnknown:QueryInterface (This=0x8512435f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x8511e1e710) [0093.643] IUnknown:AddRef (This=0x8512435f40) returned 0xe [0093.643] IUnknown_QueryService (in: punk=0x8512032ad8, guidService=0x7ff8de1c0950*(Data1=0xcde725b0, Data2=0xccc9, Data3=0x4519, Data4=([0]=0x91, [1]=0x7e, [2]=0x32, [3]=0x5d, [4]=0x72, [5]=0xfa, [6]=0xb4, [7]=0xce)), riid=0x7ff8de1d2fb0*(Data1=0x1af3a467, Data2=0x214f, Data3=0x4298, Data4=([0]=0x90, [1]=0x8e, [2]=0x6, [3]=0xb0, [4]=0x3e, [5]=0xb, [6]=0x39, [7]=0xf9)), ppvOut=0x85124396f0 | out: ppvOut=0x85124396f0*=0x0) returned 0x80004001 [0093.644] IUnknown:Release (This=0x8512435f40) returned 0xd [0093.644] IUnknown:QueryInterface (This=0x8512435f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x8511e1e710) [0093.644] IUnknown:AddRef (This=0x8512435f40) returned 0xe [0093.644] IUnknown_QueryService (in: punk=0x8512032ad8, guidService=0x7ff8de1c0800*(Data1=0x80605492, Data2=0x67d9, Data3=0x414f, Data4=([0]=0xaf, [1]=0x89, [2]=0xa1, [3]=0xcd, [4]=0xf1, [5]=0x24, [6]=0x2b, [7]=0xc1)), riid=0x7ff8de1c0068*(Data1=0xe5aa01f7, Data2=0x1fb8, Data3=0x4830, Data4=([0]=0x87, [1]=0x20, [2]=0x4e, [3]=0x67, [4]=0x34, [5]=0xcb, [6]=0xd5, [7]=0xf3)), ppvOut=0x85124396f8 | out: ppvOut=0x85124396f8*=0x0) returned 0x80004001 [0093.645] IUnknown:Release (This=0x8512435f40) returned 0xd [0093.645] IUnknown:QueryInterface (This=0x8512435f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x8511e1e710) [0093.645] IUnknown:AddRef (This=0x8512435f40) returned 0xe [0093.645] IUnknown_QueryService (in: punk=0x8512032ad8, guidService=0x7ff8de1c0810*(Data1=0x2ce78010, Data2=0x74db, Data3=0x48bc, Data4=([0]=0x9c, [1]=0x6a, [2]=0x10, [3]=0xf3, [4]=0x72, [5]=0x49, [6]=0x57, [7]=0x23)), riid=0x7ff8de1bfb70*(Data1=0x989191ac, Data2=0x28ff, Data3=0x4cf0, Data4=([0]=0x95, [1]=0x84, [2]=0xe0, [3]=0xd0, [4]=0x78, [5]=0xbc, [6]=0x23, [7]=0x96)), ppvOut=0x8512439700 | out: ppvOut=0x8512439700*=0x0) returned 0x80004001 [0093.646] IUnknown:Release (This=0x8512435f40) returned 0xd [0093.646] IUnknown:QueryInterface (This=0x8512435f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x8511e1e710) [0093.646] IUnknown:AddRef (This=0x8512435f40) returned 0xe [0093.646] IUnknown_QueryService (in: punk=0x8512032ad8, guidService=0x7ff8de1c0078*(Data1=0x26db2472, Data2=0xb7b7, Data3=0x406b, Data4=([0]=0x97, [1]=0x2, [2]=0x73, [3]=0xa, [4]=0x4e, [5]=0x20, [6]=0xd3, [7]=0xbf)), riid=0x7ff8de1c0a10*(Data1=0x2f0666c6, Data2=0x12f7, Data3=0x4360, Data4=([0]=0xb5, [1]=0x11, [2]=0xa3, [3]=0x94, [4]=0xa0, [5]=0x55, [6]=0x37, [7]=0x25)), ppvOut=0x8512439708 | out: ppvOut=0x8512439708*=0x0) returned 0x80004001 [0093.647] IUnknown:Release (This=0x8512435f40) returned 0xd [0093.647] IUnknown:QueryInterface (This=0x8512435f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x8511e1e710) [0093.647] IUnknown:AddRef (This=0x8512435f40) returned 0xe [0093.647] IUnknown_QueryService (in: punk=0x8512032ad8, guidService=0x7ff8de1c0930*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), riid=0x7ff8de1c0a30*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), ppvOut=0x8512439bf0 | out: ppvOut=0x8512439bf0*=0x0) returned 0x80004001 [0093.648] IUnknown:Release (This=0x8512435f40) returned 0xd [0093.648] IUnknown:QueryInterface (This=0x8512435f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x8511e1e710) [0093.648] IUnknown:AddRef (This=0x8512435f40) returned 0xe [0093.648] IUnknown_QueryService (in: punk=0x8512032ad8, guidService=0x7ff8de27c2c0*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff8de27fc98*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0x8511e1e750 | out: ppvOut=0x8511e1e750*=0x0) returned 0x80004001 [0093.649] IUnknown:Release (This=0x8512435f40) returned 0xd [0093.649] IUnknown:AddRef (This=0x8512435f40) returned 0xe [0093.649] GetCurrentThreadId () returned 0x88c [0093.649] PostThreadMessageW (idThread=0x88c, Msg=0x8001, wParam=0x0, lParam=0x0) returned 1 [0093.649] GetMessageW (in: lpMsg=0x8511e1fd68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8511e1fd68) returned 1 [0093.649] CompareStringOrdinal (lpString1="openas", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0093.649] CompareStringOrdinal (lpString1="OpenWithSetDefaultOn", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0093.649] IUnknown_QueryService (in: punk=0x8512032ad8, guidService=0x7ff7bd657da0*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), riid=0x7ff7bd657910*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), ppvOut=0x8511e1fdf8 | out: ppvOut=0x8511e1fdf8*=0x851203c1b8) returned 0x0 [0093.689] IUnknown_Set (in: ppunk=0x8512435f60*=0x8512032ad8, punk=0x0 | out: ppunk=0x8512435f60*=0x0) [0093.738] IUnknown_QueryService (in: punk=0x0, guidService=0x7ff7bd657d60*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff7bd657950*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0x8511e1fd48 | out: ppvOut=0x8511e1fd48*=0x0) returned 0x80004001 [0093.738] QISearch (in: that=0x8512435f30, pqit=0x7ff7bd657970, riid=0x7ff7bd657ac0*(Data1=0x1c9cd5bb, Data2=0x98e9, Data3=0x4491, Data4=([0]=0xa6, [1]=0xf, [2]=0x31, [3]=0xaa, [4]=0xcc, [5]=0x72, [6]=0xb8, [7]=0x3c)), ppv=0x8511e1fca8 | out: that=0x8512435f30, ppv=0x8511e1fca8*=0x8512435f78) returned 0x0 [0093.738] IUnknown:QueryInterface (in: This=0x8512037f48, riid=0x7ff7bd657930*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0x8511e1fd40 | out: ppvObject=0x8511e1fd40*=0x8512037f48) returned 0x0 [0093.738] IShellItemArray:GetItemAt (in: This=0x8512037f48, dwIndex=0x0, ppsi=0x8511e1fd30 | out: ppsi=0x8511e1fd30*=0x85120329b8) returned 0x0 [0093.738] IUnknown:QueryInterface (in: This=0x85120329b8, riid=0x7ff7bd657b10*(Data1=0x7e9fb0d3, Data2=0x919f, Data3=0x4307, Data4=([0]=0xab, [1]=0x2e, [2]=0x9b, [3]=0x18, [4]=0x60, [5]=0x31, [6]=0xc, [7]=0x93)), ppvObject=0x8511e1fd38 | out: ppvObject=0x8511e1fd38*=0x85120329b8) returned 0x0 [0093.739] IUnknown:Release (This=0x85120329b8) returned 0x1 [0093.739] IShellItem:BindToHandler (in: This=0x85120329b8, pbc=0x0, bhid=0x7ff7bd657db0, riid=0x7ff7bd657920, ppv=0x8511e1fd30 | out: ppv=0x8511e1fd30) returned 0x0 [0093.745] IUnknown:Release (This=0x85120329b8) returned 0x0 [0093.745] IUnknown:Release (This=0x8512037f48) returned 0x1 [0093.745] IUnknown:AddRef (This=0x8512435f78) returned 0xf [0093.745] IObjectWithSelection:GetSelection (in: This=0x8512435f78, riid=0x7ff8de1c76a8, ppv=0x8512439718 | out: ppv=0x8512439718) returned 0x0 [0093.745] IUnknown:QueryInterface (in: This=0x8512037f48, riid=0x7ff8de1c76a8*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0x8512439718 | out: ppvObject=0x8512439718*=0x8512037f48) returned 0x0 [0093.745] IUnknown:Release (This=0x8512435f78) returned 0xe [0093.753] IUnknown:Release (This=0x8512435f78) returned 0x7 [0093.753] IUnknown:Release (This=0x8512435f78) returned 0x6 [0111.472] IUnknown:Release (This=0x8512037f48) returned 0x1 [0111.472] IUnknown_SetSite (punk=0x8512439620, punkSite=0x0) returned 0x0 [0111.472] IUnknown:Release (This=0x8512435f40) returned 0x2 [0111.472] PostQuitMessage (nExitCode=0) [0111.472] TranslateMessage (lpMsg=0x8511e1fd68) returned 0 [0111.472] DispatchMessageW (lpMsg=0x8511e1fd68) returned 0x0 [0111.472] GetMessageW (in: lpMsg=0x8511e1fd68, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8511e1fd68) returned 0 [0111.472] CoRevokeClassObject (dwRegister=0x10) returned 0x0 [0111.571] IUnknown:Release (This=0x8512439620) returned 0x0 [0112.279] CoTaskMemFree (pv=0x851201d830) [0112.279] Str_SetPtrW (in: ppsz=0x8512435fa0*=0x0, psz=0x0 | out: ppsz=0x8512435fa0*=0x0) returned 1 [0112.279] Str_SetPtrW (in: ppsz=0x8512435fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop", psz=0x0 | out: ppsz=0x8512435fa8*=0x0) returned 1 [0112.279] SHSetThreadRef (punk=0x0) returned 0x0 [0112.279] CoUninitialize () [0112.533] LocalFree (hMem=0x851200b6e0) returned 0x0 [0112.533] EtwEventUnregister (RegHandle=0x28008512011000) returned 0x0 [0112.533] exit (_Code=0) Thread: id = 184 os_tid = 0xdac Thread: id = 210 os_tid = 0xe68 Thread: id = 211 os_tid = 0xe6c Thread: id = 212 os_tid = 0xe70 Thread: id = 213 os_tid = 0xe58 Thread: id = 214 os_tid = 0xe94 Thread: id = 282 os_tid = 0xa34 Thread: id = 283 os_tid = 0xf44 Process: id = "14" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x25002000" os_pid = "0xd08" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0xfb8" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2123 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2124 start_va = 0x65d0b10000 end_va = 0x65d0b1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000065d0b10000" filename = "" Region: id = 2125 start_va = 0x65d0b20000 end_va = 0x65d0b26fff entry_point = 0x0 region_type = private name = "private_0x00000065d0b20000" filename = "" Region: id = 2126 start_va = 0x65d0b30000 end_va = 0x65d0b43fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000065d0b30000" filename = "" Region: id = 2127 start_va = 0x65d0b50000 end_va = 0x65d0c4ffff entry_point = 0x0 region_type = private name = "private_0x00000065d0b50000" filename = "" Region: id = 2128 start_va = 0x65d0c50000 end_va = 0x65d0c53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000065d0c50000" filename = "" Region: id = 2129 start_va = 0x65d0c60000 end_va = 0x65d0c61fff entry_point = 0x0 region_type = private name = "private_0x00000065d0c60000" filename = "" Region: id = 2130 start_va = 0x65d0c70000 end_va = 0x65d0c70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000065d0c70000" filename = "" Region: id = 2131 start_va = 0x65d0c80000 end_va = 0x65d0c86fff entry_point = 0x0 region_type = private name = "private_0x00000065d0c80000" filename = "" Region: id = 2132 start_va = 0x65d0c90000 end_va = 0x65d0c90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000065d0c90000" filename = "" Region: id = 2133 start_va = 0x65d0ca0000 end_va = 0x65d0ca0fff entry_point = 0x0 region_type = private name = "private_0x00000065d0ca0000" filename = "" Region: id = 2134 start_va = 0x65d0cb0000 end_va = 0x65d0cb0fff entry_point = 0x0 region_type = private name = "private_0x00000065d0cb0000" filename = "" Region: id = 2135 start_va = 0x65d0cc0000 end_va = 0x65d0cc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000065d0cc0000" filename = "" Region: id = 2136 start_va = 0x65d0ce0000 end_va = 0x65d0ce1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000065d0ce0000" filename = "" Region: id = 2137 start_va = 0x65d0d00000 end_va = 0x65d0dfffff entry_point = 0x0 region_type = private name = "private_0x00000065d0d00000" filename = "" Region: id = 2138 start_va = 0x65d0e00000 end_va = 0x65d0ebdfff entry_point = 0x65d0e00000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2139 start_va = 0x65d0ec0000 end_va = 0x65d0fbffff entry_point = 0x0 region_type = private name = "private_0x00000065d0ec0000" filename = "" Region: id = 2140 start_va = 0x65d10a0000 end_va = 0x65d10affff entry_point = 0x0 region_type = private name = "private_0x00000065d10a0000" filename = "" Region: id = 2141 start_va = 0x65d10b0000 end_va = 0x65d13e6fff entry_point = 0x65d10b0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2142 start_va = 0x65d13f0000 end_va = 0x65d14effff entry_point = 0x0 region_type = private name = "private_0x00000065d13f0000" filename = "" Region: id = 2143 start_va = 0x65d14f0000 end_va = 0x65d15effff entry_point = 0x0 region_type = private name = "private_0x00000065d14f0000" filename = "" Region: id = 2144 start_va = 0x65d15f0000 end_va = 0x65d16effff entry_point = 0x0 region_type = private name = "private_0x00000065d15f0000" filename = "" Region: id = 2145 start_va = 0x65d16f0000 end_va = 0x65d17effff entry_point = 0x0 region_type = private name = "private_0x00000065d16f0000" filename = "" Region: id = 2146 start_va = 0x65d17f0000 end_va = 0x65d1977fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000065d17f0000" filename = "" Region: id = 2147 start_va = 0x65d1980000 end_va = 0x65d1b00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000065d1980000" filename = "" Region: id = 2148 start_va = 0x65d1b10000 end_va = 0x65d2f0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000065d1b10000" filename = "" Region: id = 2149 start_va = 0x65d2f10000 end_va = 0x65d300ffff entry_point = 0x0 region_type = private name = "private_0x00000065d2f10000" filename = "" Region: id = 2150 start_va = 0x65d3070000 end_va = 0x65d307ffff entry_point = 0x0 region_type = private name = "private_0x00000065d3070000" filename = "" Region: id = 2151 start_va = 0x7df5ff0f0000 end_va = 0x7ff5ff0effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff0f0000" filename = "" Region: id = 2152 start_va = 0x7ff6a484e000 end_va = 0x7ff6a484ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6a484e000" filename = "" Region: id = 2153 start_va = 0x7ff6a4850000 end_va = 0x7ff6a494ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6a4850000" filename = "" Region: id = 2154 start_va = 0x7ff6a4950000 end_va = 0x7ff6a4972fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6a4950000" filename = "" Region: id = 2155 start_va = 0x7ff6a4973000 end_va = 0x7ff6a4974fff entry_point = 0x0 region_type = private name = "private_0x00007ff6a4973000" filename = "" Region: id = 2156 start_va = 0x7ff6a4975000 end_va = 0x7ff6a4975fff entry_point = 0x0 region_type = private name = "private_0x00007ff6a4975000" filename = "" Region: id = 2157 start_va = 0x7ff6a4976000 end_va = 0x7ff6a4977fff entry_point = 0x0 region_type = private name = "private_0x00007ff6a4976000" filename = "" Region: id = 2158 start_va = 0x7ff6a4978000 end_va = 0x7ff6a4979fff entry_point = 0x0 region_type = private name = "private_0x00007ff6a4978000" filename = "" Region: id = 2159 start_va = 0x7ff6a497a000 end_va = 0x7ff6a497bfff entry_point = 0x0 region_type = private name = "private_0x00007ff6a497a000" filename = "" Region: id = 2160 start_va = 0x7ff6a497c000 end_va = 0x7ff6a497dfff entry_point = 0x0 region_type = private name = "private_0x00007ff6a497c000" filename = "" Region: id = 2161 start_va = 0x7ff6a497e000 end_va = 0x7ff6a497ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6a497e000" filename = "" Region: id = 2162 start_va = 0x7ff6a4de0000 end_va = 0x7ff6a4de6fff entry_point = 0x7ff6a4de0000 region_type = mapped_file name = "dllhost.exe" filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe") Region: id = 2163 start_va = 0x7ff8dd900000 end_va = 0x7ff8dd94afff entry_point = 0x7ff8dd900000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 2164 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 2165 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2166 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2167 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2168 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2169 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2170 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2171 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2172 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2173 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2174 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2175 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2176 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2177 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2178 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2179 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2180 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2181 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2182 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2183 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2184 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2185 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2186 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 185 os_tid = 0xdcc Thread: id = 186 os_tid = 0xd94 Thread: id = 187 os_tid = 0xdb4 Thread: id = 188 os_tid = 0xdd0 Thread: id = 189 os_tid = 0x390 Thread: id = 190 os_tid = 0xa80 Thread: id = 191 os_tid = 0xd24 Thread: id = 192 os_tid = 0xd1c Process: id = "15" image_name = "openwith.exe" filename = "c:\\windows\\system32\\openwith.exe" page_root = "0x222a8000" os_pid = "0xdb8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xdd4" cmd_line = "C:\\Windows\\system32\\OpenWith.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2273 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2274 start_va = 0xf888130000 end_va = 0xf88813ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f888130000" filename = "" Region: id = 2275 start_va = 0xf888140000 end_va = 0xf888146fff entry_point = 0x0 region_type = private name = "private_0x000000f888140000" filename = "" Region: id = 2276 start_va = 0xf888150000 end_va = 0xf888163fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f888150000" filename = "" Region: id = 2277 start_va = 0xf888170000 end_va = 0xf8881effff entry_point = 0x0 region_type = private name = "private_0x000000f888170000" filename = "" Region: id = 2278 start_va = 0xf8881f0000 end_va = 0xf8881f3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f8881f0000" filename = "" Region: id = 2279 start_va = 0xf888200000 end_va = 0xf888202fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f888200000" filename = "" Region: id = 2280 start_va = 0xf888210000 end_va = 0xf888211fff entry_point = 0x0 region_type = private name = "private_0x000000f888210000" filename = "" Region: id = 2281 start_va = 0xf888220000 end_va = 0xf8882ddfff entry_point = 0xf888220000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2282 start_va = 0xf8882e0000 end_va = 0xf88835ffff entry_point = 0x0 region_type = private name = "private_0x000000f8882e0000" filename = "" Region: id = 2283 start_va = 0xf888360000 end_va = 0xf888366fff entry_point = 0x0 region_type = private name = "private_0x000000f888360000" filename = "" Region: id = 2284 start_va = 0xf888370000 end_va = 0xf88846ffff entry_point = 0x0 region_type = private name = "private_0x000000f888370000" filename = "" Region: id = 2285 start_va = 0xf888470000 end_va = 0xf8885f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f888470000" filename = "" Region: id = 2286 start_va = 0xf888600000 end_va = 0xf888600fff entry_point = 0xf888600000 region_type = mapped_file name = "openwith.exe.mui" filename = "\\Windows\\System32\\en-US\\OpenWith.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\openwith.exe.mui") Region: id = 2287 start_va = 0xf888610000 end_va = 0xf888610fff entry_point = 0x0 region_type = private name = "private_0x000000f888610000" filename = "" Region: id = 2288 start_va = 0xf888620000 end_va = 0xf888620fff entry_point = 0x0 region_type = private name = "private_0x000000f888620000" filename = "" Region: id = 2289 start_va = 0xf888630000 end_va = 0xf888630fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f888630000" filename = "" Region: id = 2290 start_va = 0xf888640000 end_va = 0xf888641fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f888640000" filename = "" Region: id = 2291 start_va = 0xf888650000 end_va = 0xf8886cffff entry_point = 0x0 region_type = private name = "private_0x000000f888650000" filename = "" Region: id = 2292 start_va = 0xf8886d0000 end_va = 0xf8886dffff entry_point = 0x0 region_type = private name = "private_0x000000f8886d0000" filename = "" Region: id = 2293 start_va = 0xf8886e0000 end_va = 0xf888860fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f8886e0000" filename = "" Region: id = 2294 start_va = 0xf888870000 end_va = 0xf889c6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f888870000" filename = "" Region: id = 2295 start_va = 0xf889c70000 end_va = 0xf889ceffff entry_point = 0x0 region_type = private name = "private_0x000000f889c70000" filename = "" Region: id = 2296 start_va = 0xf889cf0000 end_va = 0xf889d6ffff entry_point = 0x0 region_type = private name = "private_0x000000f889cf0000" filename = "" Region: id = 2297 start_va = 0xf889d70000 end_va = 0xf889deffff entry_point = 0x0 region_type = private name = "private_0x000000f889d70000" filename = "" Region: id = 2298 start_va = 0xf889e40000 end_va = 0xf889e4ffff entry_point = 0x0 region_type = private name = "private_0x000000f889e40000" filename = "" Region: id = 2299 start_va = 0xf889e50000 end_va = 0xf88a186fff entry_point = 0xf889e50000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2300 start_va = 0x7df5fff50000 end_va = 0x7ff5fff4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fff50000" filename = "" Region: id = 2301 start_va = 0x7ff7bd3fe000 end_va = 0x7ff7bd3fffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd3fe000" filename = "" Region: id = 2302 start_va = 0x7ff7bd400000 end_va = 0x7ff7bd4fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bd400000" filename = "" Region: id = 2303 start_va = 0x7ff7bd500000 end_va = 0x7ff7bd522fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bd500000" filename = "" Region: id = 2304 start_va = 0x7ff7bd524000 end_va = 0x7ff7bd525fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd524000" filename = "" Region: id = 2305 start_va = 0x7ff7bd526000 end_va = 0x7ff7bd527fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd526000" filename = "" Region: id = 2306 start_va = 0x7ff7bd528000 end_va = 0x7ff7bd529fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd528000" filename = "" Region: id = 2307 start_va = 0x7ff7bd52a000 end_va = 0x7ff7bd52afff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd52a000" filename = "" Region: id = 2308 start_va = 0x7ff7bd52c000 end_va = 0x7ff7bd52dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd52c000" filename = "" Region: id = 2309 start_va = 0x7ff7bd52e000 end_va = 0x7ff7bd52ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd52e000" filename = "" Region: id = 2310 start_va = 0x7ff7bd650000 end_va = 0x7ff7bd669fff entry_point = 0x7ff7bd650000 region_type = mapped_file name = "openwith.exe" filename = "\\Windows\\System32\\OpenWith.exe" (normalized: "c:\\windows\\system32\\openwith.exe") Region: id = 2311 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 2312 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 2313 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2314 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2315 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2316 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2317 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2318 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2319 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2320 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2321 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2322 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 2323 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2324 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2325 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2326 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2327 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2328 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2329 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2330 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2331 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2332 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2333 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2334 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2335 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2336 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2337 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2338 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2339 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2340 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2341 start_va = 0xf889df0000 end_va = 0xf889df0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f889df0000" filename = "" Region: id = 2342 start_va = 0xf889e00000 end_va = 0xf889e00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f889e00000" filename = "" Region: id = 2343 start_va = 0x7ff8ddbd0000 end_va = 0x7ff8de6dcfff entry_point = 0x7ff8ddbd0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 2344 start_va = 0x7ff8e9860000 end_va = 0x7ff8e994dfff entry_point = 0x7ff8e9860000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 2345 start_va = 0x7ff8e3a70000 end_va = 0x7ff8e3c26fff entry_point = 0x7ff8e3a70000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 2346 start_va = 0xf889e10000 end_va = 0xf889e12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f889e10000" filename = "" Region: id = 2347 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2348 start_va = 0x7ff8e7430000 end_va = 0x7ff8e7560fff entry_point = 0x7ff8e7430000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 2349 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2565 start_va = 0xf889e20000 end_va = 0xf889e20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f889e20000" filename = "" Region: id = 2566 start_va = 0xf889e30000 end_va = 0xf889e31fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f889e30000" filename = "" Region: id = 2567 start_va = 0xf88a190000 end_va = 0xf88a1b9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f88a190000" filename = "" Region: id = 2568 start_va = 0xf88a1c0000 end_va = 0xf88a23ffff entry_point = 0x0 region_type = private name = "private_0x000000f88a1c0000" filename = "" Region: id = 2569 start_va = 0xf88a240000 end_va = 0xf88a2bffff entry_point = 0x0 region_type = private name = "private_0x000000f88a240000" filename = "" Region: id = 2570 start_va = 0x7ff7bd3fa000 end_va = 0x7ff7bd3fbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd3fa000" filename = "" Region: id = 2571 start_va = 0x7ff7bd3fc000 end_va = 0x7ff7bd3fdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd3fc000" filename = "" Region: id = 2572 start_va = 0x7ff8d1180000 end_va = 0x7ff8d132ffff entry_point = 0x7ff8d1180000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 2573 start_va = 0x7ff8d1330000 end_va = 0x7ff8d147bfff entry_point = 0x7ff8d1330000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 2574 start_va = 0x7ff8d76a0000 end_va = 0x7ff8d7738fff entry_point = 0x7ff8d76a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 2575 start_va = 0xf88a2c0000 end_va = 0xf88a2c1fff entry_point = 0xf88a2c0000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 2576 start_va = 0xf88a2d0000 end_va = 0xf88a2d3fff entry_point = 0xf88a2d0000 region_type = mapped_file name = "windows.ui.immersive.dll.mui" filename = "\\Windows\\System32\\en-US\\Windows.UI.Immersive.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.ui.immersive.dll.mui") Region: id = 2577 start_va = 0xf88a2e0000 end_va = 0xf88a35ffff entry_point = 0x0 region_type = private name = "private_0x000000f88a2e0000" filename = "" Region: id = 2578 start_va = 0xf88a360000 end_va = 0xf88a48afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f88a360000" filename = "" Region: id = 2579 start_va = 0xf88a490000 end_va = 0xf88a490fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f88a490000" filename = "" Region: id = 2580 start_va = 0xf88a4a0000 end_va = 0xf88a4a0fff entry_point = 0x0 region_type = private name = "private_0x000000f88a4a0000" filename = "" Region: id = 2581 start_va = 0xf88a4b0000 end_va = 0xf88a4b0fff entry_point = 0x0 region_type = private name = "private_0x000000f88a4b0000" filename = "" Region: id = 2582 start_va = 0xf88a4c0000 end_va = 0xf88a53ffff entry_point = 0x0 region_type = private name = "private_0x000000f88a4c0000" filename = "" Region: id = 2583 start_va = 0xf88a540000 end_va = 0xf88a63ffff entry_point = 0x0 region_type = private name = "private_0x000000f88a540000" filename = "" Region: id = 2584 start_va = 0xf88a640000 end_va = 0xf88a640fff entry_point = 0x0 region_type = private name = "private_0x000000f88a640000" filename = "" Region: id = 2585 start_va = 0xf88a650000 end_va = 0xf88a650fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f88a650000" filename = "" Region: id = 2586 start_va = 0xf88a660000 end_va = 0xf88a673fff entry_point = 0xf88a660000 region_type = mapped_file name = "twinui.dll.mui" filename = "\\Windows\\System32\\en-US\\twinui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\twinui.dll.mui") Region: id = 2587 start_va = 0xf88a680000 end_va = 0xf88a681fff entry_point = 0xf88a680000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 2588 start_va = 0xf88a690000 end_va = 0xf88a694fff entry_point = 0xf88a690000 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 2589 start_va = 0xf88a6a0000 end_va = 0xf88a79ffff entry_point = 0x0 region_type = private name = "private_0x000000f88a6a0000" filename = "" Region: id = 2590 start_va = 0x7ff7bd3f6000 end_va = 0x7ff7bd3f7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd3f6000" filename = "" Region: id = 2591 start_va = 0x7ff7bd3f8000 end_va = 0x7ff7bd3f9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd3f8000" filename = "" Region: id = 2592 start_va = 0x7ff8debc0000 end_va = 0x7ff8dec28fff entry_point = 0x7ff8debc0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 2593 start_va = 0x7ff8e37f0000 end_va = 0x7ff8e3a48fff entry_point = 0x7ff8e37f0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 2594 start_va = 0x7ff8e8650000 end_va = 0x7ff8e869afff entry_point = 0x7ff8e8650000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 2595 start_va = 0x7ff8e8860000 end_va = 0x7ff8e8acdfff entry_point = 0x7ff8e8860000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 2596 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 2597 start_va = 0x7ff8e8c60000 end_va = 0x7ff8e8cfbfff entry_point = 0x7ff8e8c60000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2598 start_va = 0x7ff8e8d00000 end_va = 0x7ff8e8fa2fff entry_point = 0x7ff8e8d00000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 2599 start_va = 0x7ff8e9130000 end_va = 0x7ff8e9200fff entry_point = 0x7ff8e9130000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 2600 start_va = 0xf88a7b0000 end_va = 0xf88a7c2fff entry_point = 0xf88a7b0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 2601 start_va = 0xf88a7d0000 end_va = 0xf88a7d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f88a7d0000" filename = "" Region: id = 2602 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2603 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 2604 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 2605 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2606 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 2607 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 2608 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3170 start_va = 0xf88a360000 end_va = 0xf88a363fff entry_point = 0xf88a360000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3171 start_va = 0xf88a370000 end_va = 0xf88a3b2fff entry_point = 0xf88a370000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db") Region: id = 3172 start_va = 0xf88a3c0000 end_va = 0xf88a3c3fff entry_point = 0xf88a3c0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3173 start_va = 0xf88a3d0000 end_va = 0xf88a45afff entry_point = 0xf88a3d0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 3174 start_va = 0xf88a460000 end_va = 0xf88a462fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f88a460000" filename = "" Region: id = 3175 start_va = 0xf88a470000 end_va = 0xf88a478fff entry_point = 0x0 region_type = private name = "private_0x000000f88a470000" filename = "" Region: id = 3176 start_va = 0xf88a480000 end_va = 0xf88a480fff entry_point = 0x0 region_type = private name = "private_0x000000f88a480000" filename = "" Region: id = 3177 start_va = 0xf88a7a0000 end_va = 0xf88a7a3fff entry_point = 0xf88a7a0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3178 start_va = 0xf88a7e0000 end_va = 0xf88a85ffff entry_point = 0x0 region_type = private name = "private_0x000000f88a7e0000" filename = "" Region: id = 3179 start_va = 0xf88a860000 end_va = 0xf88a87bfff entry_point = 0xf88a860000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db") Region: id = 3180 start_va = 0xf88a880000 end_va = 0xf88a8fffff entry_point = 0x0 region_type = private name = "private_0x000000f88a880000" filename = "" Region: id = 3181 start_va = 0xf88a900000 end_va = 0xf88a9fffff entry_point = 0x0 region_type = private name = "private_0x000000f88a900000" filename = "" Region: id = 3182 start_va = 0xf88aa10000 end_va = 0xf88aa13fff entry_point = 0xf88aa10000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3183 start_va = 0xf88aa20000 end_va = 0xf88aa21fff entry_point = 0xf88aa20000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 3184 start_va = 0xf88aa30000 end_va = 0xf88aa53fff entry_point = 0x0 region_type = private name = "private_0x000000f88aa30000" filename = "" Region: id = 3185 start_va = 0xf88aa60000 end_va = 0xf88aa68fff entry_point = 0x0 region_type = private name = "private_0x000000f88aa60000" filename = "" Region: id = 3186 start_va = 0xf88aa70000 end_va = 0xf88ab6ffff entry_point = 0x0 region_type = private name = "private_0x000000f88aa70000" filename = "" Region: id = 3187 start_va = 0xf88ab70000 end_va = 0xf88ab73fff entry_point = 0xf88ab70000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3188 start_va = 0xf88ab80000 end_va = 0xf88ab82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f88ab80000" filename = "" Region: id = 3189 start_va = 0xf88ab90000 end_va = 0xf88ab91fff entry_point = 0xf88ab90000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 3190 start_va = 0xf88aba0000 end_va = 0xf88ac9ffff entry_point = 0xf88aba0000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 3191 start_va = 0xf88aca0000 end_va = 0xf88ace7fff entry_point = 0x0 region_type = private name = "private_0x000000f88aca0000" filename = "" Region: id = 3192 start_va = 0xf88acf0000 end_va = 0xf88ad00fff entry_point = 0xf88acf0000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 3193 start_va = 0xf88ad10000 end_va = 0xf88ae0ffff entry_point = 0xf88ad10000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 3194 start_va = 0xf88ae50000 end_va = 0xf88ae57fff entry_point = 0x0 region_type = private name = "private_0x000000f88ae50000" filename = "" Region: id = 3195 start_va = 0xf88ae60000 end_va = 0xf88aedffff entry_point = 0x0 region_type = private name = "private_0x000000f88ae60000" filename = "" Region: id = 3196 start_va = 0xf88af60000 end_va = 0xf88af60fff entry_point = 0x0 region_type = private name = "private_0x000000f88af60000" filename = "" Region: id = 3197 start_va = 0xf88af70000 end_va = 0xf88af70fff entry_point = 0x0 region_type = private name = "private_0x000000f88af70000" filename = "" Region: id = 3198 start_va = 0xf88afc0000 end_va = 0xf88afcffff entry_point = 0x0 region_type = private name = "private_0x000000f88afc0000" filename = "" Region: id = 3199 start_va = 0xf88afd0000 end_va = 0xf88b1cffff entry_point = 0x0 region_type = private name = "private_0x000000f88afd0000" filename = "" Region: id = 3200 start_va = 0xf88b1d0000 end_va = 0xf88b245fff entry_point = 0xf88b1d0000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 3201 start_va = 0xf88b250000 end_va = 0xf88c24ffff entry_point = 0xf88b250000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 3202 start_va = 0xf88c250000 end_va = 0xf88ca4ffff entry_point = 0xf88c250000 region_type = mapped_file name = "~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1462094071-1423818996-289466292-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat") Region: id = 3203 start_va = 0xf88ca50000 end_va = 0xf88cb2efff entry_point = 0xf88ca50000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 3204 start_va = 0xf88cb30000 end_va = 0xf88cc12fff entry_point = 0xf88cb30000 region_type = mapped_file name = "seguisb.ttf" filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf") Region: id = 3205 start_va = 0xf88cc20000 end_va = 0xf88cce2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f88cc20000" filename = "" Region: id = 3206 start_va = 0x7ff7bd3f0000 end_va = 0x7ff7bd3f1fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd3f0000" filename = "" Region: id = 3207 start_va = 0x7ff7bd3f2000 end_va = 0x7ff7bd3f3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd3f2000" filename = "" Region: id = 3208 start_va = 0x7ff7bd3f4000 end_va = 0x7ff7bd3f5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd3f4000" filename = "" Region: id = 3209 start_va = 0x7ff8dc6e0000 end_va = 0x7ff8dc778fff entry_point = 0x7ff8dc6e0000 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 3210 start_va = 0x7ff8dc780000 end_va = 0x7ff8dca11fff entry_point = 0x7ff8dc780000 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 3211 start_va = 0x7ff8dcfd0000 end_va = 0x7ff8dd018fff entry_point = 0x7ff8dcfd0000 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 3212 start_va = 0x7ff8dd900000 end_va = 0x7ff8dd94afff entry_point = 0x7ff8dd900000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 3213 start_va = 0x7ff8e3070000 end_va = 0x7ff8e30f8fff entry_point = 0x7ff8e3070000 region_type = mapped_file name = "directmanipulation.dll" filename = "\\Windows\\System32\\directmanipulation.dll" (normalized: "c:\\windows\\system32\\directmanipulation.dll") Region: id = 3214 start_va = 0x7ff8e86a0000 end_va = 0x7ff8e8851fff entry_point = 0x7ff8e86a0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 3215 start_va = 0x7ff8eac70000 end_va = 0x7ff8ead07fff entry_point = 0x7ff8eac70000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Thread: id = 204 os_tid = 0xd04 Thread: id = 205 os_tid = 0xce4 Thread: id = 206 os_tid = 0xcd8 Thread: id = 207 os_tid = 0xcec Thread: id = 208 os_tid = 0xdbc Thread: id = 209 os_tid = 0xdc4 [0096.101] TranslateMessage (lpMsg=0xf8881ef6a8) returned 0 [0096.101] DispatchMessageW (lpMsg=0xf8881ef6a8) returned 0x1 [0096.105] GetMessageW (in: lpMsg=0xf8881ef6a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf8881ef6a8) returned 1 [0096.224] TranslateMessage (lpMsg=0xf8881ef6a8) returned 0 [0096.224] DispatchMessageW (lpMsg=0xf8881ef6a8) returned 0x1 [0096.443] IUnknown_Set (in: ppunk=0xf8886d5f60*=0x0, punk=0xf8883a2fe8 | out: ppunk=0xf8886d5f60*=0xf8883a2fe8) [0096.443] GetMessageW (in: lpMsg=0xf8881ef6a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf8881ef6a8) returned 1 [0096.447] TranslateMessage (lpMsg=0xf8881ef6a8) returned 0 [0096.447] DispatchMessageW (lpMsg=0xf8881ef6a8) returned 0x1 [0096.447] GetMessageW (in: lpMsg=0xf8881ef6a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf8881ef6a8) returned 1 [0096.449] TranslateMessage (lpMsg=0xf8881ef6a8) returned 0 [0096.449] DispatchMessageW (lpMsg=0xf8881ef6a8) returned 0x1 [0096.449] Str_SetPtrW (in: ppsz=0xf8886d5fa8*=0x0, psz="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: ppsz=0xf8886d5fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0096.449] GetMessageW (in: lpMsg=0xf8881ef6a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf8881ef6a8) returned 1 [0096.450] TranslateMessage (lpMsg=0xf8881ef6a8) returned 0 [0096.450] DispatchMessageW (lpMsg=0xf8881ef6a8) returned 0x1 [0096.451] GetMessageW (in: lpMsg=0xf8881ef6a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf8881ef6a8) returned 1 [0096.461] TranslateMessage (lpMsg=0xf8881ef6a8) returned 0 [0096.461] DispatchMessageW (lpMsg=0xf8881ef6a8) returned 0x1 [0096.462] GetMessageW (in: lpMsg=0xf8881ef6a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf8881ef6a8) returned 1 [0096.621] TranslateMessage (lpMsg=0xf8881ef6a8) returned 0 [0096.621] DispatchMessageW (lpMsg=0xf8881ef6a8) returned 0x1 [0096.629] IUnknown_Set (in: ppunk=0xf8886d5fc0*=0x0, punk=0xf8883a7f48 | out: ppunk=0xf8886d5fc0*=0xf8883a7f48) [0096.629] GetMessageW (in: lpMsg=0xf8881ef6a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf8881ef6a8) returned 1 [0096.693] TranslateMessage (lpMsg=0xf8881ef6a8) returned 0 [0096.693] DispatchMessageW (lpMsg=0xf8881ef6a8) returned 0x1 [0096.694] GetMessageW (in: lpMsg=0xf8881ef6a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf8881ef6a8) returned 1 [0096.735] TranslateMessage (lpMsg=0xf8881ef6a8) returned 0 [0096.735] DispatchMessageW (lpMsg=0xf8881ef6a8) returned 0x1 [0096.736] GetMessageW (in: lpMsg=0xf8881ef6a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf8881ef6a8) returned 1 [0096.860] TranslateMessage (lpMsg=0xf8881ef6a8) returned 0 [0096.860] DispatchMessageW (lpMsg=0xf8881ef6a8) returned 0x1 [0096.861] CoTaskMemAlloc (cb=0xa) returned 0xf88838d830 [0096.907] GetMessageW (in: lpMsg=0xf8881ef6a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf8881ef6a8) returned 1 [0096.908] TranslateMessage (lpMsg=0xf8881ef6a8) returned 0 [0096.908] DispatchMessageW (lpMsg=0xf8881ef6a8) returned 0x1 [0096.908] GetMessageW (in: lpMsg=0xf8881ef6a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf8881ef6a8) returned 1 [0096.909] TranslateMessage (lpMsg=0xf8881ef6a8) returned 0 [0096.909] DispatchMessageW (lpMsg=0xf8881ef6a8) returned 0x1 [0096.909] GetMessageW (in: lpMsg=0xf8881ef6a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf8881ef6a8) returned 1 [0096.910] TranslateMessage (lpMsg=0xf8881ef6a8) returned 0 [0096.910] DispatchMessageW (lpMsg=0xf8881ef6a8) returned 0x1 [0096.910] KillTimer (hWnd=0x0, uIDEvent=0x7f75) returned 1 [0096.910] CompareStringOrdinal (lpString1="InvokeDefaultVerbInOtherProcess", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 1 [0096.910] CoCreateInstance (in: rclsid=0x7ff7bd6575b0*(Data1=0x94b23d4d, Data2=0x1040, Data3=0x4c4b, Data4=([0]=0x90, [1]=0x81, [2]=0x85, [3]=0xd8, [4]=0xd6, [5]=0xfa, [6]=0x36, [7]=0xc4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7bd657a50*(Data1=0xce149b23, Data2=0x5941, Data3=0x4079, Data4=([0]=0x92, [1]=0x23, [2]=0x52, [3]=0xc0, [4]=0xa9, [5]=0x91, [6]=0xec, [7]=0x48)), ppv=0xf8886d5fe0 | out: ppv=0xf8886d5fe0*=0xf8886d9620) returned 0x0 [0096.932] IUnknown_SetSite (punk=0xf8886d9620, punkSite=0xf8886d5f40) returned 0x0 [0096.932] IUnknown:QueryInterface (This=0xf8886d5f40, riid=0x7ff8ee00d438*(Data1=0x114, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xf8881edff0) [0096.932] IUnknown:QueryInterface (This=0xf8886d5f40, riid=0x7ff8ee00d468*(Data1=0x79eac9ed, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xf8881edfe0) [0096.932] IUnknown:QueryInterface (This=0xf8886d5f40, riid=0x7ff8ee00d458*(Data1=0x214e3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xf8881edfe8) [0096.932] IUnknown:QueryInterface (This=0xf8886d5f40, riid=0x7ff8ee00d448*(Data1=0x45d64a29, Data2=0xa63e, Data3=0x4cb6, Data4=([0]=0xb4, [1]=0x98, [2]=0x57, [3]=0x81, [4]=0xd2, [5]=0x98, [6]=0xcb, [7]=0x4f)), ppvObject=0xf8881edff8) [0096.932] IUnknown:QueryInterface (This=0xf8886d5f40, riid=0x7ff8eb8347d8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0xf8881ee020) [0096.932] IUnknown:QueryInterface (in: This=0xf8883a2fe8, riid=0x7ff8de1e0bd8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xf8881ee050 | out: ppvObject=0xf8881ee050*=0xf8883a2fe8) returned 0x0 [0096.993] IUnknown:QueryInterface (This=0xf8886d5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xf8881ee050) [0096.993] IUnknown:AddRef (This=0xf8886d5f40) returned 0xe [0096.993] IUnknown_QueryService (in: punk=0xf8883a2fe8, guidService=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), riid=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), ppvOut=0xf8886d96e0 | out: ppvOut=0xf8886d96e0*=0x0) returned 0x80004001 [0097.051] IUnknown:Release (This=0xf8886d5f40) returned 0xd [0097.051] IUnknown:QueryInterface (This=0xf8886d5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xf8881ee050) [0097.051] IUnknown:AddRef (This=0xf8886d5f40) returned 0xe [0097.051] IUnknown_QueryService (in: punk=0xf8883a2fe8, guidService=0x7ff8de1c0980*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), riid=0x7ff8de1c0a40*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), ppvOut=0xf8886d96e8 | out: ppvOut=0xf8886d96e8*=0x0) returned 0x80004001 [0097.052] IUnknown:Release (This=0xf8886d5f40) returned 0xd [0097.052] IUnknown:QueryInterface (This=0xf8886d5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xf8881ee050) [0097.052] IUnknown:AddRef (This=0xf8886d5f40) returned 0xe [0097.052] IUnknown_QueryService (in: punk=0xf8883a2fe8, guidService=0x7ff8de1c0950*(Data1=0xcde725b0, Data2=0xccc9, Data3=0x4519, Data4=([0]=0x91, [1]=0x7e, [2]=0x32, [3]=0x5d, [4]=0x72, [5]=0xfa, [6]=0xb4, [7]=0xce)), riid=0x7ff8de1d2fb0*(Data1=0x1af3a467, Data2=0x214f, Data3=0x4298, Data4=([0]=0x90, [1]=0x8e, [2]=0x6, [3]=0xb0, [4]=0x3e, [5]=0xb, [6]=0x39, [7]=0xf9)), ppvOut=0xf8886d96f0 | out: ppvOut=0xf8886d96f0*=0x0) returned 0x80004001 [0097.052] IUnknown:Release (This=0xf8886d5f40) returned 0xd [0097.052] IUnknown:QueryInterface (This=0xf8886d5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xf8881ee050) [0097.052] IUnknown:AddRef (This=0xf8886d5f40) returned 0xe [0097.052] IUnknown_QueryService (in: punk=0xf8883a2fe8, guidService=0x7ff8de1c0800*(Data1=0x80605492, Data2=0x67d9, Data3=0x414f, Data4=([0]=0xaf, [1]=0x89, [2]=0xa1, [3]=0xcd, [4]=0xf1, [5]=0x24, [6]=0x2b, [7]=0xc1)), riid=0x7ff8de1c0068*(Data1=0xe5aa01f7, Data2=0x1fb8, Data3=0x4830, Data4=([0]=0x87, [1]=0x20, [2]=0x4e, [3]=0x67, [4]=0x34, [5]=0xcb, [6]=0xd5, [7]=0xf3)), ppvOut=0xf8886d96f8 | out: ppvOut=0xf8886d96f8*=0x0) returned 0x80004001 [0097.053] IUnknown:Release (This=0xf8886d5f40) returned 0xd [0097.053] IUnknown:QueryInterface (This=0xf8886d5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xf8881ee050) [0097.053] IUnknown:AddRef (This=0xf8886d5f40) returned 0xe [0097.053] IUnknown_QueryService (in: punk=0xf8883a2fe8, guidService=0x7ff8de1c0810*(Data1=0x2ce78010, Data2=0x74db, Data3=0x48bc, Data4=([0]=0x9c, [1]=0x6a, [2]=0x10, [3]=0xf3, [4]=0x72, [5]=0x49, [6]=0x57, [7]=0x23)), riid=0x7ff8de1bfb70*(Data1=0x989191ac, Data2=0x28ff, Data3=0x4cf0, Data4=([0]=0x95, [1]=0x84, [2]=0xe0, [3]=0xd0, [4]=0x78, [5]=0xbc, [6]=0x23, [7]=0x96)), ppvOut=0xf8886d9700 | out: ppvOut=0xf8886d9700*=0x0) returned 0x80004001 [0097.054] IUnknown:Release (This=0xf8886d5f40) returned 0xd [0097.054] IUnknown:QueryInterface (This=0xf8886d5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xf8881ee050) [0097.054] IUnknown:AddRef (This=0xf8886d5f40) returned 0xe [0097.054] IUnknown_QueryService (in: punk=0xf8883a2fe8, guidService=0x7ff8de1c0078*(Data1=0x26db2472, Data2=0xb7b7, Data3=0x406b, Data4=([0]=0x97, [1]=0x2, [2]=0x73, [3]=0xa, [4]=0x4e, [5]=0x20, [6]=0xd3, [7]=0xbf)), riid=0x7ff8de1c0a10*(Data1=0x2f0666c6, Data2=0x12f7, Data3=0x4360, Data4=([0]=0xb5, [1]=0x11, [2]=0xa3, [3]=0x94, [4]=0xa0, [5]=0x55, [6]=0x37, [7]=0x25)), ppvOut=0xf8886d9708 | out: ppvOut=0xf8886d9708*=0x0) returned 0x80004001 [0097.054] IUnknown:Release (This=0xf8886d5f40) returned 0xd [0097.054] IUnknown:QueryInterface (This=0xf8886d5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xf8881ee050) [0097.054] IUnknown:AddRef (This=0xf8886d5f40) returned 0xe [0097.054] IUnknown_QueryService (in: punk=0xf8883a2fe8, guidService=0x7ff8de1c0930*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), riid=0x7ff8de1c0a30*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), ppvOut=0xf8886d9bf0 | out: ppvOut=0xf8886d9bf0*=0x0) returned 0x80004001 [0097.055] IUnknown:Release (This=0xf8886d5f40) returned 0xd [0097.055] IUnknown:QueryInterface (This=0xf8886d5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xf8881ee050) [0097.055] IUnknown:AddRef (This=0xf8886d5f40) returned 0xe [0097.055] IUnknown_QueryService (in: punk=0xf8883a2fe8, guidService=0x7ff8de27c2c0*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff8de27fc98*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xf8881ee090 | out: ppvOut=0xf8881ee090*=0x0) returned 0x80004001 [0097.056] IUnknown:Release (This=0xf8886d5f40) returned 0xd [0097.056] IUnknown:AddRef (This=0xf8886d5f40) returned 0xe [0097.056] GetCurrentThreadId () returned 0xdc4 [0097.056] PostThreadMessageW (idThread=0xdc4, Msg=0x8001, wParam=0x0, lParam=0x0) returned 1 [0097.056] GetMessageW (in: lpMsg=0xf8881ef6a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf8881ef6a8) returned 1 [0097.056] CompareStringOrdinal (lpString1="openas", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0097.056] CompareStringOrdinal (lpString1="OpenWithSetDefaultOn", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0097.056] IUnknown_QueryService (in: punk=0xf8883a2fe8, guidService=0x7ff7bd657da0*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), riid=0x7ff7bd657910*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), ppvOut=0xf8881ef738 | out: ppvOut=0xf8881ef738*=0xf8883ac0d8) returned 0x0 [0097.099] IUnknown_Set (in: ppunk=0xf8886d5f60*=0xf8883a2fe8, punk=0x0 | out: ppunk=0xf8886d5f60*=0x0) [0097.101] IUnknown_QueryService (in: punk=0x0, guidService=0x7ff7bd657d60*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff7bd657950*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xf8881ef688 | out: ppvOut=0xf8881ef688*=0x0) returned 0x80004001 [0097.101] QISearch (in: that=0xf8886d5f30, pqit=0x7ff7bd657970, riid=0x7ff7bd657ac0*(Data1=0x1c9cd5bb, Data2=0x98e9, Data3=0x4491, Data4=([0]=0xa6, [1]=0xf, [2]=0x31, [3]=0xaa, [4]=0xcc, [5]=0x72, [6]=0xb8, [7]=0x3c)), ppv=0xf8881ef5e8 | out: that=0xf8886d5f30, ppv=0xf8881ef5e8*=0xf8886d5f78) returned 0x0 [0097.101] IUnknown:QueryInterface (in: This=0xf8883a7f48, riid=0x7ff7bd657930*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xf8881ef680 | out: ppvObject=0xf8881ef680*=0xf8883a7f48) returned 0x0 [0097.101] IShellItemArray:GetItemAt (in: This=0xf8883a7f48, dwIndex=0x0, ppsi=0xf8881ef670 | out: ppsi=0xf8881ef670*=0xf8883afa08) returned 0x0 [0097.101] IUnknown:QueryInterface (in: This=0xf8883afa08, riid=0x7ff7bd657b10*(Data1=0x7e9fb0d3, Data2=0x919f, Data3=0x4307, Data4=([0]=0xab, [1]=0x2e, [2]=0x9b, [3]=0x18, [4]=0x60, [5]=0x31, [6]=0xc, [7]=0x93)), ppvObject=0xf8881ef678 | out: ppvObject=0xf8881ef678*=0xf8883afa08) returned 0x0 [0097.102] IUnknown:Release (This=0xf8883afa08) returned 0x1 [0097.102] IShellItem:BindToHandler (in: This=0xf8883afa08, pbc=0x0, bhid=0x7ff7bd657db0, riid=0x7ff7bd657920, ppv=0xf8881ef670 | out: ppv=0xf8881ef670) returned 0x0 [0097.106] IUnknown:Release (This=0xf8883afa08) returned 0x0 [0097.106] IUnknown:Release (This=0xf8883a7f48) returned 0x1 [0097.106] IUnknown:AddRef (This=0xf8886d5f78) returned 0xf [0097.106] IObjectWithSelection:GetSelection (in: This=0xf8886d5f78, riid=0x7ff8de1c76a8, ppv=0xf8886d9718 | out: ppv=0xf8886d9718) returned 0x0 [0097.106] IUnknown:QueryInterface (in: This=0xf8883a7f48, riid=0x7ff8de1c76a8*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xf8886d9718 | out: ppvObject=0xf8886d9718*=0xf8883a7f48) returned 0x0 [0097.106] IUnknown:Release (This=0xf8886d5f78) returned 0xe [0097.115] IUnknown:Release (This=0xf8886d5f78) returned 0x7 [0097.115] IUnknown:Release (This=0xf8886d5f78) returned 0x6 [0113.569] IUnknown:Release (This=0xf8883a7f48) returned 0x1 [0113.569] IUnknown_SetSite (punk=0xf8886d9620, punkSite=0x0) returned 0x0 [0113.569] IUnknown:Release (This=0xf8886d5f40) returned 0x2 [0113.569] PostQuitMessage (nExitCode=0) [0113.569] TranslateMessage (lpMsg=0xf8881ef6a8) returned 0 [0113.569] DispatchMessageW (lpMsg=0xf8881ef6a8) returned 0x0 [0113.569] GetMessageW (in: lpMsg=0xf8881ef6a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xf8881ef6a8) returned 0 [0113.569] CoRevokeClassObject (dwRegister=0x10) returned 0x0 [0113.570] IUnknown:Release (This=0xf8886d9620) returned 0x0 [0113.590] CoTaskMemFree (pv=0xf88838d830) [0113.590] Str_SetPtrW (in: ppsz=0xf8886d5fa0*=0x0, psz=0x0 | out: ppsz=0xf8886d5fa0*=0x0) returned 1 [0113.590] Str_SetPtrW (in: ppsz=0xf8886d5fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop", psz=0x0 | out: ppsz=0xf8886d5fa8*=0x0) returned 1 [0113.590] SHSetThreadRef (punk=0x0) returned 0x0 [0113.590] CoUninitialize () [0113.613] LocalFree (hMem=0xf88837bb00) returned 0x0 [0113.613] EtwEventUnregister (RegHandle=0x2800f888380560) returned 0x0 [0113.613] exit (_Code=0) Thread: id = 224 os_tid = 0xec4 Thread: id = 225 os_tid = 0xec0 Thread: id = 226 os_tid = 0xe60 Thread: id = 227 os_tid = 0xee0 Thread: id = 228 os_tid = 0xedc Thread: id = 229 os_tid = 0xeec Thread: id = 291 os_tid = 0xdf8 Thread: id = 292 os_tid = 0xe24 Process: id = "16" image_name = "openwith.exe" filename = "c:\\windows\\system32\\openwith.exe" page_root = "0x5f5ed000" os_pid = "0xcdc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xdd4" cmd_line = "C:\\Windows\\system32\\OpenWith.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2398 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2399 start_va = 0x1f5efd0000 end_va = 0x1f5efdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f5efd0000" filename = "" Region: id = 2400 start_va = 0x1f5efe0000 end_va = 0x1f5efe6fff entry_point = 0x0 region_type = private name = "private_0x0000001f5efe0000" filename = "" Region: id = 2401 start_va = 0x1f5eff0000 end_va = 0x1f5f003fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f5eff0000" filename = "" Region: id = 2402 start_va = 0x1f5f010000 end_va = 0x1f5f08ffff entry_point = 0x0 region_type = private name = "private_0x0000001f5f010000" filename = "" Region: id = 2403 start_va = 0x1f5f090000 end_va = 0x1f5f093fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f5f090000" filename = "" Region: id = 2404 start_va = 0x1f5f0a0000 end_va = 0x1f5f0a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f5f0a0000" filename = "" Region: id = 2405 start_va = 0x1f5f0b0000 end_va = 0x1f5f0b1fff entry_point = 0x0 region_type = private name = "private_0x0000001f5f0b0000" filename = "" Region: id = 2406 start_va = 0x1f5f0c0000 end_va = 0x1f5f0c6fff entry_point = 0x0 region_type = private name = "private_0x0000001f5f0c0000" filename = "" Region: id = 2407 start_va = 0x1f5f0d0000 end_va = 0x1f5f1cffff entry_point = 0x0 region_type = private name = "private_0x0000001f5f0d0000" filename = "" Region: id = 2408 start_va = 0x1f5f1d0000 end_va = 0x1f5f28dfff entry_point = 0x1f5f1d0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2409 start_va = 0x1f5f290000 end_va = 0x1f5f30ffff entry_point = 0x0 region_type = private name = "private_0x0000001f5f290000" filename = "" Region: id = 2410 start_va = 0x1f5f310000 end_va = 0x1f5f497fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f5f310000" filename = "" Region: id = 2411 start_va = 0x1f5f4a0000 end_va = 0x1f5f4a0fff entry_point = 0x1f5f4a0000 region_type = mapped_file name = "openwith.exe.mui" filename = "\\Windows\\System32\\en-US\\OpenWith.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\openwith.exe.mui") Region: id = 2412 start_va = 0x1f5f4b0000 end_va = 0x1f5f4bffff entry_point = 0x0 region_type = private name = "private_0x0000001f5f4b0000" filename = "" Region: id = 2413 start_va = 0x1f5f4c0000 end_va = 0x1f5f640fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f5f4c0000" filename = "" Region: id = 2414 start_va = 0x1f5f650000 end_va = 0x1f60a4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f5f650000" filename = "" Region: id = 2415 start_va = 0x1f60a50000 end_va = 0x1f60a50fff entry_point = 0x0 region_type = private name = "private_0x0000001f60a50000" filename = "" Region: id = 2416 start_va = 0x1f60a60000 end_va = 0x1f60a60fff entry_point = 0x0 region_type = private name = "private_0x0000001f60a60000" filename = "" Region: id = 2417 start_va = 0x1f60a70000 end_va = 0x1f60a70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f60a70000" filename = "" Region: id = 2418 start_va = 0x1f60a80000 end_va = 0x1f60a81fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f60a80000" filename = "" Region: id = 2419 start_va = 0x1f60a90000 end_va = 0x1f60b0ffff entry_point = 0x0 region_type = private name = "private_0x0000001f60a90000" filename = "" Region: id = 2420 start_va = 0x1f60b30000 end_va = 0x1f60b3ffff entry_point = 0x0 region_type = private name = "private_0x0000001f60b30000" filename = "" Region: id = 2421 start_va = 0x1f60b40000 end_va = 0x1f60e76fff entry_point = 0x1f60b40000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2422 start_va = 0x1f60e80000 end_va = 0x1f60efffff entry_point = 0x0 region_type = private name = "private_0x0000001f60e80000" filename = "" Region: id = 2423 start_va = 0x1f60f00000 end_va = 0x1f60f7ffff entry_point = 0x0 region_type = private name = "private_0x0000001f60f00000" filename = "" Region: id = 2424 start_va = 0x1f60f80000 end_va = 0x1f60ffffff entry_point = 0x0 region_type = private name = "private_0x0000001f60f80000" filename = "" Region: id = 2425 start_va = 0x7df5ffa70000 end_va = 0x7ff5ffa6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffa70000" filename = "" Region: id = 2426 start_va = 0x7ff7bcf3e000 end_va = 0x7ff7bcf3ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf3e000" filename = "" Region: id = 2427 start_va = 0x7ff7bcf40000 end_va = 0x7ff7bd03ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bcf40000" filename = "" Region: id = 2428 start_va = 0x7ff7bd040000 end_va = 0x7ff7bd062fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bd040000" filename = "" Region: id = 2429 start_va = 0x7ff7bd064000 end_va = 0x7ff7bd065fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd064000" filename = "" Region: id = 2430 start_va = 0x7ff7bd066000 end_va = 0x7ff7bd067fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd066000" filename = "" Region: id = 2431 start_va = 0x7ff7bd068000 end_va = 0x7ff7bd069fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd068000" filename = "" Region: id = 2432 start_va = 0x7ff7bd06a000 end_va = 0x7ff7bd06bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd06a000" filename = "" Region: id = 2433 start_va = 0x7ff7bd06c000 end_va = 0x7ff7bd06dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd06c000" filename = "" Region: id = 2434 start_va = 0x7ff7bd06e000 end_va = 0x7ff7bd06efff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd06e000" filename = "" Region: id = 2435 start_va = 0x7ff7bd650000 end_va = 0x7ff7bd669fff entry_point = 0x7ff7bd650000 region_type = mapped_file name = "openwith.exe" filename = "\\Windows\\System32\\OpenWith.exe" (normalized: "c:\\windows\\system32\\openwith.exe") Region: id = 2436 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 2437 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 2438 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2439 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2440 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2441 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2442 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2443 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2444 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2445 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2446 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2447 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 2448 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2449 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2450 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2451 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2452 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2453 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2454 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2455 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2456 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2457 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2458 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2459 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2460 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2461 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2462 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2463 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2464 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2465 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2556 start_va = 0x1f60b10000 end_va = 0x1f60b10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f60b10000" filename = "" Region: id = 2557 start_va = 0x1f60b20000 end_va = 0x1f60b20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f60b20000" filename = "" Region: id = 2558 start_va = 0x7ff8ddbd0000 end_va = 0x7ff8de6dcfff entry_point = 0x7ff8ddbd0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 2559 start_va = 0x7ff8e9860000 end_va = 0x7ff8e994dfff entry_point = 0x7ff8e9860000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 2560 start_va = 0x7ff8e3a70000 end_va = 0x7ff8e3c26fff entry_point = 0x7ff8e3a70000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 2561 start_va = 0x1f61000000 end_va = 0x1f61002fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f61000000" filename = "" Region: id = 2562 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2563 start_va = 0x7ff8e7430000 end_va = 0x7ff8e7560fff entry_point = 0x7ff8e7430000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 2564 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2769 start_va = 0x1f61010000 end_va = 0x1f61039fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f61010000" filename = "" Region: id = 2770 start_va = 0x1f61040000 end_va = 0x1f61040fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f61040000" filename = "" Region: id = 2771 start_va = 0x1f61050000 end_va = 0x1f61051fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f61050000" filename = "" Region: id = 2772 start_va = 0x1f61060000 end_va = 0x1f610dffff entry_point = 0x0 region_type = private name = "private_0x0000001f61060000" filename = "" Region: id = 2773 start_va = 0x1f610e0000 end_va = 0x1f6115ffff entry_point = 0x0 region_type = private name = "private_0x0000001f610e0000" filename = "" Region: id = 2774 start_va = 0x7ff7bcf3a000 end_va = 0x7ff7bcf3bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf3a000" filename = "" Region: id = 2775 start_va = 0x7ff7bcf3c000 end_va = 0x7ff7bcf3dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf3c000" filename = "" Region: id = 2776 start_va = 0x7ff8d1180000 end_va = 0x7ff8d132ffff entry_point = 0x7ff8d1180000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 2777 start_va = 0x7ff8d1330000 end_va = 0x7ff8d147bfff entry_point = 0x7ff8d1330000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 2778 start_va = 0x7ff8d76a0000 end_va = 0x7ff8d7738fff entry_point = 0x7ff8d76a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 2783 start_va = 0x1f61160000 end_va = 0x1f61161fff entry_point = 0x1f61160000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 2784 start_va = 0x1f61170000 end_va = 0x1f61173fff entry_point = 0x1f61170000 region_type = mapped_file name = "windows.ui.immersive.dll.mui" filename = "\\Windows\\System32\\en-US\\Windows.UI.Immersive.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.ui.immersive.dll.mui") Region: id = 2785 start_va = 0x1f61180000 end_va = 0x1f611fffff entry_point = 0x0 region_type = private name = "private_0x0000001f61180000" filename = "" Region: id = 2786 start_va = 0x1f61200000 end_va = 0x1f612fffff entry_point = 0x0 region_type = private name = "private_0x0000001f61200000" filename = "" Region: id = 2787 start_va = 0x1f61300000 end_va = 0x1f61300fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f61300000" filename = "" Region: id = 2788 start_va = 0x1f61310000 end_va = 0x1f61310fff entry_point = 0x0 region_type = private name = "private_0x0000001f61310000" filename = "" Region: id = 2789 start_va = 0x1f61320000 end_va = 0x1f61320fff entry_point = 0x0 region_type = private name = "private_0x0000001f61320000" filename = "" Region: id = 2790 start_va = 0x1f61330000 end_va = 0x1f613affff entry_point = 0x0 region_type = private name = "private_0x0000001f61330000" filename = "" Region: id = 2791 start_va = 0x1f613b0000 end_va = 0x1f613b0fff entry_point = 0x0 region_type = private name = "private_0x0000001f613b0000" filename = "" Region: id = 2792 start_va = 0x1f613c0000 end_va = 0x1f613c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f613c0000" filename = "" Region: id = 2793 start_va = 0x1f613d0000 end_va = 0x1f613e3fff entry_point = 0x1f613d0000 region_type = mapped_file name = "twinui.dll.mui" filename = "\\Windows\\System32\\en-US\\twinui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\twinui.dll.mui") Region: id = 2794 start_va = 0x1f613f0000 end_va = 0x1f613f1fff entry_point = 0x1f613f0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 2795 start_va = 0x1f61400000 end_va = 0x1f61404fff entry_point = 0x1f61400000 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 2796 start_va = 0x1f61410000 end_va = 0x1f6150ffff entry_point = 0x0 region_type = private name = "private_0x0000001f61410000" filename = "" Region: id = 2797 start_va = 0x7ff7bcf36000 end_va = 0x7ff7bcf37fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf36000" filename = "" Region: id = 2798 start_va = 0x7ff7bcf38000 end_va = 0x7ff7bcf39fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf38000" filename = "" Region: id = 2799 start_va = 0x7ff8debc0000 end_va = 0x7ff8dec28fff entry_point = 0x7ff8debc0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 2800 start_va = 0x7ff8e37f0000 end_va = 0x7ff8e3a48fff entry_point = 0x7ff8e37f0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 2801 start_va = 0x7ff8e8650000 end_va = 0x7ff8e869afff entry_point = 0x7ff8e8650000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 2802 start_va = 0x7ff8e8860000 end_va = 0x7ff8e8acdfff entry_point = 0x7ff8e8860000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 2803 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 2804 start_va = 0x7ff8e8c60000 end_va = 0x7ff8e8cfbfff entry_point = 0x7ff8e8c60000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2805 start_va = 0x7ff8e8d00000 end_va = 0x7ff8e8fa2fff entry_point = 0x7ff8e8d00000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 2806 start_va = 0x7ff8e9130000 end_va = 0x7ff8e9200fff entry_point = 0x7ff8e9130000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 3287 start_va = 0x1f61510000 end_va = 0x1f61513fff entry_point = 0x1f61510000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3288 start_va = 0x1f61520000 end_va = 0x1f61532fff entry_point = 0x1f61520000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 3289 start_va = 0x1f61540000 end_va = 0x1f61540fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f61540000" filename = "" Region: id = 3290 start_va = 0x1f61550000 end_va = 0x1f6156bfff entry_point = 0x1f61550000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db") Region: id = 3291 start_va = 0x1f61570000 end_va = 0x1f615effff entry_point = 0x0 region_type = private name = "private_0x0000001f61570000" filename = "" Region: id = 3292 start_va = 0x1f615f0000 end_va = 0x1f6166ffff entry_point = 0x0 region_type = private name = "private_0x0000001f615f0000" filename = "" Region: id = 3293 start_va = 0x1f61670000 end_va = 0x1f61673fff entry_point = 0x1f61670000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3294 start_va = 0x1f61680000 end_va = 0x1f616c2fff entry_point = 0x1f61680000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db") Region: id = 3295 start_va = 0x1f616d0000 end_va = 0x1f616d3fff entry_point = 0x1f616d0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3296 start_va = 0x1f616e0000 end_va = 0x1f6176afff entry_point = 0x1f616e0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 3297 start_va = 0x1f61770000 end_va = 0x1f6186ffff entry_point = 0x0 region_type = private name = "private_0x0000001f61770000" filename = "" Region: id = 3298 start_va = 0x1f61870000 end_va = 0x1f61872fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f61870000" filename = "" Region: id = 3299 start_va = 0x1f61890000 end_va = 0x1f61893fff entry_point = 0x1f61890000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3300 start_va = 0x1f618a0000 end_va = 0x1f618a1fff entry_point = 0x1f618a0000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 3301 start_va = 0x1f618b0000 end_va = 0x1f618b8fff entry_point = 0x0 region_type = private name = "private_0x0000001f618b0000" filename = "" Region: id = 3302 start_va = 0x1f618c0000 end_va = 0x1f618c0fff entry_point = 0x0 region_type = private name = "private_0x0000001f618c0000" filename = "" Region: id = 3303 start_va = 0x1f618d0000 end_va = 0x1f618f3fff entry_point = 0x0 region_type = private name = "private_0x0000001f618d0000" filename = "" Region: id = 3304 start_va = 0x1f61900000 end_va = 0x1f61908fff entry_point = 0x0 region_type = private name = "private_0x0000001f61900000" filename = "" Region: id = 3305 start_va = 0x1f61910000 end_va = 0x1f61a0ffff entry_point = 0x0 region_type = private name = "private_0x0000001f61910000" filename = "" Region: id = 3306 start_va = 0x1f61a20000 end_va = 0x1f61a22fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000001f61a20000" filename = "" Region: id = 3307 start_va = 0x1f61a30000 end_va = 0x1f61a31fff entry_point = 0x1f61a30000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 3308 start_va = 0x1f61a40000 end_va = 0x1f61b3ffff entry_point = 0x1f61a40000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 3309 start_va = 0x1f61b40000 end_va = 0x1f61b87fff entry_point = 0x0 region_type = private name = "private_0x0000001f61b40000" filename = "" Region: id = 3310 start_va = 0x1f61b90000 end_va = 0x1f61ba0fff entry_point = 0x1f61b90000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 3311 start_va = 0x1f61bb0000 end_va = 0x1f61caffff entry_point = 0x1f61bb0000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 3312 start_va = 0x1f61cd0000 end_va = 0x1f61ecffff entry_point = 0x0 region_type = private name = "private_0x0000001f61cd0000" filename = "" Region: id = 3313 start_va = 0x1f61ee0000 end_va = 0x1f61ee7fff entry_point = 0x0 region_type = private name = "private_0x0000001f61ee0000" filename = "" Region: id = 3314 start_va = 0x1f61ef0000 end_va = 0x1f61f6ffff entry_point = 0x0 region_type = private name = "private_0x0000001f61ef0000" filename = "" Region: id = 3315 start_va = 0x1f61ff0000 end_va = 0x1f62065fff entry_point = 0x1f61ff0000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 3316 start_va = 0x1f62100000 end_va = 0x1f62100fff entry_point = 0x0 region_type = private name = "private_0x0000001f62100000" filename = "" Region: id = 3317 start_va = 0x1f62110000 end_va = 0x1f6211ffff entry_point = 0x0 region_type = private name = "private_0x0000001f62110000" filename = "" Region: id = 3318 start_va = 0x1f62120000 end_va = 0x1f6311ffff entry_point = 0x1f62120000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 3319 start_va = 0x1f63120000 end_va = 0x1f6391ffff entry_point = 0x1f63120000 region_type = mapped_file name = "~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1462094071-1423818996-289466292-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat") Region: id = 3320 start_va = 0x1f63920000 end_va = 0x1f639fefff entry_point = 0x1f63920000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 3321 start_va = 0x1f63a00000 end_va = 0x1f63ae2fff entry_point = 0x1f63a00000 region_type = mapped_file name = "seguisb.ttf" filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf") Region: id = 3322 start_va = 0x7ff7bcf30000 end_va = 0x7ff7bcf31fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf30000" filename = "" Region: id = 3323 start_va = 0x7ff7bcf32000 end_va = 0x7ff7bcf33fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf32000" filename = "" Region: id = 3324 start_va = 0x7ff7bcf34000 end_va = 0x7ff7bcf35fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcf34000" filename = "" Region: id = 3325 start_va = 0x7ff8dc6e0000 end_va = 0x7ff8dc778fff entry_point = 0x7ff8dc6e0000 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 3326 start_va = 0x7ff8dc780000 end_va = 0x7ff8dca11fff entry_point = 0x7ff8dc780000 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 3327 start_va = 0x7ff8dcfd0000 end_va = 0x7ff8dd018fff entry_point = 0x7ff8dcfd0000 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 3328 start_va = 0x7ff8dd900000 end_va = 0x7ff8dd94afff entry_point = 0x7ff8dd900000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 3329 start_va = 0x7ff8e3070000 end_va = 0x7ff8e30f8fff entry_point = 0x7ff8e3070000 region_type = mapped_file name = "directmanipulation.dll" filename = "\\Windows\\System32\\directmanipulation.dll" (normalized: "c:\\windows\\system32\\directmanipulation.dll") Region: id = 3330 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 3331 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 3332 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 3333 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3334 start_va = 0x7ff8e86a0000 end_va = 0x7ff8e8851fff entry_point = 0x7ff8e86a0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 3335 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 3336 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3337 start_va = 0x7ff8eac70000 end_va = 0x7ff8ead07fff entry_point = 0x7ff8eac70000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 3338 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Thread: id = 216 os_tid = 0xeb0 Thread: id = 217 os_tid = 0xeac Thread: id = 218 os_tid = 0xe9c Thread: id = 219 os_tid = 0xe40 Thread: id = 220 os_tid = 0xcd4 [0098.205] TranslateMessage (lpMsg=0x1f5f08f718) returned 0 [0098.205] DispatchMessageW (lpMsg=0x1f5f08f718) returned 0x1 [0098.209] GetMessageW (in: lpMsg=0x1f5f08f718, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f5f08f718) returned 1 [0098.209] TranslateMessage (lpMsg=0x1f5f08f718) returned 0 [0098.209] DispatchMessageW (lpMsg=0x1f5f08f718) returned 0x1 [0098.303] IUnknown_Set (in: ppunk=0x1f5f4b5f60*=0x0, punk=0x1f5f102b48 | out: ppunk=0x1f5f4b5f60*=0x1f5f102b48) [0098.303] GetMessageW (in: lpMsg=0x1f5f08f718, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f5f08f718) returned 1 [0098.350] TranslateMessage (lpMsg=0x1f5f08f718) returned 0 [0098.350] DispatchMessageW (lpMsg=0x1f5f08f718) returned 0x1 [0098.350] GetMessageW (in: lpMsg=0x1f5f08f718, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f5f08f718) returned 1 [0098.382] TranslateMessage (lpMsg=0x1f5f08f718) returned 0 [0098.382] DispatchMessageW (lpMsg=0x1f5f08f718) returned 0x1 [0098.382] Str_SetPtrW (in: ppsz=0x1f5f4b5fa8*=0x0, psz="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: ppsz=0x1f5f4b5fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0098.383] GetMessageW (in: lpMsg=0x1f5f08f718, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f5f08f718) returned 1 [0098.629] TranslateMessage (lpMsg=0x1f5f08f718) returned 0 [0098.629] DispatchMessageW (lpMsg=0x1f5f08f718) returned 0x1 [0098.629] GetMessageW (in: lpMsg=0x1f5f08f718, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f5f08f718) returned 1 [0098.656] TranslateMessage (lpMsg=0x1f5f08f718) returned 0 [0098.656] DispatchMessageW (lpMsg=0x1f5f08f718) returned 0x1 [0098.657] GetMessageW (in: lpMsg=0x1f5f08f718, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f5f08f718) returned 1 [0098.701] TranslateMessage (lpMsg=0x1f5f08f718) returned 0 [0098.701] DispatchMessageW (lpMsg=0x1f5f08f718) returned 0x1 [0098.709] IUnknown_Set (in: ppunk=0x1f5f4b5fc0*=0x0, punk=0x1f5f107f48 | out: ppunk=0x1f5f4b5fc0*=0x1f5f107f48) [0098.709] GetMessageW (in: lpMsg=0x1f5f08f718, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f5f08f718) returned 1 [0098.846] TranslateMessage (lpMsg=0x1f5f08f718) returned 0 [0098.846] DispatchMessageW (lpMsg=0x1f5f08f718) returned 0x1 [0098.846] GetMessageW (in: lpMsg=0x1f5f08f718, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f5f08f718) returned 1 [0098.892] TranslateMessage (lpMsg=0x1f5f08f718) returned 0 [0098.892] DispatchMessageW (lpMsg=0x1f5f08f718) returned 0x1 [0098.893] GetMessageW (in: lpMsg=0x1f5f08f718, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f5f08f718) returned 1 [0098.985] TranslateMessage (lpMsg=0x1f5f08f718) returned 0 [0098.985] DispatchMessageW (lpMsg=0x1f5f08f718) returned 0x1 [0098.986] CoTaskMemAlloc (cb=0xa) returned 0x1f5f0ed7b0 [0099.077] GetMessageW (in: lpMsg=0x1f5f08f718, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f5f08f718) returned 1 [0099.084] TranslateMessage (lpMsg=0x1f5f08f718) returned 0 [0099.084] DispatchMessageW (lpMsg=0x1f5f08f718) returned 0x1 [0099.084] GetMessageW (in: lpMsg=0x1f5f08f718, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f5f08f718) returned 1 [0099.090] TranslateMessage (lpMsg=0x1f5f08f718) returned 0 [0099.090] DispatchMessageW (lpMsg=0x1f5f08f718) returned 0x1 [0099.090] GetMessageW (in: lpMsg=0x1f5f08f718, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f5f08f718) returned 1 [0099.101] TranslateMessage (lpMsg=0x1f5f08f718) returned 0 [0099.101] DispatchMessageW (lpMsg=0x1f5f08f718) returned 0x1 [0099.101] KillTimer (hWnd=0x0, uIDEvent=0x7f6d) returned 1 [0099.101] CompareStringOrdinal (lpString1="InvokeDefaultVerbInOtherProcess", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 1 [0099.101] CoCreateInstance (in: rclsid=0x7ff7bd6575b0*(Data1=0x94b23d4d, Data2=0x1040, Data3=0x4c4b, Data4=([0]=0x90, [1]=0x81, [2]=0x85, [3]=0xd8, [4]=0xd6, [5]=0xfa, [6]=0x36, [7]=0xc4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7bd657a50*(Data1=0xce149b23, Data2=0x5941, Data3=0x4079, Data4=([0]=0x92, [1]=0x23, [2]=0x52, [3]=0xc0, [4]=0xa9, [5]=0x91, [6]=0xec, [7]=0x48)), ppv=0x1f5f4b5fe0 | out: ppv=0x1f5f4b5fe0*=0x1f5f4b9620) returned 0x0 [0099.123] IUnknown_SetSite (punk=0x1f5f4b9620, punkSite=0x1f5f4b5f40) returned 0x0 [0099.123] IUnknown:QueryInterface (This=0x1f5f4b5f40, riid=0x7ff8ee00d438*(Data1=0x114, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1f5f08e060) [0099.123] IUnknown:QueryInterface (This=0x1f5f4b5f40, riid=0x7ff8ee00d468*(Data1=0x79eac9ed, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x1f5f08e050) [0099.123] IUnknown:QueryInterface (This=0x1f5f4b5f40, riid=0x7ff8ee00d458*(Data1=0x214e3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1f5f08e058) [0099.123] IUnknown:QueryInterface (This=0x1f5f4b5f40, riid=0x7ff8ee00d448*(Data1=0x45d64a29, Data2=0xa63e, Data3=0x4cb6, Data4=([0]=0xb4, [1]=0x98, [2]=0x57, [3]=0x81, [4]=0xd2, [5]=0x98, [6]=0xcb, [7]=0x4f)), ppvObject=0x1f5f08e068) [0099.123] IUnknown:QueryInterface (This=0x1f5f4b5f40, riid=0x7ff8eb8347d8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1f5f08e090) [0099.123] IUnknown:QueryInterface (in: This=0x1f5f102b48, riid=0x7ff8de1e0bd8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1f5f08e0c0 | out: ppvObject=0x1f5f08e0c0*=0x1f5f102b48) returned 0x0 [0099.198] IUnknown:QueryInterface (This=0x1f5f4b5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1f5f08e0c0) [0099.198] IUnknown:AddRef (This=0x1f5f4b5f40) returned 0xe [0099.198] IUnknown_QueryService (in: punk=0x1f5f102b48, guidService=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), riid=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), ppvOut=0x1f5f4b96e0 | out: ppvOut=0x1f5f4b96e0*=0x0) returned 0x80004001 [0099.203] IUnknown:Release (This=0x1f5f4b5f40) returned 0xd [0099.203] IUnknown:QueryInterface (This=0x1f5f4b5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1f5f08e0c0) [0099.203] IUnknown:AddRef (This=0x1f5f4b5f40) returned 0xe [0099.203] IUnknown_QueryService (in: punk=0x1f5f102b48, guidService=0x7ff8de1c0980*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), riid=0x7ff8de1c0a40*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), ppvOut=0x1f5f4b96e8 | out: ppvOut=0x1f5f4b96e8*=0x0) returned 0x80004001 [0099.211] IUnknown:Release (This=0x1f5f4b5f40) returned 0xd [0099.211] IUnknown:QueryInterface (This=0x1f5f4b5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1f5f08e0c0) [0099.211] IUnknown:AddRef (This=0x1f5f4b5f40) returned 0xe [0099.212] IUnknown_QueryService (in: punk=0x1f5f102b48, guidService=0x7ff8de1c0950*(Data1=0xcde725b0, Data2=0xccc9, Data3=0x4519, Data4=([0]=0x91, [1]=0x7e, [2]=0x32, [3]=0x5d, [4]=0x72, [5]=0xfa, [6]=0xb4, [7]=0xce)), riid=0x7ff8de1d2fb0*(Data1=0x1af3a467, Data2=0x214f, Data3=0x4298, Data4=([0]=0x90, [1]=0x8e, [2]=0x6, [3]=0xb0, [4]=0x3e, [5]=0xb, [6]=0x39, [7]=0xf9)), ppvOut=0x1f5f4b96f0 | out: ppvOut=0x1f5f4b96f0*=0x0) returned 0x80004001 [0099.212] IUnknown:Release (This=0x1f5f4b5f40) returned 0xd [0099.212] IUnknown:QueryInterface (This=0x1f5f4b5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1f5f08e0c0) [0099.212] IUnknown:AddRef (This=0x1f5f4b5f40) returned 0xe [0099.212] IUnknown_QueryService (in: punk=0x1f5f102b48, guidService=0x7ff8de1c0800*(Data1=0x80605492, Data2=0x67d9, Data3=0x414f, Data4=([0]=0xaf, [1]=0x89, [2]=0xa1, [3]=0xcd, [4]=0xf1, [5]=0x24, [6]=0x2b, [7]=0xc1)), riid=0x7ff8de1c0068*(Data1=0xe5aa01f7, Data2=0x1fb8, Data3=0x4830, Data4=([0]=0x87, [1]=0x20, [2]=0x4e, [3]=0x67, [4]=0x34, [5]=0xcb, [6]=0xd5, [7]=0xf3)), ppvOut=0x1f5f4b96f8 | out: ppvOut=0x1f5f4b96f8*=0x0) returned 0x80004001 [0099.213] IUnknown:Release (This=0x1f5f4b5f40) returned 0xd [0099.213] IUnknown:QueryInterface (This=0x1f5f4b5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1f5f08e0c0) [0099.213] IUnknown:AddRef (This=0x1f5f4b5f40) returned 0xe [0099.213] IUnknown_QueryService (in: punk=0x1f5f102b48, guidService=0x7ff8de1c0810*(Data1=0x2ce78010, Data2=0x74db, Data3=0x48bc, Data4=([0]=0x9c, [1]=0x6a, [2]=0x10, [3]=0xf3, [4]=0x72, [5]=0x49, [6]=0x57, [7]=0x23)), riid=0x7ff8de1bfb70*(Data1=0x989191ac, Data2=0x28ff, Data3=0x4cf0, Data4=([0]=0x95, [1]=0x84, [2]=0xe0, [3]=0xd0, [4]=0x78, [5]=0xbc, [6]=0x23, [7]=0x96)), ppvOut=0x1f5f4b9700 | out: ppvOut=0x1f5f4b9700*=0x0) returned 0x80004001 [0099.214] IUnknown:Release (This=0x1f5f4b5f40) returned 0xd [0099.214] IUnknown:QueryInterface (This=0x1f5f4b5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1f5f08e0c0) [0099.214] IUnknown:AddRef (This=0x1f5f4b5f40) returned 0xe [0099.214] IUnknown_QueryService (in: punk=0x1f5f102b48, guidService=0x7ff8de1c0078*(Data1=0x26db2472, Data2=0xb7b7, Data3=0x406b, Data4=([0]=0x97, [1]=0x2, [2]=0x73, [3]=0xa, [4]=0x4e, [5]=0x20, [6]=0xd3, [7]=0xbf)), riid=0x7ff8de1c0a10*(Data1=0x2f0666c6, Data2=0x12f7, Data3=0x4360, Data4=([0]=0xb5, [1]=0x11, [2]=0xa3, [3]=0x94, [4]=0xa0, [5]=0x55, [6]=0x37, [7]=0x25)), ppvOut=0x1f5f4b9708 | out: ppvOut=0x1f5f4b9708*=0x0) returned 0x80004001 [0099.214] IUnknown:Release (This=0x1f5f4b5f40) returned 0xd [0099.214] IUnknown:QueryInterface (This=0x1f5f4b5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1f5f08e0c0) [0099.214] IUnknown:AddRef (This=0x1f5f4b5f40) returned 0xe [0099.214] IUnknown_QueryService (in: punk=0x1f5f102b48, guidService=0x7ff8de1c0930*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), riid=0x7ff8de1c0a30*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), ppvOut=0x1f5f4b9bf0 | out: ppvOut=0x1f5f4b9bf0*=0x0) returned 0x80004001 [0099.215] IUnknown:Release (This=0x1f5f4b5f40) returned 0xd [0099.215] IUnknown:QueryInterface (This=0x1f5f4b5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1f5f08e0c0) [0099.215] IUnknown:AddRef (This=0x1f5f4b5f40) returned 0xe [0099.215] IUnknown_QueryService (in: punk=0x1f5f102b48, guidService=0x7ff8de27c2c0*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff8de27fc98*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0x1f5f08e100 | out: ppvOut=0x1f5f08e100*=0x0) returned 0x80004001 [0099.216] IUnknown:Release (This=0x1f5f4b5f40) returned 0xd [0099.216] IUnknown:AddRef (This=0x1f5f4b5f40) returned 0xe [0099.216] GetCurrentThreadId () returned 0xcd4 [0099.216] PostThreadMessageW (idThread=0xcd4, Msg=0x8001, wParam=0x0, lParam=0x0) returned 1 [0099.216] GetMessageW (in: lpMsg=0x1f5f08f718, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f5f08f718) returned 1 [0099.216] CompareStringOrdinal (lpString1="openas", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0099.216] CompareStringOrdinal (lpString1="OpenWithSetDefaultOn", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0099.216] IUnknown_QueryService (in: punk=0x1f5f102b48, guidService=0x7ff7bd657da0*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), riid=0x7ff7bd657910*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), ppvOut=0x1f5f08f7a8 | out: ppvOut=0x1f5f08f7a8*=0x1f5f10bff8) returned 0x0 [0099.221] IUnknown_Set (in: ppunk=0x1f5f4b5f60*=0x1f5f102b48, punk=0x0 | out: ppunk=0x1f5f4b5f60*=0x0) [0099.223] IUnknown_QueryService (in: punk=0x0, guidService=0x7ff7bd657d60*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff7bd657950*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0x1f5f08f6f8 | out: ppvOut=0x1f5f08f6f8*=0x0) returned 0x80004001 [0099.223] QISearch (in: that=0x1f5f4b5f30, pqit=0x7ff7bd657970, riid=0x7ff7bd657ac0*(Data1=0x1c9cd5bb, Data2=0x98e9, Data3=0x4491, Data4=([0]=0xa6, [1]=0xf, [2]=0x31, [3]=0xaa, [4]=0xcc, [5]=0x72, [6]=0xb8, [7]=0x3c)), ppv=0x1f5f08f658 | out: that=0x1f5f4b5f30, ppv=0x1f5f08f658*=0x1f5f4b5f78) returned 0x0 [0099.223] IUnknown:QueryInterface (in: This=0x1f5f107f48, riid=0x7ff7bd657930*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0x1f5f08f6f0 | out: ppvObject=0x1f5f08f6f0*=0x1f5f107f48) returned 0x0 [0099.223] IShellItemArray:GetItemAt (in: This=0x1f5f107f48, dwIndex=0x0, ppsi=0x1f5f08f6e0 | out: ppsi=0x1f5f08f6e0*=0x1f5f102a28) returned 0x0 [0099.224] IUnknown:QueryInterface (in: This=0x1f5f102a28, riid=0x7ff7bd657b10*(Data1=0x7e9fb0d3, Data2=0x919f, Data3=0x4307, Data4=([0]=0xab, [1]=0x2e, [2]=0x9b, [3]=0x18, [4]=0x60, [5]=0x31, [6]=0xc, [7]=0x93)), ppvObject=0x1f5f08f6e8 | out: ppvObject=0x1f5f08f6e8*=0x1f5f102a28) returned 0x0 [0099.224] IUnknown:Release (This=0x1f5f102a28) returned 0x1 [0099.224] IShellItem:BindToHandler (in: This=0x1f5f102a28, pbc=0x0, bhid=0x7ff7bd657db0, riid=0x7ff7bd657920, ppv=0x1f5f08f6e0 | out: ppv=0x1f5f08f6e0) returned 0x0 [0099.228] IUnknown:Release (This=0x1f5f102a28) returned 0x0 [0099.228] IUnknown:Release (This=0x1f5f107f48) returned 0x1 [0099.228] IUnknown:AddRef (This=0x1f5f4b5f78) returned 0xf [0099.228] IObjectWithSelection:GetSelection (in: This=0x1f5f4b5f78, riid=0x7ff8de1c76a8, ppv=0x1f5f4b9718 | out: ppv=0x1f5f4b9718) returned 0x0 [0099.228] IUnknown:QueryInterface (in: This=0x1f5f107f48, riid=0x7ff8de1c76a8*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0x1f5f4b9718 | out: ppvObject=0x1f5f4b9718*=0x1f5f107f48) returned 0x0 [0099.229] IUnknown:Release (This=0x1f5f4b5f78) returned 0xe [0099.239] IUnknown:Release (This=0x1f5f4b5f78) returned 0x7 [0099.239] IUnknown:Release (This=0x1f5f4b5f78) returned 0x6 [0115.646] IUnknown:Release (This=0x1f5f107f48) returned 0x1 [0115.646] IUnknown_SetSite (punk=0x1f5f4b9620, punkSite=0x0) returned 0x0 [0115.646] IUnknown:Release (This=0x1f5f4b5f40) returned 0x2 [0115.646] PostQuitMessage (nExitCode=0) [0115.646] TranslateMessage (lpMsg=0x1f5f08f718) returned 0 [0115.646] DispatchMessageW (lpMsg=0x1f5f08f718) returned 0x0 [0115.646] GetMessageW (in: lpMsg=0x1f5f08f718, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f5f08f718) returned 0 [0115.646] CoRevokeClassObject (dwRegister=0x10) returned 0x0 [0115.764] IUnknown:Release (This=0x1f5f4b9620) returned 0x0 [0115.833] CoTaskMemFree (pv=0x1f5f0ed7b0) [0115.833] Str_SetPtrW (in: ppsz=0x1f5f4b5fa0*=0x0, psz=0x0 | out: ppsz=0x1f5f4b5fa0*=0x0) returned 1 [0115.833] Str_SetPtrW (in: ppsz=0x1f5f4b5fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop", psz=0x0 | out: ppsz=0x1f5f4b5fa8*=0x0) returned 1 [0115.833] SHSetThreadRef (punk=0x0) returned 0x0 [0115.833] CoUninitialize () [0115.864] LocalFree (hMem=0x1f5f0dbb60) returned 0x0 [0115.864] EtwEventUnregister (RegHandle=0x28001f5f0e1220) returned 0x0 [0115.864] exit (_Code=0) Thread: id = 221 os_tid = 0xebc Thread: id = 244 os_tid = 0xe7c Thread: id = 245 os_tid = 0xc64 Thread: id = 246 os_tid = 0xc68 Thread: id = 247 os_tid = 0xf4c Thread: id = 248 os_tid = 0xf48 Thread: id = 249 os_tid = 0x228 Thread: id = 293 os_tid = 0xe28 Thread: id = 294 os_tid = 0xd14 Process: id = "17" image_name = "openwith.exe" filename = "c:\\windows\\system32\\openwith.exe" page_root = "0x75af2000" os_pid = "0xeb4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xdd4" cmd_line = "C:\\Windows\\system32\\OpenWith.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2690 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2691 start_va = 0xb3d5570000 end_va = 0xb3d557ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d5570000" filename = "" Region: id = 2692 start_va = 0xb3d5580000 end_va = 0xb3d5586fff entry_point = 0x0 region_type = private name = "private_0x000000b3d5580000" filename = "" Region: id = 2693 start_va = 0xb3d5590000 end_va = 0xb3d55a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d5590000" filename = "" Region: id = 2694 start_va = 0xb3d55b0000 end_va = 0xb3d562ffff entry_point = 0x0 region_type = private name = "private_0x000000b3d55b0000" filename = "" Region: id = 2695 start_va = 0xb3d5630000 end_va = 0xb3d5633fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d5630000" filename = "" Region: id = 2696 start_va = 0xb3d5640000 end_va = 0xb3d5642fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d5640000" filename = "" Region: id = 2697 start_va = 0xb3d5650000 end_va = 0xb3d5651fff entry_point = 0x0 region_type = private name = "private_0x000000b3d5650000" filename = "" Region: id = 2698 start_va = 0xb3d5660000 end_va = 0xb3d5666fff entry_point = 0x0 region_type = private name = "private_0x000000b3d5660000" filename = "" Region: id = 2699 start_va = 0xb3d5670000 end_va = 0xb3d576ffff entry_point = 0x0 region_type = private name = "private_0x000000b3d5670000" filename = "" Region: id = 2700 start_va = 0xb3d5770000 end_va = 0xb3d582dfff entry_point = 0xb3d5770000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2701 start_va = 0xb3d5830000 end_va = 0xb3d58affff entry_point = 0x0 region_type = private name = "private_0x000000b3d5830000" filename = "" Region: id = 2702 start_va = 0xb3d58b0000 end_va = 0xb3d5a37fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d58b0000" filename = "" Region: id = 2703 start_va = 0xb3d5a40000 end_va = 0xb3d5a40fff entry_point = 0xb3d5a40000 region_type = mapped_file name = "openwith.exe.mui" filename = "\\Windows\\System32\\en-US\\OpenWith.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\openwith.exe.mui") Region: id = 2704 start_va = 0xb3d5a50000 end_va = 0xb3d5a50fff entry_point = 0x0 region_type = private name = "private_0x000000b3d5a50000" filename = "" Region: id = 2705 start_va = 0xb3d5a60000 end_va = 0xb3d5a60fff entry_point = 0x0 region_type = private name = "private_0x000000b3d5a60000" filename = "" Region: id = 2706 start_va = 0xb3d5a70000 end_va = 0xb3d5a70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d5a70000" filename = "" Region: id = 2707 start_va = 0xb3d5a80000 end_va = 0xb3d5a81fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d5a80000" filename = "" Region: id = 2708 start_va = 0xb3d5ab0000 end_va = 0xb3d5abffff entry_point = 0x0 region_type = private name = "private_0x000000b3d5ab0000" filename = "" Region: id = 2709 start_va = 0xb3d5ac0000 end_va = 0xb3d5c40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d5ac0000" filename = "" Region: id = 2710 start_va = 0xb3d5c50000 end_va = 0xb3d704ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d5c50000" filename = "" Region: id = 2711 start_va = 0xb3d70a0000 end_va = 0xb3d70affff entry_point = 0x0 region_type = private name = "private_0x000000b3d70a0000" filename = "" Region: id = 2712 start_va = 0xb3d70b0000 end_va = 0xb3d73e6fff entry_point = 0xb3d70b0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2713 start_va = 0xb3d73f0000 end_va = 0xb3d746ffff entry_point = 0x0 region_type = private name = "private_0x000000b3d73f0000" filename = "" Region: id = 2714 start_va = 0xb3d7470000 end_va = 0xb3d74effff entry_point = 0x0 region_type = private name = "private_0x000000b3d7470000" filename = "" Region: id = 2715 start_va = 0xb3d74f0000 end_va = 0xb3d756ffff entry_point = 0x0 region_type = private name = "private_0x000000b3d74f0000" filename = "" Region: id = 2716 start_va = 0xb3d7570000 end_va = 0xb3d75effff entry_point = 0x0 region_type = private name = "private_0x000000b3d7570000" filename = "" Region: id = 2717 start_va = 0x7df5ffdb0000 end_va = 0x7ff5ffdaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffdb0000" filename = "" Region: id = 2718 start_va = 0x7ff7bcdb0000 end_va = 0x7ff7bceaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bcdb0000" filename = "" Region: id = 2719 start_va = 0x7ff7bceb0000 end_va = 0x7ff7bced2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bceb0000" filename = "" Region: id = 2720 start_va = 0x7ff7bced3000 end_va = 0x7ff7bced4fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bced3000" filename = "" Region: id = 2721 start_va = 0x7ff7bced5000 end_va = 0x7ff7bced6fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bced5000" filename = "" Region: id = 2722 start_va = 0x7ff7bced7000 end_va = 0x7ff7bced8fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bced7000" filename = "" Region: id = 2723 start_va = 0x7ff7bced9000 end_va = 0x7ff7bced9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bced9000" filename = "" Region: id = 2724 start_va = 0x7ff7bceda000 end_va = 0x7ff7bcedbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bceda000" filename = "" Region: id = 2725 start_va = 0x7ff7bcedc000 end_va = 0x7ff7bceddfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcedc000" filename = "" Region: id = 2726 start_va = 0x7ff7bcede000 end_va = 0x7ff7bcedffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcede000" filename = "" Region: id = 2727 start_va = 0x7ff7bd650000 end_va = 0x7ff7bd669fff entry_point = 0x7ff7bd650000 region_type = mapped_file name = "openwith.exe" filename = "\\Windows\\System32\\OpenWith.exe" (normalized: "c:\\windows\\system32\\openwith.exe") Region: id = 2728 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 2729 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 2730 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2731 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2732 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2733 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2734 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2735 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2736 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2737 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2738 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2739 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 2740 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2741 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2742 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2743 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2744 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2745 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2746 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2747 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2748 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2749 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2750 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2751 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2752 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2753 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2754 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2755 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2756 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2757 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2760 start_va = 0xb3d5a90000 end_va = 0xb3d5a90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d5a90000" filename = "" Region: id = 2761 start_va = 0xb3d5aa0000 end_va = 0xb3d5aa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d5aa0000" filename = "" Region: id = 2762 start_va = 0x7ff8ddbd0000 end_va = 0x7ff8de6dcfff entry_point = 0x7ff8ddbd0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 2763 start_va = 0x7ff8e9860000 end_va = 0x7ff8e994dfff entry_point = 0x7ff8e9860000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 2764 start_va = 0x7ff8e3a70000 end_va = 0x7ff8e3c26fff entry_point = 0x7ff8e3a70000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 2765 start_va = 0xb3d7050000 end_va = 0xb3d7052fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d7050000" filename = "" Region: id = 2766 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2767 start_va = 0x7ff8e7430000 end_va = 0x7ff8e7560fff entry_point = 0x7ff8e7430000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 2768 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2877 start_va = 0xb3d7060000 end_va = 0xb3d7089fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d7060000" filename = "" Region: id = 2878 start_va = 0xb3d7090000 end_va = 0xb3d7090fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d7090000" filename = "" Region: id = 2879 start_va = 0xb3d75f0000 end_va = 0xb3d75f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d75f0000" filename = "" Region: id = 2880 start_va = 0xb3d7600000 end_va = 0xb3d767ffff entry_point = 0x0 region_type = private name = "private_0x000000b3d7600000" filename = "" Region: id = 2881 start_va = 0xb3d7680000 end_va = 0xb3d76fffff entry_point = 0x0 region_type = private name = "private_0x000000b3d7680000" filename = "" Region: id = 2882 start_va = 0x7ff7bcdac000 end_va = 0x7ff7bcdadfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcdac000" filename = "" Region: id = 2883 start_va = 0x7ff7bcdae000 end_va = 0x7ff7bcdaffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcdae000" filename = "" Region: id = 2884 start_va = 0x7ff8d1180000 end_va = 0x7ff8d132ffff entry_point = 0x7ff8d1180000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 2885 start_va = 0x7ff8d1330000 end_va = 0x7ff8d147bfff entry_point = 0x7ff8d1330000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 2886 start_va = 0x7ff8d76a0000 end_va = 0x7ff8d7738fff entry_point = 0x7ff8d76a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 2895 start_va = 0xb3d7700000 end_va = 0xb3d7701fff entry_point = 0xb3d7700000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 2896 start_va = 0xb3d7710000 end_va = 0xb3d7713fff entry_point = 0xb3d7710000 region_type = mapped_file name = "windows.ui.immersive.dll.mui" filename = "\\Windows\\System32\\en-US\\Windows.UI.Immersive.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.ui.immersive.dll.mui") Region: id = 2897 start_va = 0xb3d7720000 end_va = 0xb3d779ffff entry_point = 0x0 region_type = private name = "private_0x000000b3d7720000" filename = "" Region: id = 2898 start_va = 0xb3d77a0000 end_va = 0xb3d789ffff entry_point = 0x0 region_type = private name = "private_0x000000b3d77a0000" filename = "" Region: id = 2899 start_va = 0xb3d78a0000 end_va = 0xb3d78a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d78a0000" filename = "" Region: id = 2900 start_va = 0xb3d78b0000 end_va = 0xb3d78b0fff entry_point = 0x0 region_type = private name = "private_0x000000b3d78b0000" filename = "" Region: id = 2901 start_va = 0xb3d78c0000 end_va = 0xb3d78c0fff entry_point = 0x0 region_type = private name = "private_0x000000b3d78c0000" filename = "" Region: id = 2902 start_va = 0xb3d78d0000 end_va = 0xb3d794ffff entry_point = 0x0 region_type = private name = "private_0x000000b3d78d0000" filename = "" Region: id = 2903 start_va = 0xb3d7950000 end_va = 0xb3d7950fff entry_point = 0x0 region_type = private name = "private_0x000000b3d7950000" filename = "" Region: id = 2904 start_va = 0xb3d7960000 end_va = 0xb3d7960fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d7960000" filename = "" Region: id = 2905 start_va = 0xb3d7970000 end_va = 0xb3d7983fff entry_point = 0xb3d7970000 region_type = mapped_file name = "twinui.dll.mui" filename = "\\Windows\\System32\\en-US\\twinui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\twinui.dll.mui") Region: id = 2906 start_va = 0xb3d7990000 end_va = 0xb3d7991fff entry_point = 0xb3d7990000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 2907 start_va = 0xb3d79a0000 end_va = 0xb3d79a4fff entry_point = 0xb3d79a0000 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 2908 start_va = 0xb3d79b0000 end_va = 0xb3d7aaffff entry_point = 0x0 region_type = private name = "private_0x000000b3d79b0000" filename = "" Region: id = 2909 start_va = 0x7ff7bcda8000 end_va = 0x7ff7bcda9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcda8000" filename = "" Region: id = 2910 start_va = 0x7ff7bcdaa000 end_va = 0x7ff7bcdabfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcdaa000" filename = "" Region: id = 2911 start_va = 0x7ff8debc0000 end_va = 0x7ff8dec28fff entry_point = 0x7ff8debc0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 2912 start_va = 0x7ff8e37f0000 end_va = 0x7ff8e3a48fff entry_point = 0x7ff8e37f0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 2913 start_va = 0x7ff8e8650000 end_va = 0x7ff8e869afff entry_point = 0x7ff8e8650000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 2914 start_va = 0x7ff8e8860000 end_va = 0x7ff8e8acdfff entry_point = 0x7ff8e8860000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 2915 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 2916 start_va = 0x7ff8e8c60000 end_va = 0x7ff8e8cfbfff entry_point = 0x7ff8e8c60000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2917 start_va = 0x7ff8e8d00000 end_va = 0x7ff8e8fa2fff entry_point = 0x7ff8e8d00000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 2918 start_va = 0x7ff8e9130000 end_va = 0x7ff8e9200fff entry_point = 0x7ff8e9130000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 3339 start_va = 0xb3d7ab0000 end_va = 0xb3d7ab3fff entry_point = 0xb3d7ab0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3340 start_va = 0xb3d7ac0000 end_va = 0xb3d7ad2fff entry_point = 0xb3d7ac0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 3341 start_va = 0xb3d7ae0000 end_va = 0xb3d7ae0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d7ae0000" filename = "" Region: id = 3342 start_va = 0xb3d7af0000 end_va = 0xb3d7b0bfff entry_point = 0xb3d7af0000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db") Region: id = 3343 start_va = 0xb3d7b10000 end_va = 0xb3d7b8ffff entry_point = 0x0 region_type = private name = "private_0x000000b3d7b10000" filename = "" Region: id = 3344 start_va = 0xb3d7b90000 end_va = 0xb3d7c0ffff entry_point = 0x0 region_type = private name = "private_0x000000b3d7b90000" filename = "" Region: id = 3345 start_va = 0xb3d7c10000 end_va = 0xb3d7c13fff entry_point = 0xb3d7c10000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3346 start_va = 0xb3d7c20000 end_va = 0xb3d7c62fff entry_point = 0xb3d7c20000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db") Region: id = 3347 start_va = 0xb3d7c70000 end_va = 0xb3d7c73fff entry_point = 0xb3d7c70000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3348 start_va = 0xb3d7c80000 end_va = 0xb3d7d0afff entry_point = 0xb3d7c80000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 3349 start_va = 0xb3d7d10000 end_va = 0xb3d7e0ffff entry_point = 0x0 region_type = private name = "private_0x000000b3d7d10000" filename = "" Region: id = 3350 start_va = 0xb3d7e10000 end_va = 0xb3d7e12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d7e10000" filename = "" Region: id = 3351 start_va = 0xb3d7e30000 end_va = 0xb3d7e33fff entry_point = 0xb3d7e30000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3352 start_va = 0xb3d7e40000 end_va = 0xb3d7e41fff entry_point = 0xb3d7e40000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 3353 start_va = 0xb3d7e50000 end_va = 0xb3d7e58fff entry_point = 0x0 region_type = private name = "private_0x000000b3d7e50000" filename = "" Region: id = 3354 start_va = 0xb3d7e60000 end_va = 0xb3d7e60fff entry_point = 0x0 region_type = private name = "private_0x000000b3d7e60000" filename = "" Region: id = 3355 start_va = 0xb3d7e70000 end_va = 0xb3d7e93fff entry_point = 0x0 region_type = private name = "private_0x000000b3d7e70000" filename = "" Region: id = 3356 start_va = 0xb3d7ea0000 end_va = 0xb3d7ea8fff entry_point = 0x0 region_type = private name = "private_0x000000b3d7ea0000" filename = "" Region: id = 3357 start_va = 0xb3d7eb0000 end_va = 0xb3d7faffff entry_point = 0x0 region_type = private name = "private_0x000000b3d7eb0000" filename = "" Region: id = 3358 start_va = 0xb3d7fc0000 end_va = 0xb3d7fc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3d7fc0000" filename = "" Region: id = 3359 start_va = 0xb3d7fd0000 end_va = 0xb3d7fd1fff entry_point = 0xb3d7fd0000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 3360 start_va = 0xb3d7fe0000 end_va = 0xb3d80dffff entry_point = 0xb3d7fe0000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 3361 start_va = 0xb3d80e0000 end_va = 0xb3d8127fff entry_point = 0x0 region_type = private name = "private_0x000000b3d80e0000" filename = "" Region: id = 3362 start_va = 0xb3d8130000 end_va = 0xb3d8140fff entry_point = 0xb3d8130000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 3363 start_va = 0xb3d8150000 end_va = 0xb3d824ffff entry_point = 0xb3d8150000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 3364 start_va = 0xb3d8280000 end_va = 0xb3d8287fff entry_point = 0x0 region_type = private name = "private_0x000000b3d8280000" filename = "" Region: id = 3365 start_va = 0xb3d8290000 end_va = 0xb3d830ffff entry_point = 0x0 region_type = private name = "private_0x000000b3d8290000" filename = "" Region: id = 3366 start_va = 0xb3d8310000 end_va = 0xb3d850ffff entry_point = 0x0 region_type = private name = "private_0x000000b3d8310000" filename = "" Region: id = 3367 start_va = 0xb3d8590000 end_va = 0xb3d8605fff entry_point = 0xb3d8590000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 3368 start_va = 0xb3d86a0000 end_va = 0xb3d86a0fff entry_point = 0x0 region_type = private name = "private_0x000000b3d86a0000" filename = "" Region: id = 3369 start_va = 0xb3d86c0000 end_va = 0xb3d86cffff entry_point = 0x0 region_type = private name = "private_0x000000b3d86c0000" filename = "" Region: id = 3370 start_va = 0xb3d86d0000 end_va = 0xb3d96cffff entry_point = 0xb3d86d0000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 3371 start_va = 0xb3d96d0000 end_va = 0xb3d9ecffff entry_point = 0xb3d96d0000 region_type = mapped_file name = "~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1462094071-1423818996-289466292-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat") Region: id = 3372 start_va = 0xb3d9ed0000 end_va = 0xb3d9faefff entry_point = 0xb3d9ed0000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 3373 start_va = 0xb3d9fb0000 end_va = 0xb3da092fff entry_point = 0xb3d9fb0000 region_type = mapped_file name = "seguisb.ttf" filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf") Region: id = 3374 start_va = 0xb3da0a0000 end_va = 0xb3da162fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b3da0a0000" filename = "" Region: id = 3375 start_va = 0x7ff7bcda2000 end_va = 0x7ff7bcda3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcda2000" filename = "" Region: id = 3376 start_va = 0x7ff7bcda4000 end_va = 0x7ff7bcda5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcda4000" filename = "" Region: id = 3377 start_va = 0x7ff7bcda6000 end_va = 0x7ff7bcda7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bcda6000" filename = "" Region: id = 3378 start_va = 0x7ff8dc6e0000 end_va = 0x7ff8dc778fff entry_point = 0x7ff8dc6e0000 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 3379 start_va = 0x7ff8dc780000 end_va = 0x7ff8dca11fff entry_point = 0x7ff8dc780000 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 3380 start_va = 0x7ff8dcfd0000 end_va = 0x7ff8dd018fff entry_point = 0x7ff8dcfd0000 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 3381 start_va = 0x7ff8dd900000 end_va = 0x7ff8dd94afff entry_point = 0x7ff8dd900000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 3382 start_va = 0x7ff8e3070000 end_va = 0x7ff8e30f8fff entry_point = 0x7ff8e3070000 region_type = mapped_file name = "directmanipulation.dll" filename = "\\Windows\\System32\\directmanipulation.dll" (normalized: "c:\\windows\\system32\\directmanipulation.dll") Region: id = 3383 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 3384 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 3385 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 3386 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3387 start_va = 0x7ff8e86a0000 end_va = 0x7ff8e8851fff entry_point = 0x7ff8e86a0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 3388 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 3389 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3390 start_va = 0x7ff8eac70000 end_va = 0x7ff8ead07fff entry_point = 0x7ff8eac70000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 3391 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Thread: id = 233 os_tid = 0xde8 Thread: id = 234 os_tid = 0xdec Thread: id = 235 os_tid = 0xef0 Thread: id = 236 os_tid = 0xea8 Thread: id = 237 os_tid = 0xe90 [0100.792] TranslateMessage (lpMsg=0xb3d562f598) returned 0 [0100.792] DispatchMessageW (lpMsg=0xb3d562f598) returned 0x1 [0100.799] GetMessageW (in: lpMsg=0xb3d562f598, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb3d562f598) returned 1 [0100.800] TranslateMessage (lpMsg=0xb3d562f598) returned 0 [0100.800] DispatchMessageW (lpMsg=0xb3d562f598) returned 0x1 [0100.943] IUnknown_Set (in: ppunk=0xb3d5ab5f60*=0x0, punk=0xb3d56a2b48 | out: ppunk=0xb3d5ab5f60*=0xb3d56a2b48) [0100.943] GetMessageW (in: lpMsg=0xb3d562f598, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb3d562f598) returned 1 [0100.948] TranslateMessage (lpMsg=0xb3d562f598) returned 0 [0100.948] DispatchMessageW (lpMsg=0xb3d562f598) returned 0x1 [0100.949] GetMessageW (in: lpMsg=0xb3d562f598, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb3d562f598) returned 1 [0100.954] TranslateMessage (lpMsg=0xb3d562f598) returned 0 [0100.954] DispatchMessageW (lpMsg=0xb3d562f598) returned 0x1 [0100.954] Str_SetPtrW (in: ppsz=0xb3d5ab5fa8*=0x0, psz="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: ppsz=0xb3d5ab5fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0100.955] GetMessageW (in: lpMsg=0xb3d562f598, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb3d562f598) returned 1 [0100.958] TranslateMessage (lpMsg=0xb3d562f598) returned 0 [0100.958] DispatchMessageW (lpMsg=0xb3d562f598) returned 0x1 [0100.959] GetMessageW (in: lpMsg=0xb3d562f598, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb3d562f598) returned 1 [0100.961] TranslateMessage (lpMsg=0xb3d562f598) returned 0 [0100.961] DispatchMessageW (lpMsg=0xb3d562f598) returned 0x1 [0100.963] GetMessageW (in: lpMsg=0xb3d562f598, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb3d562f598) returned 1 [0100.989] TranslateMessage (lpMsg=0xb3d562f598) returned 0 [0100.989] DispatchMessageW (lpMsg=0xb3d562f598) returned 0x1 [0100.999] IUnknown_Set (in: ppunk=0xb3d5ab5fc0*=0x0, punk=0xb3d56a7f48 | out: ppunk=0xb3d5ab5fc0*=0xb3d56a7f48) [0100.999] GetMessageW (in: lpMsg=0xb3d562f598, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb3d562f598) returned 1 [0101.101] TranslateMessage (lpMsg=0xb3d562f598) returned 0 [0101.101] DispatchMessageW (lpMsg=0xb3d562f598) returned 0x1 [0101.102] GetMessageW (in: lpMsg=0xb3d562f598, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb3d562f598) returned 1 [0101.143] TranslateMessage (lpMsg=0xb3d562f598) returned 0 [0101.143] DispatchMessageW (lpMsg=0xb3d562f598) returned 0x1 [0101.144] GetMessageW (in: lpMsg=0xb3d562f598, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb3d562f598) returned 1 [0101.268] TranslateMessage (lpMsg=0xb3d562f598) returned 0 [0101.268] DispatchMessageW (lpMsg=0xb3d562f598) returned 0x1 [0101.269] CoTaskMemAlloc (cb=0xa) returned 0xb3d568d8d0 [0101.367] GetMessageW (in: lpMsg=0xb3d562f598, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb3d562f598) returned 1 [0101.409] TranslateMessage (lpMsg=0xb3d562f598) returned 0 [0101.409] DispatchMessageW (lpMsg=0xb3d562f598) returned 0x1 [0101.410] GetMessageW (in: lpMsg=0xb3d562f598, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb3d562f598) returned 1 [0101.537] TranslateMessage (lpMsg=0xb3d562f598) returned 0 [0101.537] DispatchMessageW (lpMsg=0xb3d562f598) returned 0x1 [0101.537] GetMessageW (in: lpMsg=0xb3d562f598, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb3d562f598) returned 1 [0101.544] TranslateMessage (lpMsg=0xb3d562f598) returned 0 [0101.544] DispatchMessageW (lpMsg=0xb3d562f598) returned 0x1 [0101.544] KillTimer (hWnd=0x0, uIDEvent=0x7f67) returned 1 [0101.544] CompareStringOrdinal (lpString1="InvokeDefaultVerbInOtherProcess", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 1 [0101.544] CoCreateInstance (in: rclsid=0x7ff7bd6575b0*(Data1=0x94b23d4d, Data2=0x1040, Data3=0x4c4b, Data4=([0]=0x90, [1]=0x81, [2]=0x85, [3]=0xd8, [4]=0xd6, [5]=0xfa, [6]=0x36, [7]=0xc4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7bd657a50*(Data1=0xce149b23, Data2=0x5941, Data3=0x4079, Data4=([0]=0x92, [1]=0x23, [2]=0x52, [3]=0xc0, [4]=0xa9, [5]=0x91, [6]=0xec, [7]=0x48)), ppv=0xb3d5ab5fe0 | out: ppv=0xb3d5ab5fe0*=0xb3d5ab9620) returned 0x0 [0101.574] IUnknown_SetSite (punk=0xb3d5ab9620, punkSite=0xb3d5ab5f40) returned 0x0 [0101.574] IUnknown:QueryInterface (This=0xb3d5ab5f40, riid=0x7ff8ee00d438*(Data1=0x114, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb3d562dee0) [0101.574] IUnknown:QueryInterface (This=0xb3d5ab5f40, riid=0x7ff8ee00d468*(Data1=0x79eac9ed, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xb3d562ded0) [0101.574] IUnknown:QueryInterface (This=0xb3d5ab5f40, riid=0x7ff8ee00d458*(Data1=0x214e3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb3d562ded8) [0101.574] IUnknown:QueryInterface (This=0xb3d5ab5f40, riid=0x7ff8ee00d448*(Data1=0x45d64a29, Data2=0xa63e, Data3=0x4cb6, Data4=([0]=0xb4, [1]=0x98, [2]=0x57, [3]=0x81, [4]=0xd2, [5]=0x98, [6]=0xcb, [7]=0x4f)), ppvObject=0xb3d562dee8) [0101.575] IUnknown:QueryInterface (This=0xb3d5ab5f40, riid=0x7ff8eb8347d8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0xb3d562df10) [0101.575] IUnknown:QueryInterface (in: This=0xb3d56a2b48, riid=0x7ff8de1e0bd8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb3d562df40 | out: ppvObject=0xb3d562df40*=0xb3d56a2b48) returned 0x0 [0101.706] IUnknown:QueryInterface (This=0xb3d5ab5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xb3d562df40) [0101.706] IUnknown:AddRef (This=0xb3d5ab5f40) returned 0xe [0101.706] IUnknown_QueryService (in: punk=0xb3d56a2b48, guidService=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), riid=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), ppvOut=0xb3d5ab96e0 | out: ppvOut=0xb3d5ab96e0*=0x0) returned 0x80004001 [0101.715] IUnknown:Release (This=0xb3d5ab5f40) returned 0xd [0101.715] IUnknown:QueryInterface (This=0xb3d5ab5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xb3d562df40) [0101.715] IUnknown:AddRef (This=0xb3d5ab5f40) returned 0xe [0101.715] IUnknown_QueryService (in: punk=0xb3d56a2b48, guidService=0x7ff8de1c0980*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), riid=0x7ff8de1c0a40*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), ppvOut=0xb3d5ab96e8 | out: ppvOut=0xb3d5ab96e8*=0x0) returned 0x80004001 [0101.716] IUnknown:Release (This=0xb3d5ab5f40) returned 0xd [0101.716] IUnknown:QueryInterface (This=0xb3d5ab5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xb3d562df40) [0101.716] IUnknown:AddRef (This=0xb3d5ab5f40) returned 0xe [0101.716] IUnknown_QueryService (in: punk=0xb3d56a2b48, guidService=0x7ff8de1c0950*(Data1=0xcde725b0, Data2=0xccc9, Data3=0x4519, Data4=([0]=0x91, [1]=0x7e, [2]=0x32, [3]=0x5d, [4]=0x72, [5]=0xfa, [6]=0xb4, [7]=0xce)), riid=0x7ff8de1d2fb0*(Data1=0x1af3a467, Data2=0x214f, Data3=0x4298, Data4=([0]=0x90, [1]=0x8e, [2]=0x6, [3]=0xb0, [4]=0x3e, [5]=0xb, [6]=0x39, [7]=0xf9)), ppvOut=0xb3d5ab96f0 | out: ppvOut=0xb3d5ab96f0*=0x0) returned 0x80004001 [0101.717] IUnknown:Release (This=0xb3d5ab5f40) returned 0xd [0101.717] IUnknown:QueryInterface (This=0xb3d5ab5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xb3d562df40) [0101.717] IUnknown:AddRef (This=0xb3d5ab5f40) returned 0xe [0101.717] IUnknown_QueryService (in: punk=0xb3d56a2b48, guidService=0x7ff8de1c0800*(Data1=0x80605492, Data2=0x67d9, Data3=0x414f, Data4=([0]=0xaf, [1]=0x89, [2]=0xa1, [3]=0xcd, [4]=0xf1, [5]=0x24, [6]=0x2b, [7]=0xc1)), riid=0x7ff8de1c0068*(Data1=0xe5aa01f7, Data2=0x1fb8, Data3=0x4830, Data4=([0]=0x87, [1]=0x20, [2]=0x4e, [3]=0x67, [4]=0x34, [5]=0xcb, [6]=0xd5, [7]=0xf3)), ppvOut=0xb3d5ab96f8 | out: ppvOut=0xb3d5ab96f8*=0x0) returned 0x80004001 [0101.718] IUnknown:Release (This=0xb3d5ab5f40) returned 0xd [0101.718] IUnknown:QueryInterface (This=0xb3d5ab5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xb3d562df40) [0101.718] IUnknown:AddRef (This=0xb3d5ab5f40) returned 0xe [0101.718] IUnknown_QueryService (in: punk=0xb3d56a2b48, guidService=0x7ff8de1c0810*(Data1=0x2ce78010, Data2=0x74db, Data3=0x48bc, Data4=([0]=0x9c, [1]=0x6a, [2]=0x10, [3]=0xf3, [4]=0x72, [5]=0x49, [6]=0x57, [7]=0x23)), riid=0x7ff8de1bfb70*(Data1=0x989191ac, Data2=0x28ff, Data3=0x4cf0, Data4=([0]=0x95, [1]=0x84, [2]=0xe0, [3]=0xd0, [4]=0x78, [5]=0xbc, [6]=0x23, [7]=0x96)), ppvOut=0xb3d5ab9700 | out: ppvOut=0xb3d5ab9700*=0x0) returned 0x80004001 [0101.720] IUnknown:Release (This=0xb3d5ab5f40) returned 0xd [0101.720] IUnknown:QueryInterface (This=0xb3d5ab5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xb3d562df40) [0101.720] IUnknown:AddRef (This=0xb3d5ab5f40) returned 0xe [0101.720] IUnknown_QueryService (in: punk=0xb3d56a2b48, guidService=0x7ff8de1c0078*(Data1=0x26db2472, Data2=0xb7b7, Data3=0x406b, Data4=([0]=0x97, [1]=0x2, [2]=0x73, [3]=0xa, [4]=0x4e, [5]=0x20, [6]=0xd3, [7]=0xbf)), riid=0x7ff8de1c0a10*(Data1=0x2f0666c6, Data2=0x12f7, Data3=0x4360, Data4=([0]=0xb5, [1]=0x11, [2]=0xa3, [3]=0x94, [4]=0xa0, [5]=0x55, [6]=0x37, [7]=0x25)), ppvOut=0xb3d5ab9708 | out: ppvOut=0xb3d5ab9708*=0x0) returned 0x80004001 [0101.721] IUnknown:Release (This=0xb3d5ab5f40) returned 0xd [0101.721] IUnknown:QueryInterface (This=0xb3d5ab5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xb3d562df40) [0101.721] IUnknown:AddRef (This=0xb3d5ab5f40) returned 0xe [0101.721] IUnknown_QueryService (in: punk=0xb3d56a2b48, guidService=0x7ff8de1c0930*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), riid=0x7ff8de1c0a30*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), ppvOut=0xb3d5ab9bf0 | out: ppvOut=0xb3d5ab9bf0*=0x0) returned 0x80004001 [0101.722] IUnknown:Release (This=0xb3d5ab5f40) returned 0xd [0101.722] IUnknown:QueryInterface (This=0xb3d5ab5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xb3d562df40) [0101.722] IUnknown:AddRef (This=0xb3d5ab5f40) returned 0xe [0101.722] IUnknown_QueryService (in: punk=0xb3d56a2b48, guidService=0x7ff8de27c2c0*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff8de27fc98*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xb3d562df80 | out: ppvOut=0xb3d562df80*=0x0) returned 0x80004001 [0101.725] IUnknown:Release (This=0xb3d5ab5f40) returned 0xd [0101.725] IUnknown:AddRef (This=0xb3d5ab5f40) returned 0xe [0101.725] GetCurrentThreadId () returned 0xe90 [0101.725] PostThreadMessageW (idThread=0xe90, Msg=0x8001, wParam=0x0, lParam=0x0) returned 1 [0101.725] GetMessageW (in: lpMsg=0xb3d562f598, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb3d562f598) returned 1 [0101.725] CompareStringOrdinal (lpString1="openas", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0101.725] CompareStringOrdinal (lpString1="OpenWithSetDefaultOn", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0101.725] IUnknown_QueryService (in: punk=0xb3d56a2b48, guidService=0x7ff7bd657da0*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), riid=0x7ff7bd657910*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), ppvOut=0xb3d562f628 | out: ppvOut=0xb3d562f628*=0xb3d56ac378) returned 0x0 [0101.728] IUnknown_Set (in: ppunk=0xb3d5ab5f60*=0xb3d56a2b48, punk=0x0 | out: ppunk=0xb3d5ab5f60*=0x0) [0101.749] IUnknown_QueryService (in: punk=0x0, guidService=0x7ff7bd657d60*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff7bd657950*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xb3d562f578 | out: ppvOut=0xb3d562f578*=0x0) returned 0x80004001 [0101.749] QISearch (in: that=0xb3d5ab5f30, pqit=0x7ff7bd657970, riid=0x7ff7bd657ac0*(Data1=0x1c9cd5bb, Data2=0x98e9, Data3=0x4491, Data4=([0]=0xa6, [1]=0xf, [2]=0x31, [3]=0xaa, [4]=0xcc, [5]=0x72, [6]=0xb8, [7]=0x3c)), ppv=0xb3d562f4d8 | out: that=0xb3d5ab5f30, ppv=0xb3d562f4d8*=0xb3d5ab5f78) returned 0x0 [0101.750] IUnknown:QueryInterface (in: This=0xb3d56a7f48, riid=0x7ff7bd657930*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xb3d562f570 | out: ppvObject=0xb3d562f570*=0xb3d56a7f48) returned 0x0 [0101.750] IShellItemArray:GetItemAt (in: This=0xb3d56a7f48, dwIndex=0x0, ppsi=0xb3d562f560 | out: ppsi=0xb3d562f560*=0xb3d56acb48) returned 0x0 [0101.750] IUnknown:QueryInterface (in: This=0xb3d56acb48, riid=0x7ff7bd657b10*(Data1=0x7e9fb0d3, Data2=0x919f, Data3=0x4307, Data4=([0]=0xab, [1]=0x2e, [2]=0x9b, [3]=0x18, [4]=0x60, [5]=0x31, [6]=0xc, [7]=0x93)), ppvObject=0xb3d562f568 | out: ppvObject=0xb3d562f568*=0xb3d56acb48) returned 0x0 [0101.750] IUnknown:Release (This=0xb3d56acb48) returned 0x1 [0101.751] IShellItem:BindToHandler (in: This=0xb3d56acb48, pbc=0x0, bhid=0x7ff7bd657db0, riid=0x7ff7bd657920, ppv=0xb3d562f560 | out: ppv=0xb3d562f560) returned 0x0 [0101.755] IUnknown:Release (This=0xb3d56acb48) returned 0x0 [0101.755] IUnknown:Release (This=0xb3d56a7f48) returned 0x1 [0101.755] IUnknown:AddRef (This=0xb3d5ab5f78) returned 0xf [0101.755] IObjectWithSelection:GetSelection (in: This=0xb3d5ab5f78, riid=0x7ff8de1c76a8, ppv=0xb3d5ab9718 | out: ppv=0xb3d5ab9718) returned 0x0 [0101.756] IUnknown:QueryInterface (in: This=0xb3d56a7f48, riid=0x7ff8de1c76a8*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xb3d5ab9718 | out: ppvObject=0xb3d5ab9718*=0xb3d56a7f48) returned 0x0 [0101.756] IUnknown:Release (This=0xb3d5ab5f78) returned 0xe [0101.762] IUnknown:Release (This=0xb3d5ab5f78) returned 0x7 [0101.762] IUnknown:Release (This=0xb3d5ab5f78) returned 0x6 [0116.717] IUnknown:Release (This=0xb3d56a7f48) returned 0x1 [0116.717] IUnknown_SetSite (punk=0xb3d5ab9620, punkSite=0x0) returned 0x0 [0116.717] IUnknown:Release (This=0xb3d5ab5f40) returned 0x2 [0116.717] PostQuitMessage (nExitCode=0) [0116.717] TranslateMessage (lpMsg=0xb3d562f598) returned 0 [0116.717] DispatchMessageW (lpMsg=0xb3d562f598) returned 0x0 [0116.717] GetMessageW (in: lpMsg=0xb3d562f598, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb3d562f598) returned 0 [0116.717] CoRevokeClassObject (dwRegister=0x10) returned 0x0 [0116.725] IUnknown:Release (This=0xb3d5ab9620) returned 0x0 [0116.805] CoTaskMemFree (pv=0xb3d568d8d0) [0116.805] Str_SetPtrW (in: ppsz=0xb3d5ab5fa0*=0x0, psz=0x0 | out: ppsz=0xb3d5ab5fa0*=0x0) returned 1 [0116.805] Str_SetPtrW (in: ppsz=0xb3d5ab5fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop", psz=0x0 | out: ppsz=0xb3d5ab5fa8*=0x0) returned 1 [0116.805] SHSetThreadRef (punk=0x0) returned 0x0 [0116.805] CoUninitialize () [0116.820] LocalFree (hMem=0xb3d567bce0) returned 0x0 [0116.820] EtwEventUnregister (RegHandle=0x2800b3d56809a0) returned 0x0 [0116.820] exit (_Code=0) Thread: id = 238 os_tid = 0xe04 Thread: id = 258 os_tid = 0x27c Thread: id = 259 os_tid = 0x76c Thread: id = 260 os_tid = 0x73c Thread: id = 264 os_tid = 0x610 Thread: id = 265 os_tid = 0x67c Thread: id = 266 os_tid = 0xa98 Thread: id = 299 os_tid = 0x6c4 Thread: id = 300 os_tid = 0x6c8 Process: id = "18" image_name = "openwith.exe" filename = "c:\\windows\\system32\\openwith.exe" page_root = "0x1adf9000" os_pid = "0xe78" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xdd4" cmd_line = "C:\\Windows\\system32\\OpenWith.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2807 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2808 start_va = 0x81090b0000 end_va = 0x81090bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081090b0000" filename = "" Region: id = 2809 start_va = 0x81090c0000 end_va = 0x81090c6fff entry_point = 0x0 region_type = private name = "private_0x00000081090c0000" filename = "" Region: id = 2810 start_va = 0x81090d0000 end_va = 0x81090e3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081090d0000" filename = "" Region: id = 2811 start_va = 0x81090f0000 end_va = 0x810916ffff entry_point = 0x0 region_type = private name = "private_0x00000081090f0000" filename = "" Region: id = 2812 start_va = 0x8109170000 end_va = 0x8109173fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008109170000" filename = "" Region: id = 2813 start_va = 0x8109180000 end_va = 0x8109182fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008109180000" filename = "" Region: id = 2814 start_va = 0x8109190000 end_va = 0x8109191fff entry_point = 0x0 region_type = private name = "private_0x0000008109190000" filename = "" Region: id = 2815 start_va = 0x81091a0000 end_va = 0x810925dfff entry_point = 0x81091a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2816 start_va = 0x8109260000 end_va = 0x8109266fff entry_point = 0x0 region_type = private name = "private_0x0000008109260000" filename = "" Region: id = 2817 start_va = 0x8109270000 end_va = 0x8109270fff entry_point = 0x8109270000 region_type = mapped_file name = "openwith.exe.mui" filename = "\\Windows\\System32\\en-US\\OpenWith.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\openwith.exe.mui") Region: id = 2818 start_va = 0x8109280000 end_va = 0x8109280fff entry_point = 0x0 region_type = private name = "private_0x0000008109280000" filename = "" Region: id = 2819 start_va = 0x8109290000 end_va = 0x8109290fff entry_point = 0x0 region_type = private name = "private_0x0000008109290000" filename = "" Region: id = 2820 start_va = 0x81092a0000 end_va = 0x81092a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081092a0000" filename = "" Region: id = 2821 start_va = 0x81092b0000 end_va = 0x81093affff entry_point = 0x0 region_type = private name = "private_0x00000081092b0000" filename = "" Region: id = 2822 start_va = 0x81093b0000 end_va = 0x810942ffff entry_point = 0x0 region_type = private name = "private_0x00000081093b0000" filename = "" Region: id = 2823 start_va = 0x8109430000 end_va = 0x81095b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008109430000" filename = "" Region: id = 2824 start_va = 0x81095c0000 end_va = 0x8109740fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081095c0000" filename = "" Region: id = 2825 start_va = 0x8109750000 end_va = 0x8109751fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008109750000" filename = "" Region: id = 2826 start_va = 0x8109770000 end_va = 0x810977ffff entry_point = 0x0 region_type = private name = "private_0x0000008109770000" filename = "" Region: id = 2827 start_va = 0x8109780000 end_va = 0x810ab7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008109780000" filename = "" Region: id = 2828 start_va = 0x810ab80000 end_va = 0x810abfffff entry_point = 0x0 region_type = private name = "private_0x000000810ab80000" filename = "" Region: id = 2829 start_va = 0x810ac30000 end_va = 0x810ac3ffff entry_point = 0x0 region_type = private name = "private_0x000000810ac30000" filename = "" Region: id = 2830 start_va = 0x810ac40000 end_va = 0x810af76fff entry_point = 0x810ac40000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2831 start_va = 0x810af80000 end_va = 0x810affffff entry_point = 0x0 region_type = private name = "private_0x000000810af80000" filename = "" Region: id = 2832 start_va = 0x810b000000 end_va = 0x810b07ffff entry_point = 0x0 region_type = private name = "private_0x000000810b000000" filename = "" Region: id = 2833 start_va = 0x810b080000 end_va = 0x810b0fffff entry_point = 0x0 region_type = private name = "private_0x000000810b080000" filename = "" Region: id = 2834 start_va = 0x7df5ff800000 end_va = 0x7ff5ff7fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff800000" filename = "" Region: id = 2835 start_va = 0x7ff7bd300000 end_va = 0x7ff7bd3fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bd300000" filename = "" Region: id = 2836 start_va = 0x7ff7bd400000 end_va = 0x7ff7bd422fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bd400000" filename = "" Region: id = 2837 start_va = 0x7ff7bd423000 end_va = 0x7ff7bd424fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd423000" filename = "" Region: id = 2838 start_va = 0x7ff7bd425000 end_va = 0x7ff7bd425fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd425000" filename = "" Region: id = 2839 start_va = 0x7ff7bd426000 end_va = 0x7ff7bd427fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd426000" filename = "" Region: id = 2840 start_va = 0x7ff7bd428000 end_va = 0x7ff7bd429fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd428000" filename = "" Region: id = 2841 start_va = 0x7ff7bd42a000 end_va = 0x7ff7bd42bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd42a000" filename = "" Region: id = 2842 start_va = 0x7ff7bd42c000 end_va = 0x7ff7bd42dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd42c000" filename = "" Region: id = 2843 start_va = 0x7ff7bd42e000 end_va = 0x7ff7bd42ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd42e000" filename = "" Region: id = 2844 start_va = 0x7ff7bd650000 end_va = 0x7ff7bd669fff entry_point = 0x7ff7bd650000 region_type = mapped_file name = "openwith.exe" filename = "\\Windows\\System32\\OpenWith.exe" (normalized: "c:\\windows\\system32\\openwith.exe") Region: id = 2845 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 2846 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 2847 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2848 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2849 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2850 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2851 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2852 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2853 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2854 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2855 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2856 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 2857 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2858 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2859 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2860 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2861 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2862 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2863 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2864 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2865 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2866 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2867 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2868 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2869 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2870 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2871 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2872 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2873 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2874 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2875 start_va = 0x8109760000 end_va = 0x8109760fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008109760000" filename = "" Region: id = 2876 start_va = 0x810ac00000 end_va = 0x810ac00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000810ac00000" filename = "" Region: id = 2887 start_va = 0x7ff8ddbd0000 end_va = 0x7ff8de6dcfff entry_point = 0x7ff8ddbd0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 2888 start_va = 0x7ff8e9860000 end_va = 0x7ff8e994dfff entry_point = 0x7ff8e9860000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 2889 start_va = 0x7ff8e3a70000 end_va = 0x7ff8e3c26fff entry_point = 0x7ff8e3a70000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 2890 start_va = 0x810ac10000 end_va = 0x810ac12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000810ac10000" filename = "" Region: id = 2891 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2892 start_va = 0x7ff8e7430000 end_va = 0x7ff8e7560fff entry_point = 0x7ff8e7430000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 2893 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3007 start_va = 0x810ac20000 end_va = 0x810ac20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000810ac20000" filename = "" Region: id = 3008 start_va = 0x810b100000 end_va = 0x810b129fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000810b100000" filename = "" Region: id = 3009 start_va = 0x810b130000 end_va = 0x810b131fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000810b130000" filename = "" Region: id = 3010 start_va = 0x810b140000 end_va = 0x810b1bffff entry_point = 0x0 region_type = private name = "private_0x000000810b140000" filename = "" Region: id = 3011 start_va = 0x810b1c0000 end_va = 0x810b23ffff entry_point = 0x0 region_type = private name = "private_0x000000810b1c0000" filename = "" Region: id = 3012 start_va = 0x7ff7bd2fc000 end_va = 0x7ff7bd2fdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd2fc000" filename = "" Region: id = 3013 start_va = 0x7ff7bd2fe000 end_va = 0x7ff7bd2fffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd2fe000" filename = "" Region: id = 3014 start_va = 0x7ff8d1180000 end_va = 0x7ff8d132ffff entry_point = 0x7ff8d1180000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 3015 start_va = 0x7ff8d1330000 end_va = 0x7ff8d147bfff entry_point = 0x7ff8d1330000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 3016 start_va = 0x7ff8d76a0000 end_va = 0x7ff8d7738fff entry_point = 0x7ff8d76a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 3019 start_va = 0x810b240000 end_va = 0x810b241fff entry_point = 0x810b240000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 3020 start_va = 0x810b250000 end_va = 0x810b253fff entry_point = 0x810b250000 region_type = mapped_file name = "windows.ui.immersive.dll.mui" filename = "\\Windows\\System32\\en-US\\Windows.UI.Immersive.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.ui.immersive.dll.mui") Region: id = 3021 start_va = 0x810b260000 end_va = 0x810b2dffff entry_point = 0x0 region_type = private name = "private_0x000000810b260000" filename = "" Region: id = 3022 start_va = 0x810b2e0000 end_va = 0x810b3dffff entry_point = 0x0 region_type = private name = "private_0x000000810b2e0000" filename = "" Region: id = 3023 start_va = 0x810b3e0000 end_va = 0x810b3e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000810b3e0000" filename = "" Region: id = 3024 start_va = 0x810b3f0000 end_va = 0x810b3f0fff entry_point = 0x0 region_type = private name = "private_0x000000810b3f0000" filename = "" Region: id = 3025 start_va = 0x810b400000 end_va = 0x810b400fff entry_point = 0x0 region_type = private name = "private_0x000000810b400000" filename = "" Region: id = 3026 start_va = 0x810b410000 end_va = 0x810b48ffff entry_point = 0x0 region_type = private name = "private_0x000000810b410000" filename = "" Region: id = 3027 start_va = 0x810b490000 end_va = 0x810b490fff entry_point = 0x0 region_type = private name = "private_0x000000810b490000" filename = "" Region: id = 3028 start_va = 0x810b4a0000 end_va = 0x810b4a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000810b4a0000" filename = "" Region: id = 3029 start_va = 0x810b4b0000 end_va = 0x810b4c3fff entry_point = 0x810b4b0000 region_type = mapped_file name = "twinui.dll.mui" filename = "\\Windows\\System32\\en-US\\twinui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\twinui.dll.mui") Region: id = 3030 start_va = 0x810b4d0000 end_va = 0x810b4d1fff entry_point = 0x810b4d0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 3031 start_va = 0x810b4e0000 end_va = 0x810b4e4fff entry_point = 0x810b4e0000 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 3032 start_va = 0x810b4f0000 end_va = 0x810b5effff entry_point = 0x0 region_type = private name = "private_0x000000810b4f0000" filename = "" Region: id = 3033 start_va = 0x7ff7bd2f8000 end_va = 0x7ff7bd2f9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd2f8000" filename = "" Region: id = 3034 start_va = 0x7ff7bd2fa000 end_va = 0x7ff7bd2fbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd2fa000" filename = "" Region: id = 3035 start_va = 0x7ff8debc0000 end_va = 0x7ff8dec28fff entry_point = 0x7ff8debc0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 3036 start_va = 0x7ff8e37f0000 end_va = 0x7ff8e3a48fff entry_point = 0x7ff8e37f0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 3037 start_va = 0x7ff8e8650000 end_va = 0x7ff8e869afff entry_point = 0x7ff8e8650000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 3038 start_va = 0x7ff8e8860000 end_va = 0x7ff8e8acdfff entry_point = 0x7ff8e8860000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 3039 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 3040 start_va = 0x7ff8e8c60000 end_va = 0x7ff8e8cfbfff entry_point = 0x7ff8e8c60000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 3041 start_va = 0x7ff8e8d00000 end_va = 0x7ff8e8fa2fff entry_point = 0x7ff8e8d00000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 3042 start_va = 0x7ff8e9130000 end_va = 0x7ff8e9200fff entry_point = 0x7ff8e9130000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 3043 start_va = 0x810b600000 end_va = 0x810b612fff entry_point = 0x810b600000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 3044 start_va = 0x810b620000 end_va = 0x810b620fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000810b620000" filename = "" Region: id = 3045 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 3046 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 3047 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 3048 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3049 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 3050 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3051 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3392 start_va = 0x810b5f0000 end_va = 0x810b5f3fff entry_point = 0x810b5f0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3393 start_va = 0x810b630000 end_va = 0x810b6affff entry_point = 0x0 region_type = private name = "private_0x000000810b630000" filename = "" Region: id = 3394 start_va = 0x810b6b0000 end_va = 0x810b6cbfff entry_point = 0x810b6b0000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db") Region: id = 3395 start_va = 0x810b6d0000 end_va = 0x810b74ffff entry_point = 0x0 region_type = private name = "private_0x000000810b6d0000" filename = "" Region: id = 3396 start_va = 0x810b750000 end_va = 0x810b753fff entry_point = 0x810b750000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3397 start_va = 0x810b760000 end_va = 0x810b7a2fff entry_point = 0x810b760000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db") Region: id = 3398 start_va = 0x810b7b0000 end_va = 0x810b7b3fff entry_point = 0x810b7b0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3399 start_va = 0x810b7c0000 end_va = 0x810b84afff entry_point = 0x810b7c0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 3400 start_va = 0x810b850000 end_va = 0x810b94ffff entry_point = 0x0 region_type = private name = "private_0x000000810b850000" filename = "" Region: id = 3401 start_va = 0x810b950000 end_va = 0x810b952fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000810b950000" filename = "" Region: id = 3402 start_va = 0x810b970000 end_va = 0x810b973fff entry_point = 0x810b970000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3403 start_va = 0x810b980000 end_va = 0x810b981fff entry_point = 0x810b980000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 3404 start_va = 0x810b990000 end_va = 0x810b998fff entry_point = 0x0 region_type = private name = "private_0x000000810b990000" filename = "" Region: id = 3405 start_va = 0x810b9a0000 end_va = 0x810b9a0fff entry_point = 0x0 region_type = private name = "private_0x000000810b9a0000" filename = "" Region: id = 3406 start_va = 0x810b9b0000 end_va = 0x810b9d3fff entry_point = 0x0 region_type = private name = "private_0x000000810b9b0000" filename = "" Region: id = 3407 start_va = 0x810b9e0000 end_va = 0x810b9e8fff entry_point = 0x0 region_type = private name = "private_0x000000810b9e0000" filename = "" Region: id = 3408 start_va = 0x810b9f0000 end_va = 0x810baeffff entry_point = 0x0 region_type = private name = "private_0x000000810b9f0000" filename = "" Region: id = 3409 start_va = 0x810bb00000 end_va = 0x810bb02fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000810bb00000" filename = "" Region: id = 3410 start_va = 0x810bb10000 end_va = 0x810bb11fff entry_point = 0x810bb10000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 3411 start_va = 0x810bb20000 end_va = 0x810bc1ffff entry_point = 0x810bb20000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 3412 start_va = 0x810bc20000 end_va = 0x810bc67fff entry_point = 0x0 region_type = private name = "private_0x000000810bc20000" filename = "" Region: id = 3413 start_va = 0x810bc70000 end_va = 0x810bc80fff entry_point = 0x810bc70000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 3414 start_va = 0x810bc90000 end_va = 0x810bd8ffff entry_point = 0x810bc90000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 3415 start_va = 0x810bdc0000 end_va = 0x810bdc7fff entry_point = 0x0 region_type = private name = "private_0x000000810bdc0000" filename = "" Region: id = 3416 start_va = 0x810bdd0000 end_va = 0x810be4ffff entry_point = 0x0 region_type = private name = "private_0x000000810bdd0000" filename = "" Region: id = 3417 start_va = 0x810be50000 end_va = 0x810c04ffff entry_point = 0x0 region_type = private name = "private_0x000000810be50000" filename = "" Region: id = 3418 start_va = 0x810c0d0000 end_va = 0x810c145fff entry_point = 0x810c0d0000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 3419 start_va = 0x810c1d0000 end_va = 0x810c1d0fff entry_point = 0x0 region_type = private name = "private_0x000000810c1d0000" filename = "" Region: id = 3420 start_va = 0x810c1e0000 end_va = 0x810c1effff entry_point = 0x0 region_type = private name = "private_0x000000810c1e0000" filename = "" Region: id = 3421 start_va = 0x810c1f0000 end_va = 0x810d1effff entry_point = 0x810c1f0000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 3422 start_va = 0x810d1f0000 end_va = 0x810d9effff entry_point = 0x810d1f0000 region_type = mapped_file name = "~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1462094071-1423818996-289466292-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat") Region: id = 3423 start_va = 0x810d9f0000 end_va = 0x810dacefff entry_point = 0x810d9f0000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 3424 start_va = 0x810dad0000 end_va = 0x810dbb2fff entry_point = 0x810dad0000 region_type = mapped_file name = "seguisb.ttf" filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf") Region: id = 3425 start_va = 0x810dc90000 end_va = 0x810dc90fff entry_point = 0x0 region_type = private name = "private_0x000000810dc90000" filename = "" Region: id = 3426 start_va = 0x7ff7bd2f2000 end_va = 0x7ff7bd2f3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd2f2000" filename = "" Region: id = 3427 start_va = 0x7ff7bd2f4000 end_va = 0x7ff7bd2f5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd2f4000" filename = "" Region: id = 3428 start_va = 0x7ff7bd2f6000 end_va = 0x7ff7bd2f7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bd2f6000" filename = "" Region: id = 3429 start_va = 0x7ff8dc6e0000 end_va = 0x7ff8dc778fff entry_point = 0x7ff8dc6e0000 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 3430 start_va = 0x7ff8dc780000 end_va = 0x7ff8dca11fff entry_point = 0x7ff8dc780000 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 3431 start_va = 0x7ff8dcfd0000 end_va = 0x7ff8dd018fff entry_point = 0x7ff8dcfd0000 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 3432 start_va = 0x7ff8dd900000 end_va = 0x7ff8dd94afff entry_point = 0x7ff8dd900000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 3433 start_va = 0x7ff8e3070000 end_va = 0x7ff8e30f8fff entry_point = 0x7ff8e3070000 region_type = mapped_file name = "directmanipulation.dll" filename = "\\Windows\\System32\\directmanipulation.dll" (normalized: "c:\\windows\\system32\\directmanipulation.dll") Region: id = 3434 start_va = 0x7ff8e86a0000 end_va = 0x7ff8e8851fff entry_point = 0x7ff8e86a0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 3435 start_va = 0x7ff8eac70000 end_va = 0x7ff8ead07fff entry_point = 0x7ff8eac70000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Thread: id = 252 os_tid = 0x378 Thread: id = 253 os_tid = 0x350 Thread: id = 254 os_tid = 0x344 Thread: id = 255 os_tid = 0xe84 Thread: id = 256 os_tid = 0xe80 [0103.806] TranslateMessage (lpMsg=0x810916f5e8) returned 0 [0103.806] DispatchMessageW (lpMsg=0x810916f5e8) returned 0x1 [0103.811] GetMessageW (in: lpMsg=0x810916f5e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x810916f5e8) returned 1 [0103.812] TranslateMessage (lpMsg=0x810916f5e8) returned 0 [0103.812] DispatchMessageW (lpMsg=0x810916f5e8) returned 0x1 [0103.993] IUnknown_Set (in: ppunk=0x8109775f60*=0x0, punk=0x81092e2ad8 | out: ppunk=0x8109775f60*=0x81092e2ad8) [0103.994] GetMessageW (in: lpMsg=0x810916f5e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x810916f5e8) returned 1 [0104.033] TranslateMessage (lpMsg=0x810916f5e8) returned 0 [0104.033] DispatchMessageW (lpMsg=0x810916f5e8) returned 0x1 [0104.034] GetMessageW (in: lpMsg=0x810916f5e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x810916f5e8) returned 1 [0104.037] TranslateMessage (lpMsg=0x810916f5e8) returned 0 [0104.037] DispatchMessageW (lpMsg=0x810916f5e8) returned 0x1 [0104.037] Str_SetPtrW (in: ppsz=0x8109775fa8*=0x0, psz="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: ppsz=0x8109775fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0104.038] GetMessageW (in: lpMsg=0x810916f5e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x810916f5e8) returned 1 [0104.067] TranslateMessage (lpMsg=0x810916f5e8) returned 0 [0104.067] DispatchMessageW (lpMsg=0x810916f5e8) returned 0x1 [0104.068] GetMessageW (in: lpMsg=0x810916f5e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x810916f5e8) returned 1 [0104.069] TranslateMessage (lpMsg=0x810916f5e8) returned 0 [0104.069] DispatchMessageW (lpMsg=0x810916f5e8) returned 0x1 [0104.071] GetMessageW (in: lpMsg=0x810916f5e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x810916f5e8) returned 1 [0104.116] TranslateMessage (lpMsg=0x810916f5e8) returned 0 [0104.116] DispatchMessageW (lpMsg=0x810916f5e8) returned 0x1 [0104.129] IUnknown_Set (in: ppunk=0x8109775fc0*=0x0, punk=0x81092e7f48 | out: ppunk=0x8109775fc0*=0x81092e7f48) [0104.129] GetMessageW (in: lpMsg=0x810916f5e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x810916f5e8) returned 1 [0104.137] TranslateMessage (lpMsg=0x810916f5e8) returned 0 [0104.137] DispatchMessageW (lpMsg=0x810916f5e8) returned 0x1 [0104.137] GetMessageW (in: lpMsg=0x810916f5e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x810916f5e8) returned 1 [0104.202] TranslateMessage (lpMsg=0x810916f5e8) returned 0 [0104.202] DispatchMessageW (lpMsg=0x810916f5e8) returned 0x1 [0104.202] GetMessageW (in: lpMsg=0x810916f5e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x810916f5e8) returned 1 [0104.259] TranslateMessage (lpMsg=0x810916f5e8) returned 0 [0104.259] DispatchMessageW (lpMsg=0x810916f5e8) returned 0x1 [0104.259] CoTaskMemAlloc (cb=0xa) returned 0x81092cd8d0 [0104.266] GetMessageW (in: lpMsg=0x810916f5e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x810916f5e8) returned 1 [0104.274] TranslateMessage (lpMsg=0x810916f5e8) returned 0 [0104.274] DispatchMessageW (lpMsg=0x810916f5e8) returned 0x1 [0104.275] GetMessageW (in: lpMsg=0x810916f5e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x810916f5e8) returned 1 [0104.281] TranslateMessage (lpMsg=0x810916f5e8) returned 0 [0104.281] DispatchMessageW (lpMsg=0x810916f5e8) returned 0x1 [0104.281] GetMessageW (in: lpMsg=0x810916f5e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x810916f5e8) returned 1 [0104.313] TranslateMessage (lpMsg=0x810916f5e8) returned 0 [0104.313] DispatchMessageW (lpMsg=0x810916f5e8) returned 0x1 [0104.313] KillTimer (hWnd=0x0, uIDEvent=0x7f5f) returned 1 [0104.313] CompareStringOrdinal (lpString1="InvokeDefaultVerbInOtherProcess", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 1 [0104.313] CoCreateInstance (in: rclsid=0x7ff7bd6575b0*(Data1=0x94b23d4d, Data2=0x1040, Data3=0x4c4b, Data4=([0]=0x90, [1]=0x81, [2]=0x85, [3]=0xd8, [4]=0xd6, [5]=0xfa, [6]=0x36, [7]=0xc4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7bd657a50*(Data1=0xce149b23, Data2=0x5941, Data3=0x4079, Data4=([0]=0x92, [1]=0x23, [2]=0x52, [3]=0xc0, [4]=0xa9, [5]=0x91, [6]=0xec, [7]=0x48)), ppv=0x8109775fe0 | out: ppv=0x8109775fe0*=0x8109779620) returned 0x0 [0104.341] IUnknown_SetSite (punk=0x8109779620, punkSite=0x8109775f40) returned 0x0 [0104.341] IUnknown:QueryInterface (This=0x8109775f40, riid=0x7ff8ee00d438*(Data1=0x114, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x810916df30) [0104.341] IUnknown:QueryInterface (This=0x8109775f40, riid=0x7ff8ee00d468*(Data1=0x79eac9ed, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x810916df20) [0104.341] IUnknown:QueryInterface (This=0x8109775f40, riid=0x7ff8ee00d458*(Data1=0x214e3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x810916df28) [0104.341] IUnknown:QueryInterface (This=0x8109775f40, riid=0x7ff8ee00d448*(Data1=0x45d64a29, Data2=0xa63e, Data3=0x4cb6, Data4=([0]=0xb4, [1]=0x98, [2]=0x57, [3]=0x81, [4]=0xd2, [5]=0x98, [6]=0xcb, [7]=0x4f)), ppvObject=0x810916df38) [0104.341] IUnknown:QueryInterface (This=0x8109775f40, riid=0x7ff8eb8347d8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x810916df60) [0104.342] IUnknown:QueryInterface (in: This=0x81092e2ad8, riid=0x7ff8de1e0bd8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x810916df90 | out: ppvObject=0x810916df90*=0x81092e2ad8) returned 0x0 [0104.818] IUnknown:QueryInterface (This=0x8109775f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x810916df90) [0104.818] IUnknown:AddRef (This=0x8109775f40) returned 0xe [0104.818] IUnknown_QueryService (in: punk=0x81092e2ad8, guidService=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), riid=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), ppvOut=0x81097796e0 | out: ppvOut=0x81097796e0*=0x0) returned 0x80004001 [0105.110] IUnknown:Release (This=0x8109775f40) returned 0xd [0105.110] IUnknown:QueryInterface (This=0x8109775f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x810916df90) [0105.110] IUnknown:AddRef (This=0x8109775f40) returned 0xe [0105.110] IUnknown_QueryService (in: punk=0x81092e2ad8, guidService=0x7ff8de1c0980*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), riid=0x7ff8de1c0a40*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), ppvOut=0x81097796e8 | out: ppvOut=0x81097796e8*=0x0) returned 0x80004001 [0105.111] IUnknown:Release (This=0x8109775f40) returned 0xd [0105.111] IUnknown:QueryInterface (This=0x8109775f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x810916df90) [0105.111] IUnknown:AddRef (This=0x8109775f40) returned 0xe [0105.111] IUnknown_QueryService (in: punk=0x81092e2ad8, guidService=0x7ff8de1c0950*(Data1=0xcde725b0, Data2=0xccc9, Data3=0x4519, Data4=([0]=0x91, [1]=0x7e, [2]=0x32, [3]=0x5d, [4]=0x72, [5]=0xfa, [6]=0xb4, [7]=0xce)), riid=0x7ff8de1d2fb0*(Data1=0x1af3a467, Data2=0x214f, Data3=0x4298, Data4=([0]=0x90, [1]=0x8e, [2]=0x6, [3]=0xb0, [4]=0x3e, [5]=0xb, [6]=0x39, [7]=0xf9)), ppvOut=0x81097796f0 | out: ppvOut=0x81097796f0*=0x0) returned 0x80004001 [0105.112] IUnknown:Release (This=0x8109775f40) returned 0xd [0105.112] IUnknown:QueryInterface (This=0x8109775f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x810916df90) [0105.112] IUnknown:AddRef (This=0x8109775f40) returned 0xe [0105.112] IUnknown_QueryService (in: punk=0x81092e2ad8, guidService=0x7ff8de1c0800*(Data1=0x80605492, Data2=0x67d9, Data3=0x414f, Data4=([0]=0xaf, [1]=0x89, [2]=0xa1, [3]=0xcd, [4]=0xf1, [5]=0x24, [6]=0x2b, [7]=0xc1)), riid=0x7ff8de1c0068*(Data1=0xe5aa01f7, Data2=0x1fb8, Data3=0x4830, Data4=([0]=0x87, [1]=0x20, [2]=0x4e, [3]=0x67, [4]=0x34, [5]=0xcb, [6]=0xd5, [7]=0xf3)), ppvOut=0x81097796f8 | out: ppvOut=0x81097796f8*=0x0) returned 0x80004001 [0105.113] IUnknown:Release (This=0x8109775f40) returned 0xd [0105.113] IUnknown:QueryInterface (This=0x8109775f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x810916df90) [0105.113] IUnknown:AddRef (This=0x8109775f40) returned 0xe [0105.113] IUnknown_QueryService (in: punk=0x81092e2ad8, guidService=0x7ff8de1c0810*(Data1=0x2ce78010, Data2=0x74db, Data3=0x48bc, Data4=([0]=0x9c, [1]=0x6a, [2]=0x10, [3]=0xf3, [4]=0x72, [5]=0x49, [6]=0x57, [7]=0x23)), riid=0x7ff8de1bfb70*(Data1=0x989191ac, Data2=0x28ff, Data3=0x4cf0, Data4=([0]=0x95, [1]=0x84, [2]=0xe0, [3]=0xd0, [4]=0x78, [5]=0xbc, [6]=0x23, [7]=0x96)), ppvOut=0x8109779700 | out: ppvOut=0x8109779700*=0x0) returned 0x80004001 [0105.114] IUnknown:Release (This=0x8109775f40) returned 0xd [0105.114] IUnknown:QueryInterface (This=0x8109775f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x810916df90) [0105.114] IUnknown:AddRef (This=0x8109775f40) returned 0xe [0105.114] IUnknown_QueryService (in: punk=0x81092e2ad8, guidService=0x7ff8de1c0078*(Data1=0x26db2472, Data2=0xb7b7, Data3=0x406b, Data4=([0]=0x97, [1]=0x2, [2]=0x73, [3]=0xa, [4]=0x4e, [5]=0x20, [6]=0xd3, [7]=0xbf)), riid=0x7ff8de1c0a10*(Data1=0x2f0666c6, Data2=0x12f7, Data3=0x4360, Data4=([0]=0xb5, [1]=0x11, [2]=0xa3, [3]=0x94, [4]=0xa0, [5]=0x55, [6]=0x37, [7]=0x25)), ppvOut=0x8109779708 | out: ppvOut=0x8109779708*=0x0) returned 0x80004001 [0105.115] IUnknown:Release (This=0x8109775f40) returned 0xd [0105.115] IUnknown:QueryInterface (This=0x8109775f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x810916df90) [0105.115] IUnknown:AddRef (This=0x8109775f40) returned 0xe [0105.115] IUnknown_QueryService (in: punk=0x81092e2ad8, guidService=0x7ff8de1c0930*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), riid=0x7ff8de1c0a30*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), ppvOut=0x8109779bf0 | out: ppvOut=0x8109779bf0*=0x0) returned 0x80004001 [0105.116] IUnknown:Release (This=0x8109775f40) returned 0xd [0105.116] IUnknown:QueryInterface (This=0x8109775f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x810916df90) [0105.116] IUnknown:AddRef (This=0x8109775f40) returned 0xe [0105.116] IUnknown_QueryService (in: punk=0x81092e2ad8, guidService=0x7ff8de27c2c0*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff8de27fc98*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0x810916dfd0 | out: ppvOut=0x810916dfd0*=0x0) returned 0x80004001 [0105.116] IUnknown:Release (This=0x8109775f40) returned 0xd [0105.116] IUnknown:AddRef (This=0x8109775f40) returned 0xe [0105.116] GetCurrentThreadId () returned 0xe80 [0105.116] PostThreadMessageW (idThread=0xe80, Msg=0x8001, wParam=0x0, lParam=0x0) returned 1 [0105.117] GetMessageW (in: lpMsg=0x810916f5e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x810916f5e8) returned 1 [0105.117] CompareStringOrdinal (lpString1="openas", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0105.117] CompareStringOrdinal (lpString1="OpenWithSetDefaultOn", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0105.117] IUnknown_QueryService (in: punk=0x81092e2ad8, guidService=0x7ff7bd657da0*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), riid=0x7ff7bd657910*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), ppvOut=0x810916f678 | out: ppvOut=0x810916f678*=0x81092ebea8) returned 0x0 [0105.205] IUnknown_Set (in: ppunk=0x8109775f60*=0x81092e2ad8, punk=0x0 | out: ppunk=0x8109775f60*=0x0) [0105.208] IUnknown_QueryService (in: punk=0x0, guidService=0x7ff7bd657d60*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff7bd657950*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0x810916f5c8 | out: ppvOut=0x810916f5c8*=0x0) returned 0x80004001 [0105.208] QISearch (in: that=0x8109775f30, pqit=0x7ff7bd657970, riid=0x7ff7bd657ac0*(Data1=0x1c9cd5bb, Data2=0x98e9, Data3=0x4491, Data4=([0]=0xa6, [1]=0xf, [2]=0x31, [3]=0xaa, [4]=0xcc, [5]=0x72, [6]=0xb8, [7]=0x3c)), ppv=0x810916f528 | out: that=0x8109775f30, ppv=0x810916f528*=0x8109775f78) returned 0x0 [0105.208] IUnknown:QueryInterface (in: This=0x81092e7f48, riid=0x7ff7bd657930*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0x810916f5c0 | out: ppvObject=0x810916f5c0*=0x81092e7f48) returned 0x0 [0105.209] IShellItemArray:GetItemAt (in: This=0x81092e7f48, dwIndex=0x0, ppsi=0x810916f5b0 | out: ppsi=0x810916f5b0*=0x81092e29b8) returned 0x0 [0105.209] IUnknown:QueryInterface (in: This=0x81092e29b8, riid=0x7ff7bd657b10*(Data1=0x7e9fb0d3, Data2=0x919f, Data3=0x4307, Data4=([0]=0xab, [1]=0x2e, [2]=0x9b, [3]=0x18, [4]=0x60, [5]=0x31, [6]=0xc, [7]=0x93)), ppvObject=0x810916f5b8 | out: ppvObject=0x810916f5b8*=0x81092e29b8) returned 0x0 [0105.210] IUnknown:Release (This=0x81092e29b8) returned 0x1 [0105.210] IShellItem:BindToHandler (in: This=0x81092e29b8, pbc=0x0, bhid=0x7ff7bd657db0, riid=0x7ff7bd657920, ppv=0x810916f5b0 | out: ppv=0x810916f5b0) returned 0x0 [0105.214] IUnknown:Release (This=0x81092e29b8) returned 0x0 [0105.214] IUnknown:Release (This=0x81092e7f48) returned 0x1 [0105.215] IUnknown:AddRef (This=0x8109775f78) returned 0xf [0105.215] IObjectWithSelection:GetSelection (in: This=0x8109775f78, riid=0x7ff8de1c76a8, ppv=0x8109779718 | out: ppv=0x8109779718) returned 0x0 [0105.215] IUnknown:QueryInterface (in: This=0x81092e7f48, riid=0x7ff8de1c76a8*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0x8109779718 | out: ppvObject=0x8109779718*=0x81092e7f48) returned 0x0 [0105.215] IUnknown:Release (This=0x8109775f78) returned 0xe [0105.361] IUnknown:Release (This=0x8109775f78) returned 0x7 [0105.361] IUnknown:Release (This=0x8109775f78) returned 0x6 [0116.718] IUnknown:Release (This=0x81092e7f48) returned 0x1 [0116.718] IUnknown_SetSite (punk=0x8109779620, punkSite=0x0) returned 0x0 [0116.718] IUnknown:Release (This=0x8109775f40) returned 0x2 [0116.718] PostQuitMessage (nExitCode=0) [0116.718] TranslateMessage (lpMsg=0x810916f5e8) returned 0 [0116.718] DispatchMessageW (lpMsg=0x810916f5e8) returned 0x0 [0116.718] GetMessageW (in: lpMsg=0x810916f5e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x810916f5e8) returned 0 [0116.718] CoRevokeClassObject (dwRegister=0x10) returned 0x0 [0116.776] IUnknown:Release (This=0x8109779620) returned 0x0 [0116.811] CoTaskMemFree (pv=0x81092cd8d0) [0116.811] Str_SetPtrW (in: ppsz=0x8109775fa0*=0x0, psz=0x0 | out: ppsz=0x8109775fa0*=0x0) returned 1 [0116.811] Str_SetPtrW (in: ppsz=0x8109775fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop", psz=0x0 | out: ppsz=0x8109775fa8*=0x0) returned 1 [0116.811] SHSetThreadRef (punk=0x0) returned 0x0 [0116.812] CoUninitialize () [0116.838] LocalFree (hMem=0x81092bb830) returned 0x0 [0116.838] EtwEventUnregister (RegHandle=0x280081092c1330) returned 0x0 [0116.838] exit (_Code=0) Thread: id = 257 os_tid = 0x304 Thread: id = 270 os_tid = 0xa78 Thread: id = 276 os_tid = 0x9d4 Thread: id = 278 os_tid = 0xa60 Thread: id = 279 os_tid = 0x9e4 Thread: id = 280 os_tid = 0x85c Thread: id = 281 os_tid = 0x868 Thread: id = 301 os_tid = 0xfa8 Thread: id = 302 os_tid = 0xf30 Process: id = "19" image_name = "openwith.exe" filename = "c:\\windows\\system32\\openwith.exe" page_root = "0x19dfe000" os_pid = "0xa88" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xdd4" cmd_line = "C:\\Windows\\system32\\OpenWith.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2939 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2940 start_va = 0xc6a90c0000 end_va = 0xc6a90cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6a90c0000" filename = "" Region: id = 2941 start_va = 0xc6a90d0000 end_va = 0xc6a90d6fff entry_point = 0x0 region_type = private name = "private_0x000000c6a90d0000" filename = "" Region: id = 2942 start_va = 0xc6a90e0000 end_va = 0xc6a90f3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6a90e0000" filename = "" Region: id = 2943 start_va = 0xc6a9100000 end_va = 0xc6a917ffff entry_point = 0x0 region_type = private name = "private_0x000000c6a9100000" filename = "" Region: id = 2944 start_va = 0xc6a9180000 end_va = 0xc6a9183fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6a9180000" filename = "" Region: id = 2945 start_va = 0xc6a9190000 end_va = 0xc6a9192fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6a9190000" filename = "" Region: id = 2946 start_va = 0xc6a91a0000 end_va = 0xc6a91a1fff entry_point = 0x0 region_type = private name = "private_0x000000c6a91a0000" filename = "" Region: id = 2947 start_va = 0xc6a91b0000 end_va = 0xc6a926dfff entry_point = 0xc6a91b0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2948 start_va = 0xc6a9270000 end_va = 0xc6a92effff entry_point = 0x0 region_type = private name = "private_0x000000c6a9270000" filename = "" Region: id = 2949 start_va = 0xc6a92f0000 end_va = 0xc6a92f6fff entry_point = 0x0 region_type = private name = "private_0x000000c6a92f0000" filename = "" Region: id = 2950 start_va = 0xc6a9300000 end_va = 0xc6a9300fff entry_point = 0xc6a9300000 region_type = mapped_file name = "openwith.exe.mui" filename = "\\Windows\\System32\\en-US\\OpenWith.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\openwith.exe.mui") Region: id = 2951 start_va = 0xc6a9310000 end_va = 0xc6a940ffff entry_point = 0x0 region_type = private name = "private_0x000000c6a9310000" filename = "" Region: id = 2952 start_va = 0xc6a9410000 end_va = 0xc6a9597fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6a9410000" filename = "" Region: id = 2953 start_va = 0xc6a95a0000 end_va = 0xc6a95a0fff entry_point = 0x0 region_type = private name = "private_0x000000c6a95a0000" filename = "" Region: id = 2954 start_va = 0xc6a95b0000 end_va = 0xc6a95b0fff entry_point = 0x0 region_type = private name = "private_0x000000c6a95b0000" filename = "" Region: id = 2955 start_va = 0xc6a95c0000 end_va = 0xc6a95c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6a95c0000" filename = "" Region: id = 2956 start_va = 0xc6a95d0000 end_va = 0xc6a95d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6a95d0000" filename = "" Region: id = 2957 start_va = 0xc6a95e0000 end_va = 0xc6a965ffff entry_point = 0x0 region_type = private name = "private_0x000000c6a95e0000" filename = "" Region: id = 2958 start_va = 0xc6a96a0000 end_va = 0xc6a96affff entry_point = 0x0 region_type = private name = "private_0x000000c6a96a0000" filename = "" Region: id = 2959 start_va = 0xc6a96b0000 end_va = 0xc6a9830fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6a96b0000" filename = "" Region: id = 2960 start_va = 0xc6a9840000 end_va = 0xc6aac3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6a9840000" filename = "" Region: id = 2961 start_va = 0xc6aac40000 end_va = 0xc6aacbffff entry_point = 0x0 region_type = private name = "private_0x000000c6aac40000" filename = "" Region: id = 2962 start_va = 0xc6aacc0000 end_va = 0xc6aad3ffff entry_point = 0x0 region_type = private name = "private_0x000000c6aacc0000" filename = "" Region: id = 2963 start_va = 0xc6aad90000 end_va = 0xc6aad9ffff entry_point = 0x0 region_type = private name = "private_0x000000c6aad90000" filename = "" Region: id = 2964 start_va = 0xc6aada0000 end_va = 0xc6ab0d6fff entry_point = 0xc6aada0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2965 start_va = 0xc6ab0e0000 end_va = 0xc6ab15ffff entry_point = 0x0 region_type = private name = "private_0x000000c6ab0e0000" filename = "" Region: id = 2966 start_va = 0x7df5ff970000 end_va = 0x7ff5ff96ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff970000" filename = "" Region: id = 2967 start_va = 0x7ff7bc7d0000 end_va = 0x7ff7bc8cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bc7d0000" filename = "" Region: id = 2968 start_va = 0x7ff7bc8d0000 end_va = 0x7ff7bc8f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7bc8d0000" filename = "" Region: id = 2969 start_va = 0x7ff7bc8f3000 end_va = 0x7ff7bc8f3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc8f3000" filename = "" Region: id = 2970 start_va = 0x7ff7bc8f4000 end_va = 0x7ff7bc8f5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc8f4000" filename = "" Region: id = 2971 start_va = 0x7ff7bc8f6000 end_va = 0x7ff7bc8f7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc8f6000" filename = "" Region: id = 2972 start_va = 0x7ff7bc8f8000 end_va = 0x7ff7bc8f9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc8f8000" filename = "" Region: id = 2973 start_va = 0x7ff7bc8fa000 end_va = 0x7ff7bc8fbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc8fa000" filename = "" Region: id = 2974 start_va = 0x7ff7bc8fc000 end_va = 0x7ff7bc8fdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc8fc000" filename = "" Region: id = 2975 start_va = 0x7ff7bc8fe000 end_va = 0x7ff7bc8fffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc8fe000" filename = "" Region: id = 2976 start_va = 0x7ff7bd650000 end_va = 0x7ff7bd669fff entry_point = 0x7ff7bd650000 region_type = mapped_file name = "openwith.exe" filename = "\\Windows\\System32\\OpenWith.exe" (normalized: "c:\\windows\\system32\\openwith.exe") Region: id = 2977 start_va = 0x7ff8df640000 end_va = 0x7ff8dfaa9fff entry_point = 0x7ff8df640000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 2978 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 2979 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2980 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2981 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2982 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2983 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2984 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2985 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2986 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2987 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2988 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 2989 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2990 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2991 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2992 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2993 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2994 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2995 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2996 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2997 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2998 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2999 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3000 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3001 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3002 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3003 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3004 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3005 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3006 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3017 start_va = 0xc6a9660000 end_va = 0xc6a9660fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6a9660000" filename = "" Region: id = 3018 start_va = 0xc6a9670000 end_va = 0xc6a9670fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6a9670000" filename = "" Region: id = 3052 start_va = 0x7ff8ddbd0000 end_va = 0x7ff8de6dcfff entry_point = 0x7ff8ddbd0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 3053 start_va = 0x7ff8e9860000 end_va = 0x7ff8e994dfff entry_point = 0x7ff8e9860000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 3054 start_va = 0x7ff8e3a70000 end_va = 0x7ff8e3c26fff entry_point = 0x7ff8e3a70000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 3055 start_va = 0xc6a9680000 end_va = 0xc6a9682fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6a9680000" filename = "" Region: id = 3056 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 3057 start_va = 0x7ff8e7430000 end_va = 0x7ff8e7560fff entry_point = 0x7ff8e7430000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 3058 start_va = 0x7ff8ea360000 end_va = 0x7ff8ea37efff entry_point = 0x7ff8ea360000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3060 start_va = 0xc6a9690000 end_va = 0xc6a9690fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6a9690000" filename = "" Region: id = 3061 start_va = 0xc6aad40000 end_va = 0xc6aad69fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6aad40000" filename = "" Region: id = 3062 start_va = 0xc6aad70000 end_va = 0xc6aad71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6aad70000" filename = "" Region: id = 3063 start_va = 0xc6ab160000 end_va = 0xc6ab1dffff entry_point = 0x0 region_type = private name = "private_0x000000c6ab160000" filename = "" Region: id = 3064 start_va = 0xc6ab1e0000 end_va = 0xc6ab25ffff entry_point = 0x0 region_type = private name = "private_0x000000c6ab1e0000" filename = "" Region: id = 3065 start_va = 0x7ff7bc7cc000 end_va = 0x7ff7bc7cdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc7cc000" filename = "" Region: id = 3066 start_va = 0x7ff7bc7ce000 end_va = 0x7ff7bc7cffff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc7ce000" filename = "" Region: id = 3067 start_va = 0x7ff8d1180000 end_va = 0x7ff8d132ffff entry_point = 0x7ff8d1180000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 3068 start_va = 0x7ff8d1330000 end_va = 0x7ff8d147bfff entry_point = 0x7ff8d1330000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 3069 start_va = 0x7ff8d76a0000 end_va = 0x7ff8d7738fff entry_point = 0x7ff8d76a0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 3070 start_va = 0xc6aad80000 end_va = 0xc6aad81fff entry_point = 0xc6aad80000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 3071 start_va = 0xc6ab260000 end_va = 0xc6ab263fff entry_point = 0xc6ab260000 region_type = mapped_file name = "windows.ui.immersive.dll.mui" filename = "\\Windows\\System32\\en-US\\Windows.UI.Immersive.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.ui.immersive.dll.mui") Region: id = 3072 start_va = 0xc6ab270000 end_va = 0xc6ab2effff entry_point = 0x0 region_type = private name = "private_0x000000c6ab270000" filename = "" Region: id = 3073 start_va = 0xc6ab2f0000 end_va = 0xc6ab3effff entry_point = 0x0 region_type = private name = "private_0x000000c6ab2f0000" filename = "" Region: id = 3074 start_va = 0xc6ab3f0000 end_va = 0xc6ab3f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6ab3f0000" filename = "" Region: id = 3075 start_va = 0xc6ab400000 end_va = 0xc6ab400fff entry_point = 0x0 region_type = private name = "private_0x000000c6ab400000" filename = "" Region: id = 3076 start_va = 0xc6ab410000 end_va = 0xc6ab410fff entry_point = 0x0 region_type = private name = "private_0x000000c6ab410000" filename = "" Region: id = 3077 start_va = 0xc6ab420000 end_va = 0xc6ab49ffff entry_point = 0x0 region_type = private name = "private_0x000000c6ab420000" filename = "" Region: id = 3078 start_va = 0x7ff7bc7c8000 end_va = 0x7ff7bc7c9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc7c8000" filename = "" Region: id = 3079 start_va = 0x7ff7bc7ca000 end_va = 0x7ff7bc7cbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc7ca000" filename = "" Region: id = 3080 start_va = 0x7ff8e37f0000 end_va = 0x7ff8e3a48fff entry_point = 0x7ff8e37f0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 3081 start_va = 0x7ff8e8650000 end_va = 0x7ff8e869afff entry_point = 0x7ff8e8650000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 3082 start_va = 0x7ff8e8860000 end_va = 0x7ff8e8acdfff entry_point = 0x7ff8e8860000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 3083 start_va = 0x7ff8e8af0000 end_va = 0x7ff8e8b55fff entry_point = 0x7ff8e8af0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 3084 start_va = 0x7ff8e8c60000 end_va = 0x7ff8e8cfbfff entry_point = 0x7ff8e8c60000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 3085 start_va = 0x7ff8e8d00000 end_va = 0x7ff8e8fa2fff entry_point = 0x7ff8e8d00000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 3216 start_va = 0xc6ab4a0000 end_va = 0xc6ab4a0fff entry_point = 0x0 region_type = private name = "private_0x000000c6ab4a0000" filename = "" Region: id = 3217 start_va = 0xc6ab4b0000 end_va = 0xc6ab4b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6ab4b0000" filename = "" Region: id = 3218 start_va = 0xc6ab4c0000 end_va = 0xc6ab4d3fff entry_point = 0xc6ab4c0000 region_type = mapped_file name = "twinui.dll.mui" filename = "\\Windows\\System32\\en-US\\twinui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\twinui.dll.mui") Region: id = 3219 start_va = 0xc6ab4e0000 end_va = 0xc6ab4e1fff entry_point = 0xc6ab4e0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 3220 start_va = 0xc6ab4f0000 end_va = 0xc6ab4f4fff entry_point = 0xc6ab4f0000 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 3221 start_va = 0xc6ab500000 end_va = 0xc6ab5fffff entry_point = 0x0 region_type = private name = "private_0x000000c6ab500000" filename = "" Region: id = 3222 start_va = 0xc6ab600000 end_va = 0xc6ab603fff entry_point = 0xc6ab600000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3223 start_va = 0xc6ab610000 end_va = 0xc6ab622fff entry_point = 0xc6ab610000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 3224 start_va = 0xc6ab630000 end_va = 0xc6ab630fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6ab630000" filename = "" Region: id = 3225 start_va = 0xc6ab640000 end_va = 0xc6ab6bffff entry_point = 0x0 region_type = private name = "private_0x000000c6ab640000" filename = "" Region: id = 3226 start_va = 0xc6ab6c0000 end_va = 0xc6ab6dbfff entry_point = 0xc6ab6c0000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db") Region: id = 3227 start_va = 0xc6ab6e0000 end_va = 0xc6ab75ffff entry_point = 0x0 region_type = private name = "private_0x000000c6ab6e0000" filename = "" Region: id = 3228 start_va = 0xc6ab760000 end_va = 0xc6ab763fff entry_point = 0xc6ab760000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3229 start_va = 0xc6ab770000 end_va = 0xc6ab7b2fff entry_point = 0xc6ab770000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db") Region: id = 3230 start_va = 0xc6ab7c0000 end_va = 0xc6ab7c3fff entry_point = 0xc6ab7c0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3231 start_va = 0xc6ab7d0000 end_va = 0xc6ab85afff entry_point = 0xc6ab7d0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 3232 start_va = 0xc6ab860000 end_va = 0xc6ab95ffff entry_point = 0x0 region_type = private name = "private_0x000000c6ab860000" filename = "" Region: id = 3233 start_va = 0xc6ab960000 end_va = 0xc6ab962fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6ab960000" filename = "" Region: id = 3234 start_va = 0xc6ab970000 end_va = 0xc6ab970fff entry_point = 0x0 region_type = private name = "private_0x000000c6ab970000" filename = "" Region: id = 3235 start_va = 0xc6ab980000 end_va = 0xc6ab983fff entry_point = 0xc6ab980000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3236 start_va = 0xc6ab990000 end_va = 0xc6ab991fff entry_point = 0xc6ab990000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 3237 start_va = 0xc6ab9a0000 end_va = 0xc6ab9a8fff entry_point = 0x0 region_type = private name = "private_0x000000c6ab9a0000" filename = "" Region: id = 3238 start_va = 0xc6ab9b0000 end_va = 0xc6ab9b0fff entry_point = 0x0 region_type = private name = "private_0x000000c6ab9b0000" filename = "" Region: id = 3239 start_va = 0xc6ab9c0000 end_va = 0xc6ab9e3fff entry_point = 0x0 region_type = private name = "private_0x000000c6ab9c0000" filename = "" Region: id = 3240 start_va = 0xc6ab9f0000 end_va = 0xc6ab9f8fff entry_point = 0x0 region_type = private name = "private_0x000000c6ab9f0000" filename = "" Region: id = 3241 start_va = 0xc6aba00000 end_va = 0xc6abafffff entry_point = 0x0 region_type = private name = "private_0x000000c6aba00000" filename = "" Region: id = 3242 start_va = 0xc6abb00000 end_va = 0xc6abb04fff entry_point = 0x0 region_type = private name = "private_0x000000c6abb00000" filename = "" Region: id = 3243 start_va = 0xc6abb10000 end_va = 0xc6abb12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6abb10000" filename = "" Region: id = 3244 start_va = 0xc6abb20000 end_va = 0xc6abb21fff entry_point = 0xc6abb20000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 3245 start_va = 0xc6abb30000 end_va = 0xc6abc2ffff entry_point = 0xc6abb30000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 3246 start_va = 0xc6abc30000 end_va = 0xc6abc77fff entry_point = 0x0 region_type = private name = "private_0x000000c6abc30000" filename = "" Region: id = 3247 start_va = 0xc6abc80000 end_va = 0xc6abc90fff entry_point = 0xc6abc80000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 3248 start_va = 0xc6abca0000 end_va = 0xc6abd9ffff entry_point = 0xc6abca0000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 3249 start_va = 0xc6abda0000 end_va = 0xc6abda0fff entry_point = 0x0 region_type = private name = "private_0x000000c6abda0000" filename = "" Region: id = 3250 start_va = 0xc6abdb0000 end_va = 0xc6abdb0fff entry_point = 0x0 region_type = private name = "private_0x000000c6abdb0000" filename = "" Region: id = 3251 start_va = 0xc6abdc0000 end_va = 0xc6abdc0fff entry_point = 0x0 region_type = private name = "private_0x000000c6abdc0000" filename = "" Region: id = 3252 start_va = 0xc6abdd0000 end_va = 0xc6abdd0fff entry_point = 0x0 region_type = private name = "private_0x000000c6abdd0000" filename = "" Region: id = 3253 start_va = 0xc6abde0000 end_va = 0xc6abe5ffff entry_point = 0x0 region_type = private name = "private_0x000000c6abde0000" filename = "" Region: id = 3254 start_va = 0xc6abe60000 end_va = 0xc6abe60fff entry_point = 0x0 region_type = private name = "private_0x000000c6abe60000" filename = "" Region: id = 3255 start_va = 0xc6abe70000 end_va = 0xc6abe70fff entry_point = 0x0 region_type = private name = "private_0x000000c6abe70000" filename = "" Region: id = 3256 start_va = 0xc6abe80000 end_va = 0xc6abe8ffff entry_point = 0x0 region_type = private name = "private_0x000000c6abe80000" filename = "" Region: id = 3257 start_va = 0xc6abe90000 end_va = 0xc6abf0ffff entry_point = 0x0 region_type = private name = "private_0x000000c6abe90000" filename = "" Region: id = 3258 start_va = 0xc6abf10000 end_va = 0xc6abf85fff entry_point = 0xc6abf10000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 3259 start_va = 0xc6abf90000 end_va = 0xc6acf8ffff entry_point = 0xc6abf90000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 3260 start_va = 0xc6acf90000 end_va = 0xc6ad78ffff entry_point = 0xc6acf90000 region_type = mapped_file name = "~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1462094071-1423818996-289466292-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1462094071-1423818996-289466292-1000.dat") Region: id = 3261 start_va = 0xc6ad790000 end_va = 0xc6ad86efff entry_point = 0xc6ad790000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 3262 start_va = 0xc6ad870000 end_va = 0xc6ad952fff entry_point = 0xc6ad870000 region_type = mapped_file name = "seguisb.ttf" filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf") Region: id = 3263 start_va = 0xc6ad960000 end_va = 0xc6ada22fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6ad960000" filename = "" Region: id = 3264 start_va = 0xc6ada30000 end_va = 0xc6adaabfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6ada30000" filename = "" Region: id = 3265 start_va = 0xc6adab0000 end_va = 0xc6adb72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6adab0000" filename = "" Region: id = 3266 start_va = 0xc6adb80000 end_va = 0xc6adc42fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c6adb80000" filename = "" Region: id = 3267 start_va = 0x7ff7bc7c0000 end_va = 0x7ff7bc7c1fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc7c0000" filename = "" Region: id = 3268 start_va = 0x7ff7bc7c2000 end_va = 0x7ff7bc7c3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc7c2000" filename = "" Region: id = 3269 start_va = 0x7ff7bc7c4000 end_va = 0x7ff7bc7c5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc7c4000" filename = "" Region: id = 3270 start_va = 0x7ff7bc7c6000 end_va = 0x7ff7bc7c7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7bc7c6000" filename = "" Region: id = 3271 start_va = 0x7ff8dc6e0000 end_va = 0x7ff8dc778fff entry_point = 0x7ff8dc6e0000 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 3272 start_va = 0x7ff8dc780000 end_va = 0x7ff8dca11fff entry_point = 0x7ff8dc780000 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 3273 start_va = 0x7ff8dcfd0000 end_va = 0x7ff8dd018fff entry_point = 0x7ff8dcfd0000 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 3274 start_va = 0x7ff8dd900000 end_va = 0x7ff8dd94afff entry_point = 0x7ff8dd900000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 3275 start_va = 0x7ff8debc0000 end_va = 0x7ff8dec28fff entry_point = 0x7ff8debc0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 3276 start_va = 0x7ff8e3070000 end_va = 0x7ff8e30f8fff entry_point = 0x7ff8e3070000 region_type = mapped_file name = "directmanipulation.dll" filename = "\\Windows\\System32\\directmanipulation.dll" (normalized: "c:\\windows\\system32\\directmanipulation.dll") Region: id = 3277 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 3278 start_va = 0x7ff8e4fb0000 end_va = 0x7ff8e504dfff entry_point = 0x7ff8e4fb0000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 3279 start_va = 0x7ff8e5050000 end_va = 0x7ff8e515efff entry_point = 0x7ff8e5050000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 3280 start_va = 0x7ff8e79b0000 end_va = 0x7ff8e7b32fff entry_point = 0x7ff8e79b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3281 start_va = 0x7ff8e86a0000 end_va = 0x7ff8e8851fff entry_point = 0x7ff8e86a0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 3282 start_va = 0x7ff8e9000000 end_va = 0x7ff8e905bfff entry_point = 0x7ff8e9000000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 3283 start_va = 0x7ff8e9130000 end_va = 0x7ff8e9200fff entry_point = 0x7ff8e9130000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 3284 start_va = 0x7ff8e9500000 end_va = 0x7ff8e9577fff entry_point = 0x7ff8e9500000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3285 start_va = 0x7ff8eac70000 end_va = 0x7ff8ead07fff entry_point = 0x7ff8eac70000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 3286 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3436 start_va = 0xc6abdd0000 end_va = 0xc6abdd7fff entry_point = 0x0 region_type = private name = "private_0x000000c6abdd0000" filename = "" Region: id = 3437 start_va = 0xc6adc60000 end_va = 0xc6ade5ffff entry_point = 0x0 region_type = private name = "private_0x000000c6adc60000" filename = "" Thread: id = 271 os_tid = 0xa90 Thread: id = 272 os_tid = 0x96c Thread: id = 273 os_tid = 0x950 Thread: id = 274 os_tid = 0x928 Thread: id = 275 os_tid = 0x9a8 [0107.013] TranslateMessage (lpMsg=0xc6a917f998) returned 0 [0107.013] DispatchMessageW (lpMsg=0xc6a917f998) returned 0x1 [0107.020] GetMessageW (in: lpMsg=0xc6a917f998, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc6a917f998) returned 1 [0107.020] TranslateMessage (lpMsg=0xc6a917f998) returned 0 [0107.020] DispatchMessageW (lpMsg=0xc6a917f998) returned 0x1 [0107.585] IUnknown_Set (in: ppunk=0xc6a96a5f60*=0x0, punk=0xc6a9342ad8 | out: ppunk=0xc6a96a5f60*=0xc6a9342ad8) [0107.586] GetMessageW (in: lpMsg=0xc6a917f998, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc6a917f998) returned 1 [0107.641] TranslateMessage (lpMsg=0xc6a917f998) returned 0 [0107.641] DispatchMessageW (lpMsg=0xc6a917f998) returned 0x1 [0107.641] GetMessageW (in: lpMsg=0xc6a917f998, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc6a917f998) returned 1 [0107.642] TranslateMessage (lpMsg=0xc6a917f998) returned 0 [0107.642] DispatchMessageW (lpMsg=0xc6a917f998) returned 0x1 [0107.642] Str_SetPtrW (in: ppsz=0xc6a96a5fa8*=0x0, psz="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: ppsz=0xc6a96a5fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0107.643] GetMessageW (in: lpMsg=0xc6a917f998, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc6a917f998) returned 1 [0107.656] TranslateMessage (lpMsg=0xc6a917f998) returned 0 [0107.656] DispatchMessageW (lpMsg=0xc6a917f998) returned 0x1 [0107.658] GetMessageW (in: lpMsg=0xc6a917f998, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc6a917f998) returned 1 [0107.661] TranslateMessage (lpMsg=0xc6a917f998) returned 0 [0107.661] DispatchMessageW (lpMsg=0xc6a917f998) returned 0x1 [0107.662] GetMessageW (in: lpMsg=0xc6a917f998, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc6a917f998) returned 1 [0107.669] TranslateMessage (lpMsg=0xc6a917f998) returned 0 [0107.669] DispatchMessageW (lpMsg=0xc6a917f998) returned 0x1 [0107.679] IUnknown_Set (in: ppunk=0xc6a96a5fc0*=0x0, punk=0xc6a9347f48 | out: ppunk=0xc6a96a5fc0*=0xc6a9347f48) [0107.679] GetMessageW (in: lpMsg=0xc6a917f998, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc6a917f998) returned 1 [0107.680] TranslateMessage (lpMsg=0xc6a917f998) returned 0 [0107.680] DispatchMessageW (lpMsg=0xc6a917f998) returned 0x1 [0107.681] GetMessageW (in: lpMsg=0xc6a917f998, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc6a917f998) returned 1 [0107.685] TranslateMessage (lpMsg=0xc6a917f998) returned 0 [0107.685] DispatchMessageW (lpMsg=0xc6a917f998) returned 0x1 [0107.686] GetMessageW (in: lpMsg=0xc6a917f998, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc6a917f998) returned 1 [0107.754] TranslateMessage (lpMsg=0xc6a917f998) returned 0 [0107.754] DispatchMessageW (lpMsg=0xc6a917f998) returned 0x1 [0107.754] CoTaskMemAlloc (cb=0xa) returned 0xc6a932da50 [0107.838] GetMessageW (in: lpMsg=0xc6a917f998, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc6a917f998) returned 1 [0107.944] TranslateMessage (lpMsg=0xc6a917f998) returned 0 [0107.944] DispatchMessageW (lpMsg=0xc6a917f998) returned 0x1 [0107.945] GetMessageW (in: lpMsg=0xc6a917f998, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc6a917f998) returned 1 [0108.097] TranslateMessage (lpMsg=0xc6a917f998) returned 0 [0108.097] DispatchMessageW (lpMsg=0xc6a917f998) returned 0x1 [0108.098] GetMessageW (in: lpMsg=0xc6a917f998, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc6a917f998) returned 1 [0108.145] TranslateMessage (lpMsg=0xc6a917f998) returned 0 [0108.145] DispatchMessageW (lpMsg=0xc6a917f998) returned 0x1 [0108.145] KillTimer (hWnd=0x0, uIDEvent=0x7f59) returned 1 [0108.145] CompareStringOrdinal (lpString1="InvokeDefaultVerbInOtherProcess", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 1 [0108.145] CoCreateInstance (in: rclsid=0x7ff7bd6575b0*(Data1=0x94b23d4d, Data2=0x1040, Data3=0x4c4b, Data4=([0]=0x90, [1]=0x81, [2]=0x85, [3]=0xd8, [4]=0xd6, [5]=0xfa, [6]=0x36, [7]=0xc4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7bd657a50*(Data1=0xce149b23, Data2=0x5941, Data3=0x4079, Data4=([0]=0x92, [1]=0x23, [2]=0x52, [3]=0xc0, [4]=0xa9, [5]=0x91, [6]=0xec, [7]=0x48)), ppv=0xc6a96a5fe0 | out: ppv=0xc6a96a5fe0*=0xc6a96a9620) returned 0x0 [0108.175] IUnknown_SetSite (punk=0xc6a96a9620, punkSite=0xc6a96a5f40) returned 0x0 [0108.175] IUnknown:QueryInterface (This=0xc6a96a5f40, riid=0x7ff8ee00d438*(Data1=0x114, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xc6a917e2e0) [0108.175] IUnknown:QueryInterface (This=0xc6a96a5f40, riid=0x7ff8ee00d468*(Data1=0x79eac9ed, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xc6a917e2d0) [0108.175] IUnknown:QueryInterface (This=0xc6a96a5f40, riid=0x7ff8ee00d458*(Data1=0x214e3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xc6a917e2d8) [0108.175] IUnknown:QueryInterface (This=0xc6a96a5f40, riid=0x7ff8ee00d448*(Data1=0x45d64a29, Data2=0xa63e, Data3=0x4cb6, Data4=([0]=0xb4, [1]=0x98, [2]=0x57, [3]=0x81, [4]=0xd2, [5]=0x98, [6]=0xcb, [7]=0x4f)), ppvObject=0xc6a917e2e8) [0108.175] IUnknown:QueryInterface (This=0xc6a96a5f40, riid=0x7ff8eb8347d8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0xc6a917e310) [0108.175] IUnknown:QueryInterface (in: This=0xc6a9342ad8, riid=0x7ff8de1e0bd8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xc6a917e340 | out: ppvObject=0xc6a917e340*=0xc6a9342ad8) returned 0x0 [0108.353] IUnknown:QueryInterface (This=0xc6a96a5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc6a917e340) [0108.353] IUnknown:AddRef (This=0xc6a96a5f40) returned 0xe [0108.353] IUnknown_QueryService (in: punk=0xc6a9342ad8, guidService=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), riid=0x7ff8de1c09e0*(Data1=0xbafa21d8, Data2=0xb071, Data3=0x4cd8, Data4=([0]=0x85, [1]=0x3e, [2]=0x34, [3]=0x12, [4]=0x3, [5]=0xe5, [6]=0x57, [7]=0xd3)), ppvOut=0xc6a96a96e0 | out: ppvOut=0xc6a96a96e0*=0x0) returned 0x80004001 [0108.470] IUnknown:Release (This=0xc6a96a5f40) returned 0xd [0108.470] IUnknown:QueryInterface (This=0xc6a96a5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc6a917e340) [0108.470] IUnknown:AddRef (This=0xc6a96a5f40) returned 0xe [0108.470] IUnknown_QueryService (in: punk=0xc6a9342ad8, guidService=0x7ff8de1c0980*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), riid=0x7ff8de1c0a40*(Data1=0x4b6832a2, Data2=0x5f04, Data3=0x4c9d, Data4=([0]=0xb8, [1]=0x9d, [2]=0x72, [3]=0x7a, [4]=0x15, [5]=0xd1, [6]=0x3, [7]=0xe7)), ppvOut=0xc6a96a96e8 | out: ppvOut=0xc6a96a96e8*=0x0) returned 0x80004001 [0108.472] IUnknown:Release (This=0xc6a96a5f40) returned 0xd [0108.472] IUnknown:QueryInterface (This=0xc6a96a5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc6a917e340) [0108.472] IUnknown:AddRef (This=0xc6a96a5f40) returned 0xe [0108.472] IUnknown_QueryService (in: punk=0xc6a9342ad8, guidService=0x7ff8de1c0950*(Data1=0xcde725b0, Data2=0xccc9, Data3=0x4519, Data4=([0]=0x91, [1]=0x7e, [2]=0x32, [3]=0x5d, [4]=0x72, [5]=0xfa, [6]=0xb4, [7]=0xce)), riid=0x7ff8de1d2fb0*(Data1=0x1af3a467, Data2=0x214f, Data3=0x4298, Data4=([0]=0x90, [1]=0x8e, [2]=0x6, [3]=0xb0, [4]=0x3e, [5]=0xb, [6]=0x39, [7]=0xf9)), ppvOut=0xc6a96a96f0 | out: ppvOut=0xc6a96a96f0*=0x0) returned 0x80004001 [0108.473] IUnknown:Release (This=0xc6a96a5f40) returned 0xd [0108.473] IUnknown:QueryInterface (This=0xc6a96a5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc6a917e340) [0108.473] IUnknown:AddRef (This=0xc6a96a5f40) returned 0xe [0108.473] IUnknown_QueryService (in: punk=0xc6a9342ad8, guidService=0x7ff8de1c0800*(Data1=0x80605492, Data2=0x67d9, Data3=0x414f, Data4=([0]=0xaf, [1]=0x89, [2]=0xa1, [3]=0xcd, [4]=0xf1, [5]=0x24, [6]=0x2b, [7]=0xc1)), riid=0x7ff8de1c0068*(Data1=0xe5aa01f7, Data2=0x1fb8, Data3=0x4830, Data4=([0]=0x87, [1]=0x20, [2]=0x4e, [3]=0x67, [4]=0x34, [5]=0xcb, [6]=0xd5, [7]=0xf3)), ppvOut=0xc6a96a96f8 | out: ppvOut=0xc6a96a96f8*=0x0) returned 0x80004001 [0108.474] IUnknown:Release (This=0xc6a96a5f40) returned 0xd [0108.474] IUnknown:QueryInterface (This=0xc6a96a5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc6a917e340) [0108.474] IUnknown:AddRef (This=0xc6a96a5f40) returned 0xe [0108.474] IUnknown_QueryService (in: punk=0xc6a9342ad8, guidService=0x7ff8de1c0810*(Data1=0x2ce78010, Data2=0x74db, Data3=0x48bc, Data4=([0]=0x9c, [1]=0x6a, [2]=0x10, [3]=0xf3, [4]=0x72, [5]=0x49, [6]=0x57, [7]=0x23)), riid=0x7ff8de1bfb70*(Data1=0x989191ac, Data2=0x28ff, Data3=0x4cf0, Data4=([0]=0x95, [1]=0x84, [2]=0xe0, [3]=0xd0, [4]=0x78, [5]=0xbc, [6]=0x23, [7]=0x96)), ppvOut=0xc6a96a9700 | out: ppvOut=0xc6a96a9700*=0x0) returned 0x80004001 [0108.516] IUnknown:Release (This=0xc6a96a5f40) returned 0xd [0108.516] IUnknown:QueryInterface (This=0xc6a96a5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc6a917e340) [0108.517] IUnknown:AddRef (This=0xc6a96a5f40) returned 0xe [0108.517] IUnknown_QueryService (in: punk=0xc6a9342ad8, guidService=0x7ff8de1c0078*(Data1=0x26db2472, Data2=0xb7b7, Data3=0x406b, Data4=([0]=0x97, [1]=0x2, [2]=0x73, [3]=0xa, [4]=0x4e, [5]=0x20, [6]=0xd3, [7]=0xbf)), riid=0x7ff8de1c0a10*(Data1=0x2f0666c6, Data2=0x12f7, Data3=0x4360, Data4=([0]=0xb5, [1]=0x11, [2]=0xa3, [3]=0x94, [4]=0xa0, [5]=0x55, [6]=0x37, [7]=0x25)), ppvOut=0xc6a96a9708 | out: ppvOut=0xc6a96a9708*=0x0) returned 0x80004001 [0108.517] IUnknown:Release (This=0xc6a96a5f40) returned 0xd [0108.517] IUnknown:QueryInterface (This=0xc6a96a5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc6a917e340) [0108.517] IUnknown:AddRef (This=0xc6a96a5f40) returned 0xe [0108.517] IUnknown_QueryService (in: punk=0xc6a9342ad8, guidService=0x7ff8de1c0930*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), riid=0x7ff8de1c0a30*(Data1=0x667708d1, Data2=0xa931, Data3=0x4a85, Data4=([0]=0x99, [1]=0x99, [2]=0x60, [3]=0x9e, [4]=0xaa, [5]=0x7d, [6]=0xd8, [7]=0x5a)), ppvOut=0xc6a96a9bf0 | out: ppvOut=0xc6a96a9bf0*=0x0) returned 0x80004001 [0108.518] IUnknown:Release (This=0xc6a96a5f40) returned 0xd [0108.518] IUnknown:QueryInterface (This=0xc6a96a5f40, riid=0x7ff8eb834628*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xc6a917e340) [0108.518] IUnknown:AddRef (This=0xc6a96a5f40) returned 0xe [0108.518] IUnknown_QueryService (in: punk=0xc6a9342ad8, guidService=0x7ff8de27c2c0*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff8de27fc98*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xc6a917e380 | out: ppvOut=0xc6a917e380*=0x0) returned 0x80004001 [0108.519] IUnknown:Release (This=0xc6a96a5f40) returned 0xd [0108.519] IUnknown:AddRef (This=0xc6a96a5f40) returned 0xe [0108.519] GetCurrentThreadId () returned 0x9a8 [0108.519] PostThreadMessageW (idThread=0x9a8, Msg=0x8001, wParam=0x0, lParam=0x0) returned 1 [0108.520] GetMessageW (in: lpMsg=0xc6a917f998, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc6a917f998) returned 1 [0108.520] CompareStringOrdinal (lpString1="openas", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0108.520] CompareStringOrdinal (lpString1="OpenWithSetDefaultOn", cchCount1=-1, lpString2="open", cchCount2=-1, bIgnoreCase=1) returned 3 [0108.520] IUnknown_QueryService (in: punk=0xc6a9342ad8, guidService=0x7ff7bd657da0*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), riid=0x7ff7bd657910*(Data1=0x9d923edc, Data2=0xb7a9, Data3=0x4f77, Data4=([0]=0x99, [1]=0x33, [2]=0x28, [3]=0x4e, [4]=0x7e, [5]=0x2b, [6]=0x25, [7]=0x36)), ppvOut=0xc6a917fa28 | out: ppvOut=0xc6a917fa28*=0xc6a934bea8) returned 0x0 [0108.538] IUnknown_Set (in: ppunk=0xc6a96a5f60*=0xc6a9342ad8, punk=0x0 | out: ppunk=0xc6a96a5f60*=0x0) [0108.540] IUnknown_QueryService (in: punk=0x0, guidService=0x7ff7bd657d60*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), riid=0x7ff7bd657950*(Data1=0x94724f59, Data2=0xeb2c, Data3=0x4efb, Data4=([0]=0xad, [1]=0x2b, [2]=0x85, [3]=0x38, [4]=0xf6, [5]=0x49, [6]=0x6f, [7]=0x7d)), ppvOut=0xc6a917f978 | out: ppvOut=0xc6a917f978*=0x0) returned 0x80004001 [0108.540] QISearch (in: that=0xc6a96a5f30, pqit=0x7ff7bd657970, riid=0x7ff7bd657ac0*(Data1=0x1c9cd5bb, Data2=0x98e9, Data3=0x4491, Data4=([0]=0xa6, [1]=0xf, [2]=0x31, [3]=0xaa, [4]=0xcc, [5]=0x72, [6]=0xb8, [7]=0x3c)), ppv=0xc6a917f8d8 | out: that=0xc6a96a5f30, ppv=0xc6a917f8d8*=0xc6a96a5f78) returned 0x0 [0108.540] IUnknown:QueryInterface (in: This=0xc6a9347f48, riid=0x7ff7bd657930*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xc6a917f970 | out: ppvObject=0xc6a917f970*=0xc6a9347f48) returned 0x0 [0108.540] IShellItemArray:GetItemAt (in: This=0xc6a9347f48, dwIndex=0x0, ppsi=0xc6a917f960 | out: ppsi=0xc6a917f960*=0xc6a934cb48) returned 0x0 [0108.541] IUnknown:QueryInterface (in: This=0xc6a934cb48, riid=0x7ff7bd657b10*(Data1=0x7e9fb0d3, Data2=0x919f, Data3=0x4307, Data4=([0]=0xab, [1]=0x2e, [2]=0x9b, [3]=0x18, [4]=0x60, [5]=0x31, [6]=0xc, [7]=0x93)), ppvObject=0xc6a917f968 | out: ppvObject=0xc6a917f968*=0xc6a934cb48) returned 0x0 [0108.541] IUnknown:Release (This=0xc6a934cb48) returned 0x1 [0108.541] IShellItem:BindToHandler (in: This=0xc6a934cb48, pbc=0x0, bhid=0x7ff7bd657db0, riid=0x7ff7bd657920, ppv=0xc6a917f960 | out: ppv=0xc6a917f960) returned 0x0 [0108.546] IUnknown:Release (This=0xc6a934cb48) returned 0x0 [0108.547] IUnknown:Release (This=0xc6a9347f48) returned 0x1 [0108.547] IUnknown:AddRef (This=0xc6a96a5f78) returned 0xf [0108.547] IObjectWithSelection:GetSelection (in: This=0xc6a96a5f78, riid=0x7ff8de1c76a8, ppv=0xc6a96a9718 | out: ppv=0xc6a96a9718) returned 0x0 [0108.547] IUnknown:QueryInterface (in: This=0xc6a9347f48, riid=0x7ff8de1c76a8*(Data1=0xb63ea76d, Data2=0x1f85, Data3=0x456f, Data4=([0]=0xa1, [1]=0x9c, [2]=0x48, [3]=0x15, [4]=0x9e, [5]=0xfa, [6]=0x85, [7]=0x8b)), ppvObject=0xc6a96a9718 | out: ppvObject=0xc6a96a9718*=0xc6a9347f48) returned 0x0 [0108.547] IUnknown:Release (This=0xc6a96a5f78) returned 0xe [0108.604] IUnknown:Release (This=0xc6a96a5f78) returned 0x7 [0108.604] IUnknown:Release (This=0xc6a96a5f78) returned 0x6 [0120.928] IUnknown:Release (This=0xc6a9347f48) returned 0x1 [0120.928] IUnknown_SetSite (punk=0xc6a96a9620, punkSite=0x0) returned 0x0 [0120.928] IUnknown:Release (This=0xc6a96a5f40) returned 0x2 [0120.928] PostQuitMessage (nExitCode=0) [0120.928] TranslateMessage (lpMsg=0xc6a917f998) returned 0 [0120.928] DispatchMessageW (lpMsg=0xc6a917f998) returned 0x0 [0120.928] GetMessageW (in: lpMsg=0xc6a917f998, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc6a917f998) returned 0 [0120.929] CoRevokeClassObject (dwRegister=0x10) returned 0x0 [0120.929] IUnknown:Release (This=0xc6a96a9620) returned 0x0 [0121.014] CoTaskMemFree (pv=0xc6a932da50) [0121.014] Str_SetPtrW (in: ppsz=0xc6a96a5fa0*=0x0, psz=0x0 | out: ppsz=0xc6a96a5fa0*=0x0) returned 1 [0121.014] Str_SetPtrW (in: ppsz=0xc6a96a5fa8*="C:\\Users\\CIiHmnxMn6Ps\\Desktop", psz=0x0 | out: ppsz=0xc6a96a5fa8*=0x0) returned 1 [0121.014] SHSetThreadRef (punk=0x0) returned 0x0 [0121.014] CoUninitialize () [0121.027] LocalFree (hMem=0xc6a931b6e0) returned 0x0 [0121.027] EtwEventUnregister (RegHandle=0x2800c6a9320de0) returned 0x0 [0121.027] exit (_Code=0) Thread: id = 277 os_tid = 0xa64 Thread: id = 284 os_tid = 0xf28 Thread: id = 285 os_tid = 0xf24 Thread: id = 286 os_tid = 0x9ac Thread: id = 287 os_tid = 0xc6c Thread: id = 289 os_tid = 0x374 Thread: id = 290 os_tid = 0xbac Thread: id = 303 os_tid = 0xfa4 Thread: id = 304 os_tid = 0xfa0 Process: id = "20" image_name = "officeclicktorun.exe" filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe" page_root = "0x58f68000" os_pid = "0xa78" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0x508" cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe\" /user" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00014ee5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3438 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3439 start_va = 0x44607f0000 end_va = 0x446080ffff entry_point = 0x0 region_type = private name = "private_0x00000044607f0000" filename = "" Region: id = 3440 start_va = 0x4460810000 end_va = 0x4460823fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004460810000" filename = "" Region: id = 3441 start_va = 0x4460830000 end_va = 0x446092ffff entry_point = 0x0 region_type = private name = "private_0x0000004460830000" filename = "" Region: id = 3442 start_va = 0x4460930000 end_va = 0x4460933fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004460930000" filename = "" Region: id = 3443 start_va = 0x4460940000 end_va = 0x4460942fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004460940000" filename = "" Region: id = 3444 start_va = 0x4460950000 end_va = 0x4460951fff entry_point = 0x0 region_type = private name = "private_0x0000004460950000" filename = "" Region: id = 3445 start_va = 0x7df5ff3c0000 end_va = 0x7ff5ff3bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff3c0000" filename = "" Region: id = 3446 start_va = 0x7ff649f80000 end_va = 0x7ff649fa2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff649f80000" filename = "" Region: id = 3447 start_va = 0x7ff649fa8000 end_va = 0x7ff649fa8fff entry_point = 0x0 region_type = private name = "private_0x00007ff649fa8000" filename = "" Region: id = 3448 start_va = 0x7ff649fae000 end_va = 0x7ff649faffff entry_point = 0x0 region_type = private name = "private_0x00007ff649fae000" filename = "" Region: id = 3449 start_va = 0x7ff64a820000 end_va = 0x7ff64b07bfff entry_point = 0x7ff64a820000 region_type = mapped_file name = "officeclicktorun.exe" filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe") Region: id = 3450 start_va = 0x7ff8ee380000 end_va = 0x7ff8ee541fff entry_point = 0x7ff8ee380000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3451 start_va = 0x44607f0000 end_va = 0x44607fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000044607f0000" filename = "" Region: id = 3452 start_va = 0x4460960000 end_va = 0x4460a1dfff entry_point = 0x4460960000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3453 start_va = 0x4460a80000 end_va = 0x4460b7ffff entry_point = 0x0 region_type = private name = "private_0x0000004460a80000" filename = "" Region: id = 3454 start_va = 0x7ff649e80000 end_va = 0x7ff649f7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff649e80000" filename = "" Region: id = 3455 start_va = 0x7ff8eb870000 end_va = 0x7ff8eba4cfff entry_point = 0x7ff8eb870000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3456 start_va = 0x7ff8ee2d0000 end_va = 0x7ff8ee37cfff entry_point = 0x7ff8ee2d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3457 start_va = 0x4460800000 end_va = 0x4460806fff entry_point = 0x0 region_type = private name = "private_0x0000004460800000" filename = "" Region: id = 3458 start_va = 0x4460a20000 end_va = 0x4460a26fff entry_point = 0x0 region_type = private name = "private_0x0000004460a20000" filename = "" Region: id = 3459 start_va = 0x4460a30000 end_va = 0x4460a30fff entry_point = 0x0 region_type = private name = "private_0x0000004460a30000" filename = "" Region: id = 3460 start_va = 0x4460a40000 end_va = 0x4460a40fff entry_point = 0x0 region_type = private name = "private_0x0000004460a40000" filename = "" Region: id = 3461 start_va = 0x4460b80000 end_va = 0x4460c7ffff entry_point = 0x0 region_type = private name = "private_0x0000004460b80000" filename = "" Region: id = 3462 start_va = 0x4460d00000 end_va = 0x4460d0ffff entry_point = 0x0 region_type = private name = "private_0x0000004460d00000" filename = "" Region: id = 3463 start_va = 0x4460d10000 end_va = 0x4460e97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004460d10000" filename = "" Region: id = 3464 start_va = 0x4460ea0000 end_va = 0x4461020fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004460ea0000" filename = "" Region: id = 3465 start_va = 0x4461030000 end_va = 0x446242ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004461030000" filename = "" Region: id = 3466 start_va = 0x7ff649fac000 end_va = 0x7ff649fadfff entry_point = 0x0 region_type = private name = "private_0x00007ff649fac000" filename = "" Region: id = 3467 start_va = 0x7ff8e5eb0000 end_va = 0x7ff8e5ee9fff entry_point = 0x7ff8e5eb0000 region_type = mapped_file name = "apiclient.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll") Region: id = 3468 start_va = 0x7ff8e5ef0000 end_va = 0x7ff8e5f21fff entry_point = 0x7ff8e5ef0000 region_type = mapped_file name = "rstrtmgr.dll" filename = "\\Windows\\System32\\RstrtMgr.dll" (normalized: "c:\\windows\\system32\\rstrtmgr.dll") Region: id = 3469 start_va = 0x7ff8e5f30000 end_va = 0x7ff8e5fcefff entry_point = 0x7ff8e5f30000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll") Region: id = 3470 start_va = 0x7ff8e5fd0000 end_va = 0x7ff8e5fe5fff entry_point = 0x7ff8e5fd0000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll") Region: id = 3471 start_va = 0x7ff8e5ff0000 end_va = 0x7ff8e6016fff entry_point = 0x7ff8e5ff0000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 3472 start_va = 0x7ff8e6c30000 end_va = 0x7ff8e6d21fff entry_point = 0x7ff8e6c30000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 3473 start_va = 0x7ff8e8460000 end_va = 0x7ff8e846afff entry_point = 0x7ff8e8460000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 3474 start_va = 0x7ff8e8480000 end_va = 0x7ff8e84b7fff entry_point = 0x7ff8e8480000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 3475 start_va = 0x7ff8e8ad0000 end_va = 0x7ff8e8ae2fff entry_point = 0x7ff8e8ad0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3476 start_va = 0x7ff8ea880000 end_va = 0x7ff8ea8b5fff entry_point = 0x7ff8ea880000 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 3477 start_va = 0x7ff8ea8c0000 end_va = 0x7ff8ea8e5fff entry_point = 0x7ff8ea8c0000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 3478 start_va = 0x7ff8eabd0000 end_va = 0x7ff8eabf7fff entry_point = 0x7ff8eabd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3479 start_va = 0x7ff8eadb0000 end_va = 0x7ff8eadc0fff entry_point = 0x7ff8eadb0000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3480 start_va = 0x7ff8eae50000 end_va = 0x7ff8eaea3fff entry_point = 0x7ff8eae50000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 3481 start_va = 0x7ff8eaf60000 end_va = 0x7ff8eafa3fff entry_point = 0x7ff8eaf60000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3482 start_va = 0x7ff8eafb0000 end_va = 0x7ff8eb170fff entry_point = 0x7ff8eafb0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3483 start_va = 0x7ff8ebb30000 end_va = 0x7ff8ebbedfff entry_point = 0x7ff8ebb30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3484 start_va = 0x7ff8ebbf0000 end_va = 0x7ff8ebdb4fff entry_point = 0x7ff8ebbf0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 3485 start_va = 0x7ff8ebdc0000 end_va = 0x7ff8ebf0dfff entry_point = 0x7ff8ebdc0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3486 start_va = 0x7ff8ec0c0000 end_va = 0x7ff8ec21bfff entry_point = 0x7ff8ec0c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3487 start_va = 0x7ff8ec240000 end_va = 0x7ff8ec29afff entry_point = 0x7ff8ec240000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3488 start_va = 0x7ff8ec300000 end_va = 0x7ff8ec440fff entry_point = 0x7ff8ec300000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3489 start_va = 0x7ff8ec450000 end_va = 0x7ff8ec575fff entry_point = 0x7ff8ec450000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3490 start_va = 0x7ff8edbc0000 end_va = 0x7ff8edd44fff entry_point = 0x7ff8edbc0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3491 start_va = 0x7ff8edd60000 end_va = 0x7ff8edfdbfff entry_point = 0x7ff8edd60000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3492 start_va = 0x7ff8edfe0000 end_va = 0x7ff8ee030fff entry_point = 0x7ff8edfe0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3493 start_va = 0x7ff8ee040000 end_va = 0x7ff8ee0a8fff entry_point = 0x7ff8ee040000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3494 start_va = 0x7ff8ee0b0000 end_va = 0x7ff8ee14cfff entry_point = 0x7ff8ee0b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3495 start_va = 0x7ff8ee150000 end_va = 0x7ff8ee185fff entry_point = 0x7ff8ee150000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3496 start_va = 0x7ff8ee190000 end_va = 0x7ff8ee235fff entry_point = 0x7ff8ee190000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3497 start_va = 0x7ff8ee250000 end_va = 0x7ff8ee257fff entry_point = 0x7ff8ee250000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3498 start_va = 0x4460a50000 end_va = 0x4460a50fff entry_point = 0x0 region_type = private name = "private_0x0000004460a50000" filename = "" Region: id = 3499 start_va = 0x4460a60000 end_va = 0x4460a60fff entry_point = 0x0 region_type = private name = "private_0x0000004460a60000" filename = "" Region: id = 3500 start_va = 0x4460a70000 end_va = 0x4460a71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004460a70000" filename = "" Region: id = 3501 start_va = 0x4462430000 end_va = 0x4462766fff entry_point = 0x4462430000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3502 start_va = 0x7ff8e5a30000 end_va = 0x7ff8e5d6cfff entry_point = 0x7ff8e5a30000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 3503 start_va = 0x7ff8eac00000 end_va = 0x7ff8eac6afff entry_point = 0x7ff8eac00000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3504 start_va = 0x7ff8eadd0000 end_va = 0x7ff8eae19fff entry_point = 0x7ff8eadd0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3505 start_va = 0x7ff8eae20000 end_va = 0x7ff8eae2efff entry_point = 0x7ff8eae20000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3506 start_va = 0x7ff8eae30000 end_va = 0x7ff8eae42fff entry_point = 0x7ff8eae30000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3507 start_va = 0x7ff8eb180000 end_va = 0x7ff8eb7a7fff entry_point = 0x7ff8eb180000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 3508 start_va = 0x7ff8eb7b0000 end_va = 0x7ff8eb862fff entry_point = 0x7ff8eb7b0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 3509 start_va = 0x7ff8ec580000 end_va = 0x7ff8edaa4fff entry_point = 0x7ff8ec580000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3510 start_va = 0x4460c80000 end_va = 0x4460c80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004460c80000" filename = "" Region: id = 3511 start_va = 0x4460c90000 end_va = 0x4460c91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004460c90000" filename = "" Region: id = 3512 start_va = 0x4462770000 end_va = 0x446286ffff entry_point = 0x0 region_type = private name = "private_0x0000004462770000" filename = "" Region: id = 3513 start_va = 0x4462870000 end_va = 0x446296ffff entry_point = 0x0 region_type = private name = "private_0x0000004462870000" filename = "" Region: id = 3514 start_va = 0x4462970000 end_va = 0x4462a6ffff entry_point = 0x0 region_type = private name = "private_0x0000004462970000" filename = "" Region: id = 3515 start_va = 0x4462a70000 end_va = 0x4462b6ffff entry_point = 0x0 region_type = private name = "private_0x0000004462a70000" filename = "" Region: id = 3516 start_va = 0x7ff649fa4000 end_va = 0x7ff649fa5fff entry_point = 0x0 region_type = private name = "private_0x00007ff649fa4000" filename = "" Region: id = 3517 start_va = 0x7ff649fa6000 end_va = 0x7ff649fa7fff entry_point = 0x0 region_type = private name = "private_0x00007ff649fa6000" filename = "" Region: id = 3518 start_va = 0x7ff649faa000 end_va = 0x7ff649fabfff entry_point = 0x0 region_type = private name = "private_0x00007ff649faa000" filename = "" Region: id = 3519 start_va = 0x7ff8e3a50000 end_va = 0x7ff8e3a59fff entry_point = 0x7ff8e3a50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3520 start_va = 0x7ff8e57b0000 end_va = 0x7ff8e5a23fff entry_point = 0x7ff8e57b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 3521 start_va = 0x7ff8e6330000 end_va = 0x7ff8e6365fff entry_point = 0x7ff8e6330000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 3522 start_va = 0x4460cf0000 end_va = 0x4460cfffff entry_point = 0x0 region_type = private name = "private_0x0000004460cf0000" filename = "" Region: id = 3523 start_va = 0x4462b70000 end_va = 0x4462c6ffff entry_point = 0x0 region_type = private name = "private_0x0000004462b70000" filename = "" Region: id = 3524 start_va = 0x4462c70000 end_va = 0x4462d6ffff entry_point = 0x0 region_type = private name = "private_0x0000004462c70000" filename = "" Region: id = 3525 start_va = 0x7ff649e7c000 end_va = 0x7ff649e7dfff entry_point = 0x0 region_type = private name = "private_0x00007ff649e7c000" filename = "" Region: id = 3526 start_va = 0x7ff649e7e000 end_va = 0x7ff649e7ffff entry_point = 0x0 region_type = private name = "private_0x00007ff649e7e000" filename = "" Region: id = 3527 start_va = 0x7ff8e0a60000 end_va = 0x7ff8e0bf6fff entry_point = 0x7ff8e0a60000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 3528 start_va = 0x7ff8e3c30000 end_va = 0x7ff8e3fa5fff entry_point = 0x7ff8e3c30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 3529 start_va = 0x7ff8e5480000 end_va = 0x7ff8e548bfff entry_point = 0x7ff8e5480000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 3530 start_va = 0x7ff8e9680000 end_va = 0x7ff8e9715fff entry_point = 0x7ff8e9680000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3531 start_va = 0x7ff8ea790000 end_va = 0x7ff8ea79afff entry_point = 0x7ff8ea790000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3532 start_va = 0x7ff8ea9d0000 end_va = 0x7ff8ea9fbfff entry_point = 0x7ff8ea9d0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3533 start_va = 0x7ff8edd50000 end_va = 0x7ff8edd56fff entry_point = 0x7ff8edd50000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 3534 start_va = 0x4460ca0000 end_va = 0x4460ca3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004460ca0000" filename = "" Region: id = 3535 start_va = 0x4460cb0000 end_va = 0x4460cb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004460cb0000" filename = "" Region: id = 3536 start_va = 0x4462d70000 end_va = 0x4462e27fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004462d70000" filename = "" Region: id = 3537 start_va = 0x7ff8dff00000 end_va = 0x7ff8e01a6fff entry_point = 0x7ff8dff00000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 3538 start_va = 0x7ff8e8fb0000 end_va = 0x7ff8e8fd1fff entry_point = 0x7ff8e8fb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 3539 start_va = 0x4460cc0000 end_va = 0x4460cc0fff entry_point = 0x4460cc0000 region_type = mapped_file name = "counters.dat" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 3540 start_va = 0x7ff8e0f80000 end_va = 0x7ff8e0f94fff entry_point = 0x7ff8e0f80000 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 3541 start_va = 0x7ff8e5dd0000 end_va = 0x7ff8e5ea5fff entry_point = 0x7ff8e5dd0000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 3542 start_va = 0x4460cd0000 end_va = 0x4460cd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004460cd0000" filename = "" Region: id = 3543 start_va = 0x4462e30000 end_va = 0x4462f2ffff entry_point = 0x0 region_type = private name = "private_0x0000004462e30000" filename = "" Region: id = 3544 start_va = 0x4462f30000 end_va = 0x446302ffff entry_point = 0x0 region_type = private name = "private_0x0000004462f30000" filename = "" Region: id = 3545 start_va = 0x7ff649e78000 end_va = 0x7ff649e79fff entry_point = 0x0 region_type = private name = "private_0x00007ff649e78000" filename = "" Region: id = 3546 start_va = 0x7ff649e7a000 end_va = 0x7ff649e7bfff entry_point = 0x0 region_type = private name = "private_0x00007ff649e7a000" filename = "" Region: id = 3547 start_va = 0x7ff8ea5c0000 end_va = 0x7ff8ea61cfff entry_point = 0x7ff8ea5c0000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3548 start_va = 0x7ff8edb10000 end_va = 0x7ff8edbb4fff entry_point = 0x7ff8edb10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3549 start_va = 0x7ff8ea3c0000 end_va = 0x7ff8ea467fff entry_point = 0x7ff8ea3c0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 3550 start_va = 0x4460ce0000 end_va = 0x4460ce0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004460ce0000" filename = "" Region: id = 3551 start_va = 0x7ff8e1c70000 end_va = 0x7ff8e1ee6fff entry_point = 0x7ff8e1c70000 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 3552 start_va = 0x4463030000 end_va = 0x446310efff entry_point = 0x4463030000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 3553 start_va = 0x4463110000 end_va = 0x4463110fff entry_point = 0x4463110000 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 3554 start_va = 0x4463120000 end_va = 0x4463126fff entry_point = 0x0 region_type = private name = "private_0x0000004463120000" filename = "" Region: id = 3555 start_va = 0x44631a0000 end_va = 0x44631affff entry_point = 0x0 region_type = private name = "private_0x00000044631a0000" filename = "" Region: id = 3556 start_va = 0x44631b0000 end_va = 0x44632affff entry_point = 0x0 region_type = private name = "private_0x00000044631b0000" filename = "" Region: id = 3557 start_va = 0x7ff8e72a0000 end_va = 0x7ff8e72b5fff entry_point = 0x7ff8e72a0000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 3558 start_va = 0x7ff8e7280000 end_va = 0x7ff8e7299fff entry_point = 0x7ff8e7280000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 3559 start_va = 0x44632b0000 end_va = 0x44634affff entry_point = 0x0 region_type = private name = "private_0x00000044632b0000" filename = "" Region: id = 3560 start_va = 0x44634b0000 end_va = 0x44635affff entry_point = 0x0 region_type = private name = "private_0x00000044634b0000" filename = "" Region: id = 3561 start_va = 0x7ff649e76000 end_va = 0x7ff649e77fff entry_point = 0x0 region_type = private name = "private_0x00007ff649e76000" filename = "" Region: id = 3562 start_va = 0x7ff8dcbd0000 end_va = 0x7ff8dcc4ffff entry_point = 0x7ff8dcbd0000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 3563 start_va = 0x4463130000 end_va = 0x4463134fff entry_point = 0x4463130000 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 3564 start_va = 0x4463140000 end_va = 0x446314ffff entry_point = 0x4463140000 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 3565 start_va = 0x7ff8e2ea0000 end_va = 0x7ff8e2ea9fff entry_point = 0x7ff8e2ea0000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 3566 start_va = 0x4463150000 end_va = 0x4463152fff entry_point = 0x4463150000 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 3567 start_va = 0x7ff8e7160000 end_va = 0x7ff8e71c7fff entry_point = 0x7ff8e7160000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 3568 start_va = 0x7ff8ea150000 end_va = 0x7ff8ea1c3fff entry_point = 0x7ff8ea150000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 3569 start_va = 0x4463160000 end_va = 0x4463161fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004463160000" filename = "" Region: id = 3570 start_va = 0x7ff8e3170000 end_va = 0x7ff8e3183fff entry_point = 0x7ff8e3170000 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 3571 start_va = 0x44635b0000 end_va = 0x44636affff entry_point = 0x0 region_type = private name = "private_0x00000044635b0000" filename = "" Region: id = 3572 start_va = 0x7ff649e74000 end_va = 0x7ff649e75fff entry_point = 0x0 region_type = private name = "private_0x00007ff649e74000" filename = "" Region: id = 3573 start_va = 0x7ff8e52f0000 end_va = 0x7ff8e530efff entry_point = 0x7ff8e52f0000 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 3574 start_va = 0x4463170000 end_va = 0x4463179fff entry_point = 0x4463170000 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui") Region: id = 3575 start_va = 0x44636b0000 end_va = 0x44637affff entry_point = 0x0 region_type = private name = "private_0x00000044636b0000" filename = "" Region: id = 3576 start_va = 0x7ff649e72000 end_va = 0x7ff649e73fff entry_point = 0x0 region_type = private name = "private_0x00007ff649e72000" filename = "" Region: id = 3577 start_va = 0x7ff8e9cd0000 end_va = 0x7ff8e9cf2fff entry_point = 0x7ff8e9cd0000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 3578 start_va = 0x7ff8ea270000 end_va = 0x7ff8ea2a2fff entry_point = 0x7ff8ea270000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3579 start_va = 0x7ff8ea620000 end_va = 0x7ff8ea636fff entry_point = 0x7ff8ea620000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Thread: id = 317 os_tid = 0x9d4 Thread: id = 318 os_tid = 0x73c Thread: id = 319 os_tid = 0x378 Thread: id = 320 os_tid = 0xea8 Thread: id = 321 os_tid = 0xef0 Thread: id = 322 os_tid = 0xdec Thread: id = 323 os_tid = 0xe04 Thread: id = 324 os_tid = 0x67c Thread: id = 325 os_tid = 0xa98 Thread: id = 326 os_tid = 0x6c4 Thread: id = 327 os_tid = 0xe84 Thread: id = 328 os_tid = 0x350 Thread: id = 329 os_tid = 0x304